Understanding Domain Name Rules

A domain name usually consists of two parts separated by a period. Sometimes a domain with a country code, such as UK for the United Kingdom, consists of three parts. An example is the British newspaper the Daily Mirror at mirror.co.uk.
Domain names are not case sensitive. GOOGLE.com and Google.com and google.com are the same thing.
Domain names can contain numbers. For example, 2600.com belongs to a hacker group.
Domain names can contain dashes, though most do not. I own michaelhorowitz.com. If another person named Michael Horowitz (there are many of us) wanted their own domain, they could register michael-horowitz.com. This would have no relationship to me at all. Likewise michaelhorowitz123.com would also have nothing to do with me.
Domain names can not contain periods. Periods separate a domain from its sub-domains (more on sub-domains below). For example, in www.google.com, the three Ws are not part of the domain name, they are a sub-domain. Likewise, in thing1.thing2.google.com the domain is still google.com, and "thing1.thing2" is a sub-domain.
To illustrate how a slash ends the domain name, all the web pages below are at the same domain:
  defensivecomputingchecklist.com/somepage.html
  defensivecomputingchecklist.com/blog/anotherpage.php
  defensivecomputingchecklist.com/august/comments/anotherpage.htm
  defensivecomputingchecklist.com/audio/2022/july/listentome.mp3

Some web browsers offer a hint about the domain name by displaying it in bold on the address bar. Below is an example of this; it shows the address bar when this page is displayed by Firefox on Windows.

Below is anther example of this, using the Brave browser in Windows, in incognito mode, which displays the domain name in white.

That said, the above example is wrong. As noted above, the three Ws are, technically, not part of the domain name. In this example of www.irs.gov, the three Ws are not bold, correctly showing that the domain name is irs.gov.
Sub-domains help big organizations logically chop themselves into smaller pieces. Again, the classic three Ws to the left of the domain name is a sub-domain. Any string of letters, dashes and numbers can be at the left of the domain name. No matter what's there, it is all part of the same domain. Sub-domains are optional. This website, for example, has none. There can be an unlimited number of subdomains for any one domain. Some examples of subdomains:
1. A large university has many departments. Typically, each would get its own sub-domain. Consider, for example, Columbia University.
  
  The Chemistry Department is chem.columbia.edu, Biological Sciences is biology.columbia.edu, the Math Department is math.columbia.edu, Astronomy and Astrophysics is at astro.columbia.edu, the Law School is law.columbia.edu, the Cancer Center is cancer.columbia.edu and the Visitors Center is visit.columbia.edu.
2. A large company also has many divisions/projects and thus, subdomains. Consider Google
  
  Many of us get news at news.google.com, Financial information is at finance.google.com, Gmail is at both mail.google.com and gmail.google.com, their AI is at bard.google.com, the Chrome browser can be downloaded at chrome.google.com, you can register domains at domains.google.com, their cloud storage is drive.google.com, their Calendar is calendar.google.com and Google Docs is at docs.google.com
  Interestingly email.google.com does not exist. Neither does chromebook.google.com (it is instead at google.com/chromebook). Rather than using android.google.com, Google instead uses google.com/android or just android.com. Whew.
3. Sub-domains can have their own sub-domains.
  At Columbia University, the Irving Medical Center is cuimc.columbia.edu and their Biochemistry division is biochem.cuimc.columbia.edu
4. This website is DefensiveComputingChecklist.com
  - Defensive.ComputingChecklist.com (with a period between Defensive and Computing) is not this website. It is the "Defensive" sub-domain of the ComputingChecklist.com domain.
  - defensive.computing.Checklist.com (periods between each word) is the "defensive.computing" sub-domain of the Checklist.com domain. This also illustrates that domain names are not case sensitive.
  - Defensive-Computing.Checklist.com is the "defensive-computing" sub-domain of the Checklist.com domain.
5. The domain citi.com belongs to Citibank. Simple rule: anything that ends with ".citi.com" (note the leading period) is also Citibank. For example:
     Secure.citi.com
     jobs.Citi.com
     online.citi.com
     a.b.c.d.e.CITI.COM
     some-thing-else.citi.com
     any.thing.at.all.citi.com
  are all valid sub-domains of citi.com.
6. The flip side of the last example is that just having "citi" in a domain name means nothing. For example, these domain names have no relationship to Citibank:
     citionlinebanking.com
     citi-online-banking.com
     citi.onlinebanking.com
     citi-thebank.com
     citibank-online.com
     citibankingonline.com
     secureciti.com
     TrustUsWeAreCitibank.com
  Again, valid Citibank domains end with ".citi.com". Citibank probably has other valid domains too, large companies often do. For example, entering bn.com in a web browser, will take you to barnesandnoble.com. Bookseller Barnes and Noble owns both domains.

Off topic: The security of each sub-domain is a free agent. That is, one subdomain may implement SSL/TLS security well and another subdomain may implement it quite poorly. You can test the security of a domain or a subdomain at the Qualys SSL Server Test. Old people in the US care about Social Security. While the website is www.ssa.gov, the section where you login to your account is secure.ssa.gov. Years back, I blogged about how the "secure" sub-domain was not very secure. Now it is.

FYI: Microsoft is sloppy with their sub-domains which has led to some being stolen every now and then. On Jan. 12, 2021, Maik Morgenstern tweeted that he took ownership of covid19testing.microsoft.com thanks to Microsoft being incompetent.

The full web page identifier (URL to techies) consists of sub-domains on the left, a domain name in the middle, a slash, and finally, the name of the specific web page on the website. The slash is critical as it indicates the end of the domain name and the start of the page name. The only component that is mandatory, is the domain name. When a specific web page is not requested, the web server software always has a default web page, the home page, ready to go.
This page offers a very simple example. The full web page address is
defensivecomputingchecklist.com/DomainNameRules.php
where defensivecomputingchecklist.com is the domain name and DomainNameRules.php is this specific web page. Even this simple example shows how important the first slash is for marking the end of the domain name. Replace this slash with a period and everything changes. If you saw the below in your web browser
defensivecomputingchecklist.com.DomainNameRules.php
the domain name would be DomainNameRules.php and the subdomain would be defensivecomputingchecklist.com.

A more complicated example of a URL can be found at the IRS website of the US government. Anyone who wants to work for the IRS ends up at
www.jobs.irs.gov/application-process/application-process/how-apply where
www.jobs is the subdomain
irs.gov is the domain name, and
application-process/application-process/how-apply is the specific web page at the IRS website.
Not that it matters for Defensive Computing, but file, folder and individual web page names may or may not be case sensitive. It depends on the operating system running the web server software. Again, domain names and sub-domain names are not case sensitive. In the case of this page
defensivecomputingCHECKLIST.com/DomainNameRules.php
would display this page because the domain name is not case sensitive,
but
defensivecomputingCHECKLIST.com/domainnamerules.php
would return a "Page Not Found" error because this website runs under Linux which has case sensitive file/folder names.
Top Level Domains: And, of course, dot com is not the only thing that website/domain names end with. Sure, apple.com is the company that makes iPhones, what about
apple.talk apple.org apple.gov
apple.fail apple.us apple.cn
apple.jobs apple.app apple.me
apple.site apple.edu apple.biz
apple.name apple.io apple.store
apple.tech apple.net apple.top
apple.movie apple.tv apple.theater
They may belong to the iPhone vendor, they may not. Some of these do, some do not. Assume nothing. Citibank customers, accustomed to online banking at citi.com, should not assume that citi.somethingelse also belongs to their bank. That's not the way the system works.

An extreme example of scam websites using what appears to be a valid name was the JoeBiden.info website. That scam site (New York Times June 2019) was created by Republicans working for Donald Trump. The actual Joe Biden website during the 2020 Presidential campaign was joebiden.com.
Country Code Top-Level Domains September 1, 2023: Great article by Brian Krebs: Why is .US Being Used to Phish So Many of Us? .US is the "country code top-level domain" (aka ccTLD) for the United States. Most countries have their own, for example .CA is for Canada and .UK is for the United Kingdon. New research shows that .US domains are among the most prevalent in phishing scams. This is noteworthy because .US is overseen by the U.S. Government and these domains are only supposed to be available to U.S. citizens or to those who can demonstrate that they have a physical presence in the United States. How bad is the scam problem? The Interisle Consulting Group examined six million phishing reports and found 30,000 different .US scam domains. Who in the US Government is doing such a miserable job? GoDaddy.

Bad guys abuse everything there is to abuse, when it comes to domain names.

One trick is to use a legitimate domain name as a sub-domain. For example: citi.com.badguy.com is part of the badguy.com domain, and login.citi.com.securebanking.com is part of the securebanking.com domain. Leo Notenboom, in an article about domain name rules from 2010, offers an extreme example of this type of scam:
www.paypal.com————————————————————.somerandomservice.com
where bad guys are gambling that the web browser will not display the full web page address. That is, victims only see www.paypal.com in the browser address bar and do not see the actual domain name, which is somerandomservice.com. In May 2019 Eset found multiple examples of this type of scam. They reported that update.asuswebstorage.com.ssmailer.com was pretending to be part of the Asus Web Storage system and they also found bad guys using www.google.com.dns-report.com. In November 2021, Cory Doctorow wrote about the time he was scammed this way. The URL was twitter.com.badguywebsite.com (more or less) and the web browser on his mobile phone only displayed twitter.com.
The reverse is yet another scam. Instead of tricking people with a legitimate domain name to the left of the scam domain, bad guys also trick people by putting the legitimate domain name to the right of the scam domain. This fools anyone who is not clued in to the critical nature of the first slash character (it denotes the end of the domain name). For example: badguy.com/citi.com and www.securebanking.com/citi.com are not Citibank.
For an excellent article on the above two tricks, see How Can I Tell If a Web Address Is Safe? by Leo A. Notenboom. March 25, 2024.
Then too, there are typos. What if someone leaves out the period after the "www"? Turns out that Citibank owns the domain wwwciti.com however, they do not own wwwcitibank.com which (as of March 2020) is for sale. When I go to citi.com, I end up at online.citi.com. Perhaps the best fraudulent domain is onlineciti.com. If you ignore the one missing period, it looks legit. When I checked in June of 2019, this domain was available for bad guys to buy. Oh, and citibankonline.com is really Citibank.
Another wrinkle on this is that a bad guy might leave out the period before "com". For example, citicom.io/securelogin is not Citibank. This scam can be aided by the fact that there are hundreds of TLDs that most people will not recognize. The "io" used in this example is somewhat popular.
The official term for this type of trick is typosquatting.
Google owns the typosquat domain googel.com and re-directs it to google.com. Good for them.
Another way eyesight can be abused is citi.corn.io/login where the "r" and the "n" can blend together to look like an "m". Much depends on the font (citi.corn.io or citicom.io) and the victim expecting to see an "m".
In October 2021, the Washington Post wrote about domain name scams: Read that link carefully: Scammers scoop up misspelled cryptocurrency URLs to rob your wallet. The focus was on a missing period/dot (wwwblockchain.com pretending to be www.blockchain.com) and a simple typo (conibase.com pretending to be coinbase.com). Also mentioned were look-alike letters (hlockchain.com and blpckchain.com pretending to be blockchain.com). I have seen that the look-alike domain protonmaii.com re-directs to the actual protonmail.com domain. It is not clear who owns the domain.
Still another trick involves a scam site on a legit domain. This gives the scammer the green lock seal of approval. For example:
1. The Microsoft Azure system lets customers create websites addressable as a subdomain of their legitimate windows.net domain. Bad guys abusing this have used names like capitalexchangowa.z29.web.core.windows.net. Read more and see an example.
2. Bad guys have also been seen abusing Azure, with scam sites something like badguys.azurewebsites.net.
3. A couple Paypal Credt Card phishing sites were hosted at
  forms.office.com/Pages/ResponsePage.aspx?id=somethinglong
4. Cloudflare's IPFS gateway lets customers use a URL such as
  cloudflare-ipfs.com/ipfs/customer-files-go-here
  If the customer file is an HTML form, asking for a password, then it gets blessed with a Cloudflare certificate and it looks legit to people who have not read this.
5. This Jan 2020 article describes how bad guys create fake web pages at sway.office.com, and since this domain really belongs to Microsoft, it fools both people and defensive software.
In a different scam, you start out at a legitimate domain and then get automatically re-directed to the bad guys. The legitimate domain is not run by bad guys, just by nerds that are technically incompetent. This is simply bad programming. The home office of incompetence is, of course, the US Government and many government websites were found to have this problem. Examples:
www.weather.gov/cgi-bin/nwsexit.pl?url=http://badguys.com
outreach.senate.gov/iqextranet/iqClickTrk.aspx?redirect=https://badguys.com
healthfinder.gov/api/outlink/search/http/badguys.com
www.nyc.gov/html/exit-page.html?url=https://badguys.com
Background info:
   A Year Later, U.S. Government Websites Are Still Redirecting to Hardcore Porn (Dell Cameron June 2019)
   Phishing campaign spoofs local-government websites to rip off small businesses (Benjamin Freed June 2019)
   How Phishers Are Slinking Their Links Into LinkedIn by Brian Krebs. February 3, 2022
In March 2020 I learned about a new scam that employed two different tricks. It looked like this:
http.ps//something.com
Do you see the two tricks here?
First, the domain is http.ps. The country code "ps" is the State of Palestine. Other popular country codes are "ly" for Libya (as in bit.ly), "me" for Montenegro and "tv" for Tuvalu. So, this is not processed as a command to use the HTTPS protocol (which a victim would assume if they did not notice the period) it is taken to mean go to the website "http.ps"
The second trick is the use of two slashes instead of one. I had to look this part up. Turns out that the treatment of two consecutive slashes is up to the web server software and bad guys only need one web server product to play along to make this trick look so convincing. What this is actually doing is
http.ps/something.com
which you can think of as
http.ps/folderxyz
Folders are allowed to contain periods in their names.
These tricks end up displaying the default web page in the directory "something.com" at the Palestinian website, "HTTP".
Below is another way to look at this scam, where something plainly obvious is transformed into something sneaky:
https://http.org/somethingcom/index.html
https://http.ps/somethingcom/index.html
https://http.ps/something.com/index.html
https://http.ps/something.com
https://http.ps//something.com
http.ps//something.com
This was written up by Brian Krebs and Jérôme Segura.
A hat tip to Leo Notenboom for including a scam I had overlooked when I first wrote this section - the hex encoding of characters. A percent sign followed by two hexadecimal (never mind) characters is allowed in domain names. The most likely abuse would be using %2F instead of a slash, %2E as a period and %2D instead of a dash. For example, this link to my https://RouterSecurity%2eorg site works just fine with %2E standing in for the period before "org". Here are some examples of domains with sneaky, but legitimate, representations:
www.nyu.edu --> www%2enyu%2eedu
citi.com.badguy.com --> citi.com%2ebadguy%2ecom
www.securebanking.com/citi.com --> www.securebanking%2ecom%2fciti.com
accounts.google.com--login.com/gmail.com --> accounts.google.com%2d%2dlogin%2ecom%2fgmail.com
In March 2021, I learned of another scam. To get malicious links in email messages past assorted filters bad guys are mis-typing the link on purpose. Instead of
https://badguys.com
they type the link as
https:/\badguys.com
The second slash is replaced with a backslash. This should not work. Clicking on a link like this should produce an error message. But, too many web browsers try to be helpful and treat this as if it was typed correctly.

Unicode and Punycode can also be abused to create look-alike domains that really really look alike. This was first publicized in April 2017 by Xudong Zheng: Phishing with Unicode Domains. He pointed out that unicode in domain names can fool people because many Unicode characters are difficult to distinguish from common ASCII characters. For example, the domain "xn--pple-43d.com" looks like "аpple.com" because "аpple.com" uses the Cyrillic "а" (U+0430) rather than the ASCII "a" (U+0061). The pictures in Zheng's article illustrate it much better.

Other terms for this are a homoglyph attack, an International Domain Name (IDN) attack and a homograph attack
Chrome was updated in version 58, but the fix was insufficient. As of Chrome version 106 (current as of October 2022), there is still no fix or defense from this (see below). By Feb. 2018, Firefox had a configuration parameter that fixed this. See Show IDN punycode in Firefox to avoid phishing URLs by Mattias Geniar. As of Firefox 106, this seems to be the default (see screen shot of multiple browsers below).
Disneyland Malware Team: It’s a Puny World After All by Brian Krebs. November 16, 2022. Quoting: "A financial cybercrime group calling itself the Disneyland Team has been making liberal use of visually confusing phishing domains that spoof popular bank brands using Punycode ...".

EXAMPLE
One malicious domain in the above article is
www.xn--meripris-mx0doj.com
which translates to
www.ameriprise.com

In November 2022, I tested current versions of four web browsers (in Windows) to see how they would display this. As you can see here, only Firefox offered a visual clue of the scam. Chrome, Edge and Brave assist the bad guys by displaying a spec of dust below the a and e.

Not only do the scam domains look like the real thing in the address bar, but it is trivial for the bad guys to get a valid certificate and make the look-alike site look even more like the real thing. In July 2021, a scam copy of the brave.com website turned up in ads on Google searches when people searched for the Brave web browser using Chrome. See With help from Google, impersonated Brave.com website pushes malware in Ars Technica.
October 19, 2023: Yet again. Google-hosted malvertising leads to fake Keepass site that looks genuine by Dan Goodin for Ars Technica. The malicious ad used a punycode URL that linked to a scam copy of the Keepass password manager website, keepass.info. The URL was: xn--eepass-vbb.info and the article said "Posting ķeepass[.]info into all five major browsers leads to the imposter site." That was not my experience. On Windows 10, both Brave and the Mullvad browser warned that the scam URL was Suspected Phishing. Firefox displayed the URL as xn--eepass-vbb.info which makes it obvious that something was wrong. Only Chrome did nothing to protect us, one of many reasons I recommend against using Chrome.
Defense: NextDNS offers protection from IDN Homograph attacks. See a screen shot. To me, this is the best defense.
Defense: typing the URL manually, using a bookmark, using Firefox with the option to prevent this enabled, checking the certificate vouching for a secure website.
Defense: The mobile app of your bank would avoid this but it may bring its own set of problems.
Defense: Don't let dust get on your computer screen.
Defense: Not sure how much help a Whois query would be.
Defense: ProtonMail includes protection from Homograph attacks.
Background: Out of character: Homograph attacks explained by Jovi Umawing of MalwareBytes October 2017.
Background: Hackers often use this clever trick to take you to phishing sites - can you spot it? by Anthony Spadafora for Toms Guide. January 23, 2023. I could not spot it. The article has an example with a scam version of www.citibank.com that shows just how hard it is to spot, visually.
Background: Punycode at Wikipedia
Background: Look-Alike Domains and Visual Confusion by Brian Krebs (March 2018). The article makes it seem that all browsers offer protection except Firefox. Even if that was true at the time, the reverse is true as of November 2022 (see screen shot above). The article also points out that a bad guy could get a certificate from Comodo.com for domain that uses punycode.

In an attack called Domain Shadowing, bad guys compromise the registration of a legitimate domain and create new malicious sub-domains. For example, if bad guys compromised the citi.com domain, they would do nothing to existing domains and sub-domains such as
www.citi.com or secure.citi.com or creditcards.citi.com
But, they would create new malicious sub-domains such as
s-e-c-u-r-e.citi.com and we.fooled.you.citi.com
See Domain Shadowing: A Stealthy Use of DNS Compromise for Cybercrime by Janos Szurdi, Rebekah Houser and Daiping Liu of Palo Alto Networks (September 2022). Needless to say, Palo Alto has a fix for this. Quoting the report: "Domain shadowing is a subcategory of DNS hijacking, where attackers attempt to stay unnoticed. First, cybercriminals stealthily insert subdomains under the compromised domain name. Second, they keep existing records to allow the normal operation of services such as websites, email servers and any other services using the compromised domain."
The most technically advanced attack: When everything else is good, you can still be scammed. Yes, (for example) the citi.com website you are looking at in your web browser can be a scam, even with the standard lock indicating security and with citi.com correctly spelled. This is because the source of the lock icon can also be a scam. To check on this you need to look at the certificate that is the source of the lock icon. It is possible to display the certificate, but over the years this has been made harder and harder as it gets buried behind multiple clicks. And, even when you find it, there is no system that tells you what the certificate should look like. For more on this see: Mysterious company with government ties plays key internet role from the Washington Post (November 2022) and HTTPS Fingerprints by Steve Gibson which goes into a lot of detail.
In May 2023, Google started offering domain names that end with .zip and .mov. Bad on Google. As for terminology, these are Top Level Domains, aka TLDs. Popular TLDs are .com and .org. I have to do some more research on the tricks bad guys will use with these domains. Here is a starting point.
1. The Dangers of Google’s .zip TLD by Bobbyr May 16, 2023
2. File Archiver In The Browser by mr.dox May 22, 2023. The article explores a phishing technique that emulates a file archiver software in the browser while using a .zip domain.
The at sign: At signs (this => @) in a URL should be taken as an indication that the URL is a scam. At signs belong in email, not after HTTP or HTTPS. Yes, this a URL thing, not a domain name thing, but close enough for Defensive Computing.
In the old days, web browsers let you log into a website using a userid/password that was in the URL. For example
https://user123:passwordxyz@somewebsite.com
was a thing in the early days of the Internet. The website somewebsite.com would log you in as user123 with password passwordxyz if you clicked on that link. Some web browsers still support this, others do not. When a browser does not support this scheme, it would take you to somewebsite.com without logging in. So, a possible scam is
https://goodwebsite.com@badwebsite.com
which will take you to the bad website. I tested this with Firefox and Chrome on Windows 10. Chrome took me to badwebsite.com without fussing. Firefox, however, put up a warning and asked for confirmation before logging into the bad site. There are too many different browsers on too many different operating systems, for me to catalog how each one handles this issue.
Added this May 2023. The idea came from the article above by Bobbyr.
The unicode character ∕ (U+2215) looks exactly like a slash, but it is not. I don't have an obvious defense, other than putting every URL with a slash into an URL expander. Not very realistic.
April 2023: A deep3r look at lookal1ke attacks - new study reveals latest threat vectors by Infoblox. A 41 page PDF. They describe Homographs (née Homoglyphs), Typosquats, Combosquatting, Soundsquatting and other forms of lookalikes. Quoting: "This report describes the current threat landscape by showcasing real world examples ... Infoblox has been detecting lookalike domains for years and analyzes over 70 billion domain name system (DNS) events daily to find new and potential threats. For this paper, we focused on detections from January 2022 to March 2023. From over 300,000 lookalike domains, we’ve curated a set that highlights the challenges and risks associated with these attacks."
Report scam domains to Google Safe Browsing and Microsoft Smart Screen and Netcraft anti-Phishing. Registration not required. Links from Daniel Aleksandersen. You can also submit it to Sophos at their Submit a Sample page in the Web Address section.

The best defense comes from looking up who actually owns a domain. I know of two ways to do this.

The fast, simple approach is Google. If you have heard of a company but don't know their domain name, then do a Google search for the company name. For example, if you Google "coinbase", you will see that the first search result is www.coinbase.com, the legitimate domain. Just be sure that you are looking at the search results and not ads, as there have been scam ads that send victims to coinbases.org, which is a malicious clone of coinbase.com.

The more technical approach to research a domain name is to look at information from the Registrar.

Companies that register domains are called "Registrars" and they are required to make information about domains public. This database is referred to as "Whois" and, in the Whois system, the domain owner is referred to as the "Registrant." Some Registrars offering a Whois lookup are: Namecheap, Gandi, pair Domains, eNom and Tucows Domains. DomainTools also offers a Whois lookup.

If an honest company owns the domain, you should see the company name listed as the Registrant. Scammers will hide their name behind one of many different services that exist just for this purpose. That said, a domain owner may not want their contact information public. If you look up this domain (DefensiveComputingChecklist.com) for example, you will not find my home address. While people may want to hide, legitimate companies have no reason to do so. Note that this cloaking is not perfect, law enforcement can always knock on the door of a registrar to see who paid for a domain.

Someone I know needed the Whois system to see if they were being scammed. They use TD Bank whose website is tdbank.com. But they got a text message that claimed to be from the bank, telling them to go to td.com. Is td.com really TD Bank or is it a scam? Whois to the rescue :-)

Another thing to look for in the Whois report is the date that the domain was first registered. Scam domains tend to be new, legitimate domains tend to be old. A domain registered in the last few days, is pretty much guaranteed to be a scam. Other useful information provided by Whois, is a technical contact, an administrative contact, the name of the Registrar and, for techies, the authoritative DNS servers.

Another defense is a search engine. Searching for the company or software you want should turn up the real website rather than a scam site. That said, be careful of ads. Bad guys have often purchased ads, that show up before the search results, as a way to lure victims to their scam websites.

Finally, some domains are more likely to be scams than others. Yes, this is judging a book by its cover. From this article: Why Phishers Love New TLDs Like .shop, .top and .xyz by Brian Krebs (December 3, 2024).

Phishing attacks increased nearly 40 percent in the year ending August 2024, with much of that growth concentrated at a small number of new generic top-level domains (gTLDs) - such as .shop, .top and .xyz
A recent study found that gTLDs introduced in the last few years, were just 11 percent of newly registered domains, but, they accounted for 37 percent of the domains used in scams.
Bad guys like to abuse domains in the newer gTLDs (again, .shop or .xyz or .top) because registrars in charge tend to offer cheap or free registration with little to no account or identity verification requirements.
This past year, the U.S. Postal Service was, by far, the most-phished entity. Their real domain is usps.com. Interestingly, they do not use usps.gov. Second was Apple.
This may get worse as the ruling domain name entity plans on still more new gTLDs. Most likely, a money grab. They cash in, we get scammed.

January 21, 2025: Don't fall for the IRS scam by Susan Bradley for AskWoody.com. A scam text message pretends to be from the IRS and sends victims to www.irs.gov.tax-popular.com.

December 18, 2024: Brian Krebs wrote How to Lose a Fortune with Just One Bad Click about someone who lost control of their Gmail/Google account. In part, the victim was scammed by an email message sent from google.com. So, it must be legit? Nope. The article references this December 2023 article by Graham Cluley: Google Forms Used in Call-Back Phishing Scam. Suffice it to say, that the Google Forms system can be abused by bad guys to send victims scam emails that really come from google.com. As I write this, it has been over a year and Google has not fixed this problem.

October 25, 2024: Amazon seizes domains used in rogue Remote Desktop campaign to steal data by Bill Toulas of Bleeping Computer. Quoting: "Amazon has seized domains used by the Russian APT29 hacking group in targeted attacks against government and military organizations to steal Windows credentials and data ... APT29, also known as 'Cozy Bear' and 'Midnight Blizzard,' is a Russian state-sponsored cyber-espionage group linked to Russia's Foreign Intelligence Service (SVR)." The scam domains were made to appear as AWS (Amazon Web Services) domains. Among the many scam domains: us-east-1-aws.mfa-gov.cloud, awsplatform.online, aws-data.cloud, md-gov.cloud, s3-proofpoint.cloud, s3-knowbe4.cloud and s3-spacex.cloud.

October 9, 2023: Phishers Spoof USPS, 12 Other National Postal Services by Brian Krebs. About a common scan where victims get an SMS text message claiming to have been sent by the US postal Service, saying there was a problem with a package and a link to fix it. Some of scam domains cited in the article: usps.informedtrck.com, usps.receivepost.com, postreceive.com, usps.trckpackages.com, trackingusps.infortrck.com, tackingpos.com, usa-usps.shop and many more.

November 2022: In this article How social media scammers buy time to steal your 2FA codes Paul Ducklin disects a scam targeting Facebook users. Part of the scam involves domain names in the format facebook-help-nnnnnn. The bad guys claimed that the digits nnnnnn were a unique identifier for the victim.

November 2022: A Brian Krebs article mentioned ushank.com which was created to scam U.S. Bank customers.

October 2022: Typosquat campaign mimics 27 brands to push Windows, Android malware by Bill Toulas of Bleeping Computer. Quoting: "A massive, malicious campaign is underway using over 200 typosquatting domains that impersonate twenty-seven brands to trick visitors into downloading various Windows and Android malware. Typosquatting is an old method of tricking people into visiting a fake website by registering a domain name similar to that used by genuine brands. The domains used in this campaign are very close to the authentic ones, featuring a single letter position swap or an additional "s," making them easy for people to miss." Some examples: tocrproject.com pretended to be torproject.com. I have downloaded Notepad++ many times from notepad-plus-plus.org. Bad guys are trying to scam people using notepads-plus-plus.org. The Brave browser is at brave.com. Bad guys created braves-browsers.org.

In August 2022, I got this scam text message pretending to be from Citibank and using the scam domain citi-online-supported06a.com.

In August 2022, Cloudflare blogged about their experience with a scam domain name (The mechanics of a sophisticated phishing scam and how we stopped it). They use Okta's identity and access management services and the scam domain that employees received text messages to visit was cloudflare-okta.com which really looks legit. Cloudflare is very serious about shutting down scam domains. They monitor new domain registrations looking for those that contain their name, and they attempt to have them shut down ASAP. In this case, however, the domain had been registered less than 40 minutes before the scam text messages were sent.

In July 2022, we learned that bad guys are abusing IPFS, a somewhat rare file system where data is retrieved based on its content rather than its location. Since IPFS locations have, up till then, been considered safe, this gets around systems that look for bad domains. See Decentralized IPFS networks forming the 'hotbed of phishing' from The Register. Among the IPFS domains used in phishing emails were: cloudflare-ipfs.com, ipfs.infura-ipfs.io, googleweblight.com, ipfs.filebase.io, nftstorage.link and ipfs.fleek.co.

In May 2022, we learned this: U.S. DoD tricked into paying $23.5 million to phishing actor (from Bleeping Computer by Bill Toulas). Part of the scam involved domain names. Quoting: "... conspirators registered the domain dia-mil.com, which is very similar to the legitimate dla.mil, and used it to send phishing emails." The bad guys were pretending to be from the Defense Logistics Agency.

In December 2021, many outlets wrote about a TV newscaster in India that was scammed into quitting her job, providing tons of personal information and almost moving to Boston for a non-existing job at Harvard. This is from the New York Times: The Harvard Job Offer No One at Harvard Ever Heard Of. The bad guys used the domain HarvardCareer.com as part of the scam. This was a large scam, several journalists and media personalities in India were targeted. Despite being alerted to the scam, Harvard University did nothing. I write this months after the scam and Harvard still has not bothered to take ownership of HarvardCareer.com.

In November 2021, Brian Krebs wrote about scams focused on un-delivered packages that used the returns-fedex.com domain.

In October 2021, Brian Krebs wrote about a scam that used coinbase.com.password-reset.com to scam coinbase.com users.

Security firm Proofpoint registered some look-alike domain names to use in training their customers about common scams. Among the domains were facbook-login.com, facbook-login.net, instagrarn.ai, instagrarn.net, and instagrarn.org. Facebook learned about this and went after the registrar to get ownership of the domains transferred to Facebook. See Proofpoint drops lawsuit, transfers phishing domains to Facebook (August 2021)

In October 2020, I was searching for a specific Chromebook and one of the top search results was the website consumes.report. It is a scam (see screen shot), pretending to be Consumer Reports. Their real domain name is consumerreports.org.

This August 2020 article about phone based scams includes these actual scam domain names: bofaticket.com, helpdesk-att.com and vzw-employee.com. In discussing these particular scams, the author, Brian Krebs says: ...domains used for these pages often invoke the company's name, followed or preceded by hyphenated terms such as 'vpn,' 'ticket,' 'employee,' or 'portal.'

In April 2020 bad guys hacked into a Sophos firewall device and downloaded malware from sophosfirewallupdate.com which did not belong to Sophos.

In March 2020, Facebook sued domain registrar Namecheap for registering domains designed to trick people. Some cited examples: instagrambusinesshelp.com, facebo0k-login.com and whatsappdownload.site. In Oct. 2019, Facebook sued another registrar, OnlineNIC for registering domains such as www-facebook-login.com and facebook-mails.com.

For years, Microsoft has been disgraceful in how they handle their subdomains and, as a result, bad guys have been hijacking some of them. The domains cited as being miserably managed are microsoft.com, skype.com, office.com, msn.com, windows.com and xbox.com. Microsoft has been told about this many times, yet the problems linger. This is easily addressed, Microsoft is simply incompetent. It is fairly easy for bad guys to steal the vulnerable subdomains. Victims visiting something.office.com, for example, can be easily tricked into entering passwords that go directly to the bad guys. Recent accounts in the news from March 2020 are here and here. Two subdomains that researchers hijacked to demonstrate the problem were mybrowser.microsoft.com and identityhelp.microsoft.com. A video shows that the bad guys even got an SSL certificate for the subdomain they hijacked. This also made news in February 2020.

In Feb. 2020, I saw this scam text message on a phone. The domain citiunlocknow.com does not belong to Citibank.

In Nov. 2019, we learned of a fake payment service platform (PSP). Many small websites, rather than take credit cards directly, transfer their customers to a secure website run by a large ecommerce company such as Mastercard. An Australian company had their website hacked and instead of customers being transfered to the legitimate mastercard.com.au, they were sent to the scam site payment-mastercard.com.

This October 2019 article, Fake Tor Browser steals Bitcoin from Dark Web users notes that the scam domains tor-browser.org and torproect.org were used to lure victims. The real Tor website is torproject.org.

A September 2019 article about stolen iPhones included this scam, directed at someone whose iPhone had been stolen: "Your missing iPhone has been found by the police nearby and handed over to the Apple related department ... Please click apple-ios-id-gps.us/us and login to the Apple ID management system."

A June 2019 scam combined two methods. Pretending to be from British retailer Argos (argos.co.uk), bad guys at gknu.com sent phishing emails trying to get victims to go to
www.argos.co.uk.theninja.gknu.com/
www.argos.co.uk/account-login/
Note: this looks more convincing when viewed as a single string, but I broke it up into two lines for page display reasons.

In April 2019, Brian Krebs wrote about a service called Land Lords that creates Airbnb scams. A key piece of these scams are domains that look like airbnb.com, but, are not. The scam domain in the article was airbnb.longterm-airbnb.co.uk. It looked exactly like the real Airbnb website and requested victims to sign. The fake site forwarded the legit Airbnb credentials to the real Airbnb, but only after recording them. Other domains used to scam Airbnb were: airbnb.longterm-airbnb.co.uk, airbnb.request-online.com and airbnb-invoice.com. For another defense against this scam see the topic below on verified website identities.

When, also in April 2019, Krebs wrote about Wipro being hacked by phishing/scam email messages, the phony domain name he cited was
securemail.wipro.com.internal-message.app
Who even knew that a legitimate domain name can end in dot app? The bad guys loved using their internal-message.app domain so much they also may have used
securemail.capgemini.com.internal-message.app to scam employees of CapGemini.

The squidblacklist.org site maintains lists of bad domains. Their DNS Malicious Zone file has thousands of malicious domains, some of which are clearly designed to fool people. Just looking for Microsoft related domains turns up: accountsmicrosoft.com, microsoft.com-windows-cleaner-pc.live, drives-microsoft.com, livemicrosoftsupports.com, loginmicrosoftsonline.com, login.microsoftonline.com.atomysales.com, microsoft-0ffice365.com, microsoft365drive.com and microsoftcustomercares.com.

Arguably the biggest domain name screw-up ever, was by Equifax in 2017. I say this not because they were hacked, but because of their reaction. The Equifax domain is equifax.com. To post their response to the hacking incident, they created a new website: equifaxsecurity2017.com. They should have named their response website something like security2017.equifax.com or equifax.com/security2017. A techie exposed Equifax for the fools they are by registering a scam website securityequifax2017.com. In the ultimate irony, the official Equifax twitter account, sent people to the scam site. You can't make this stuff up. And, now that you have read this far, you know more about domain names than the techies at Equifax.

FINAL EXAM top

Think you've got it? You can test yourself at the OpenDNS Phishing Quiz. It shows you 14 website screen shots, each asking for information, and you have to judge if they are real or a scam/phishing.