Nominet suspends over 180 ‘.uk’ covid-19-related domain names

United Kingdom
  • Nominet has suspended over 180 ‘.uk’ domain names related to the current covid-19 pandemic
  • Over the past few weeks, Nominet has been incorporating new key words such as ‘coronavirus’ and ‘covid19’ in its searches
  • Nominet works with UK law enforcement agencies so that they can monitor names that "have already been registered for any criminal activity"

 

Nominet, the registry responsible for running the ‘.uk’ country-code top-level domain, has recently suspended over 180 ‘.uk’ domain names related to the current covid-19 (coronavirus) pandemic. Unfortunately, this global pandemic is not only causing great concern and uncertainty, it is also increasing the risk of phishing attacks as larger numbers of people are using the Internet due to confinement and are also searching online for information concerning covid-19.

As noted in a recent blog post written by Eleanor Bradley, MD Registry Solutions and Public Benefit at Nominet, Nominet is continually monitoring new ‘.uk’ domain names that are being registered, alongside those names already registered, specifically looking for "any evidence of fraudulent or malicious usage". Over the past few weeks, Nominet has been incorporating new key words such as ‘coronavirus’ and ‘covid19’ in its searches and has seen a marked increase in the number of domain names being registered with these terms.

Nominet’s Domain Watch initiative uses a combination of manual and automated checks to help it identify which newly registered domain names are "likely to be used for phishing". Those domain names that are viewed as suspicious are suspended by Nominet until it has undertaken due diligence on them and "seen evidence of good intentions from the registrants". It was on this basis that Nominet recently suspended over 180 ‘.uk’ domain names. A small number of domain names were subsequently reactivated after the registrants demonstrated, to Nominet's satisfaction, that they were not going to be used for malicious purposes.

Nevertheless, Nominet has noted that not all domain names registered with or containing the terms ‘coronavirus’ or ‘covid19’ will have been registered for malicious purposes. Some domain names are obviously being registered for legitimate reasons, including names for pharmaceutical trials, topical blogs or community groups offering support.

Even though Nominet's Domain Watch does pick up suspicious domain names at the point of registration, Nominet also works with UK law enforcement agencies so that they can monitor names that "have already been registered for any criminal activity". Subsequently, Nominet recently identified over 300 domain names using the terms ‘covid-19’ or ‘coronavirus’ that it shared with the appropriate regulatory authority in order to obtain guidance.

However, Eleanor Bradley has pointed out that some of these domain names will be ‘innocent’, as the terms will appear in words such as ‘coronation’ or ‘Corona beer’; in these instances, no action will be taken in relation to the related domain name registrations. Due to the increased risk of phishing attacks related to malicious 'covid-19’ or ‘coronavirus’ domain name registrations, Nominet is asking users to be extra vigilant before clicking on any links that they do not recognise and to consult only official websites when seeking covid-19-related advice and information. If users do witness any phishing attacks, Nominet is asking them to report these to Action Fraud.

Get unlimited access to all WTR content