Re: .US Harbors Prolific Malicious Link Shortening Service

2023-11-07 Thread John Levine
It appears that Eric Kuhnke said: >-=-=-=-=-=- > >I've seen a US based ISP do its internal management network reverse DNS >using '.us' as a suffix, where the hierarchy is like POP name, then >city/airport code, then state (eg: CA, NJ, FL), then .us for geographical >location of equipment in USA.

Re: .US Harbors Prolific Malicious Link Shortening Service

2023-11-06 Thread Eric Kuhnke
I've seen a US based ISP do its internal management network reverse DNS using '.us' as a suffix, where the hierarchy is like POP name, then city/airport code, then state (eg: CA, NJ, FL), then .us for geographical location of equipment in USA. The .us domain in question was owned by the same

Re: .US Harbors Prolific Malicious Link Shortening Service

2023-11-06 Thread Jay R. Ashworth
- Original Message - > From: "Seth Mattinen via NANOG" > On 11/2/23 1:30 PM, goemon--- via NANOG wrote: >> Are there any legitimate services running solely on .us domain names? > > Yes. Though not -- by several orders of magnitude -- nearly as many as there should be... but let's not

Re: .US Harbors Prolific Malicious Link Shortening Service

2023-11-05 Thread Seth Mattinen via NANOG
On 11/2/23 1:30 PM, goemon--- via NANOG wrote: Are there any legitimate services running solely on .us domain names? Yes.

Re: .US Harbors Prolific Malicious Link Shortening Service

2023-11-04 Thread Eric Harrison
K-12 education is typically in *.us -Eric On Thu, Nov 2, 2023 at 1:32 PM goemon--- via NANOG wrote: > > https://krebsonsecurity.com/2023/10/us-harbors-prolific-malicious-link-shortening-service/ > > "The NTIA recently published a proposal that would allow registrars to > redact all registrant

Re: .US Harbors Prolific Malicious Link Shortening Service

2023-11-04 Thread William Herrin
On Sat, Nov 4, 2023 at 8:54 AM wrote: > Yeah. I wonder why this cannot be reversed really? > First domain registration should cost more.. 50 USD maybe? Dunno. > And then, when you want to extend the domain, price should be > around 5 times lower? Maybe go the other way: you have to pay the same

Re: .US Harbors Prolific Malicious Link Shortening Service

2023-11-04 Thread John McCormac
list Subject: Re: .US Harbors Prolific Malicious Link Shortening Service Date: Thu, 2 Nov 2023 20:39:17 -0700 Not specific to .US really Pretty much every new gTLD that can be registered on "promotional" first year prices below .com/.net/.org harbors a large than usual proportion of phishi

Re: .US Harbors Prolific Malicious Link Shortening Service

2023-11-04 Thread borg
message -- From: Eric Kuhnke To: goe...@sasami.anime.net Cc: NANOG list Subject: Re: .US Harbors Prolific Malicious Link Shortening Service Date: Thu, 2 Nov 2023 20:39:17 -0700 Not specific to .US really Pretty much every new gTLD that can be registered on "promotional" first y

Re: .US Harbors Prolific Malicious Link Shortening Service

2023-11-02 Thread Eric Kuhnke
Not specific to .US really Pretty much every new gTLD that can be registered on "promotional" first year prices below .com/.net/.org harbors a large than usual proportion of phishing domains and suspicious things, because one of the sole operational criteria for phishers registering disposable

Re: .US Harbors Prolific Malicious Link Shortening Service

2023-11-02 Thread bzs
On November 2, 2023 at 22:09 al...@allan.vin (Allan Liska) wrote: > I think it is a matter of proportionality. > > According to Spamhaus malicious domains account for only 1.5% of all .com > domains, but 4.8% of all .us domains > (https://www.spamhaus.org/statistics/tlds/) - compare

Re: .US Harbors Prolific Malicious Link Shortening Service

2023-11-02 Thread William Herrin
On Thu, Nov 2, 2023 at 3:10 PM Allan Liska wrote: > According to Spamhaus malicious domains account for only 1.5% of all .com > domains, but 4.8% of all .us domains > (https://www.spamhaus.org/statistics/tlds/) - compare that to .tk where 6.7% > of all domains are malicious. Hi Allan,

Re: .US Harbors Prolific Malicious Link Shortening Service

2023-11-02 Thread Rubens Kuhl
On Thu, Nov 2, 2023 at 5:46 PM William Herrin wrote: > > On Thu, Nov 2, 2023 at 1:30 PM goemon--- via NANOG wrote: > > https://krebsonsecurity.com/2023/10/us-harbors-prolific-malicious-link-shortening-service/ > > > > What hope is there when registrars are actively aiding and abeting criminal >

Re: .US Harbors Prolific Malicious Link Shortening Service

2023-11-02 Thread Allan Liska
I think it is a matter of proportionality. According to Spamhaus malicious domains account for only 1.5% of all .com domains, but 4.8% of all .us domains (https://www.spamhaus.org/statistics/tlds/) - compare that to .tk where 6.7% of all domains are malicious. allan --- Original

Re: .US Harbors Prolific Malicious Link Shortening Service

2023-11-02 Thread Richard Holbo
There are LOTS of small business that have .us domains. I've got several that just use these domains as well as locality specific things such as schools or towns that use them rather than the longer ones supplied to municipal entities. /rh On Thu, Nov 2, 2023 at 1:34 PM goemon--- via NANOG

Re: .US Harbors Prolific Malicious Link Shortening Service

2023-11-02 Thread William Herrin
On Thu, Nov 2, 2023 at 1:30 PM goemon--- via NANOG wrote: > https://krebsonsecurity.com/2023/10/us-harbors-prolific-malicious-link-shortening-service/ > > What hope is there when registrars are actively aiding and abeting criminal > enterprises? I'm confused. Does .com/.net/.org have a

RE: .US Harbors Prolific Malicious Link Shortening Service

2023-11-02 Thread Shawn L via NANOG
I personally own a .us domain name -- while it's a personal domain and doesn't do a lot of traffic, it's still a legitimate domain. -Original Message- From: "goemon--- via NANOG" Sent: Thursday, November 2, 2023 4:30pm To: "NANOG list" Subject: .US Harbors Prolific Malicious Link