Many new top-level domains have become Internet’s “bad neighborhoods” [Updated]

There were many who warned that the Internet Corporation for Assigned Names and Numbers' (ICANN) decision to allow a host of new commercial generic top-level Internet domains was going to create a huge opportunity for Internet scammers and hackers. The approval of top-level domains (TLDs) beyond those assigned to countries and generic ones such as .com, .org, and .net created an opportunity, some in the security industry warned, for criminals to set up "look-alike" domains in the new namespace that aped legitimate sites already registered in .com or elsewhere.

Well, the warnings were spot-on. Based on data just published (PDF) by the network security and deep packet inspection tool vendor Blue Coat, that's exactly what happened: some of the new "neighborhoods" open for name registration have become almost exclusively the domain of people setting up hosts for spam e-mailing, scams, shady software downloads, malware distribution, botnet operations and "phishing" attacks, or other suspicious content. One hundred percent of sites accessed with the .zip and .review TLD that had been scanned and added to Blue Coat's domain database were classified by Blue Coat's researchers as "shady."

Of course, these rankings may be distorted by the fact that there are so few records in Blue Coat's database for these domains—.zip isn't even officially available yet from domain registrars, so it's not clear how there were any records for it at all. Update: A Google spokesperson (and many others) reached out to Ars to point out that .ZIP has never been publicly released, which we noted earlier.  The only site currently sporting an actual .zip domain is Google's site advertising the TLD. A Blue Coat spokesperson pointed to a blog post from the company today that clarifies how .zip got on the "shady" list:

Regardless of [there being only one current .zip domain], .zip URLs are showing up in our traffic logs, among the billion or so anonymized Web requests that our customers send us every day to be categorized in our WebPulse system. Generally, if you look closer, most of these appear to be filenames, not URLs – but they somehow ended up in somebody's browser somewhere as a URL, and got treated accordingly. (For example, many of the requests are for [whatever].zip/favicon.ico URLs.)

Now that .zip is no longer exclusively a file extension, but is also a TLD, browsers have to treat something that's now a legal URL as a URL, not as a filename, or a search term, or anything else...So, when one of those URLs shows up out on the public Internet, as a real Web request, we in turn treat it as a URL. Funny-looking URLs that don't resolve tend to get treated as Suspicious -- after all, we don't see any counter-balancing legitimate traffic there. Further, if a legal domain name gets enough shady-looking traffic -- with no counter-evidence of legitimate Web traffic -- it's possible for one of our AI systems to conclude that the behavior isn't changing, and that it deserves a Suspicious rating in the database. So it gets one.

Not all of the worst domains were new TLDs. One, .gq—the top level domain assigned to Equatorial Guinea—scored a 96.68 percent score for "shady" sites out of all traffic screened.  Overall, the worst ten TLDs for malicious domains, as of August of 2015, were:

1. .zip (100.00%)
2. .review (100.00%)
3. .country (99.97%)
4. .kim (99.74%)
5. .cricket (99.57%)
6. .science (99.35%)
7. .work (98.20%)
8.  .party (98.07%)
9. .gq (97.68%)
10. .link (96.98%)

Not all new TLDs were bad neigbhorhoods. The .church TLD, for example, had 0.84 percent "shady" sites. The .london TLD had 1.85 percent; the older .tel had 1.6 percent. And the safest of all the new TLD neigborhoods is apparently .jobs, in which a mere 0.36 percent of domain names had any hint of suspicious intent. Of course, these low percentages may be because of a small sample rate—if your employer is running deep packet inspection on your Web traffic, you might be less likely to be visiting a .church or .jobs site from work.