Should Hosting Companies Be On The Lookout For Phishing Sites?
from the whose-responsibility? dept
Part of the trouble with phishing attacks is that it's a combination of different things, including setting up a misleading domain, spamming people, and then tricking recipients into filling out their info. That means there are also multiple ways of trying to crack down on phishing scams, from education to stopping spam to checking to see if site URLs are really owned by the company in question. However, one other method may be to stop questionable looking URLs from being registered in the first place. Anti-spam group Spamhaus ran a quick study and noticed that some major hosters, such as Yahoo, seem to be hosting a lot of URLs that have the words eBay, PayPal or bank in the URL. That may be a cause of some concern, but it's not illegal to have such a domain name (unless it's done in a way that violates trademark by confusing visitors). Obviously, though, domains like that may deserve greater scrutiny to see if they're being used in phishing scams. So, the question is, who is responsible for the checking? Should hosting sites and registrars monitor the domain names that are hosted and registered with them? Or does that go beyond their responsibility?
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Reader Comments
Subscribe: RSS
View by: Time | Thread
At least the ISPs and hosting houses can respond t
These things can persist for days, weeks, and months, however.
[ link to this | view in thread ]
Re: At least the ISPs and hosting houses can respo
Yes, hosters do have a upmost responsibility to respond in a more-than-timely manner to complaints about phishing activities. Any host that does not respond in a timely fashion should be taken down by thier ISP (I feel).
However, it simply is not possible to check all urls and all domain names to see if any one of them have any phishing activity. Yes, hosters should have a flag system - where they flag new customers with suspicious domains internally and check in from time to time (as I do). However, even domains with not-obvious names can be used for bad purposes, and domains with phishing-sounding names can be legit.
Worse still is that with each new domain registered, there is no history with that client to say they wont put phishing pages on thier site. With the transfer of existing domains, you can see the customers old content and check them out - but with new domains, its blind faith.
Even domains that the hoster has had for years can suddenly go bad - as some have for us. Even years of good service and a good domain, they decided that they couldnt be caught, and were taken offline by us at the first complaint.
Again - with all the thousands of domains we host, and the sheer numbers of URLs possible in those domains, it is NOT possible to proactively check each web page. But a agressive responce policy to complaints and a general 'checking out' of customers sites can help the community as a whole avoid these issues.
[ link to this | view in thread ]