domains It’s Way Too Easy to Get a .gov Domain Name

[Lox]

Earlier this month, KrebsOnSecurity received an email from a researcher who said he got a .gov domain simply by filling out and emailing an online form, grabbing some letterhead off the homepage of a small U.S. town that only has a “.us” domain name, and impersonating the town’s mayor in the application.

“I used a fake Google Voice number and fake Gmail address,” said the source, who asked to remain anonymous for this story but who said he did it mainly as a thought experiment. “The only thing that was real was the mayor’s name.”

read more (Krebsonsecurity)

 

[Super-Annuation]

In Australia the .gov.au extension can only be renewed for a maximum of 2 years, meaning every 2 years you would kind of have to re-confirm and commit the same felony if you wanted to pull it off again.


The .edu.au for educational institutes seems plausable, but the .gov within Aus and the USA looks tough. A lot to prove, and a shady resell market.


How much would one of them go for anyway? And how would you go about selling/changing the details of temporary ownership of the license? Wouldn't you need a registry to assist in this process?


I can, right now, buy "Insurance.org.au" and "Property.org.au," but there are only 20,000-ish registered names under the .org.au, with audits forcing people to delete them if you aren't a registered charity using the domain name, and to top it off, a quick mention of the stupidly low resell value.


I'm just wondering if the guy that did this stunt was just slightly thinking of a sale to some extremist living under a rock or bridge, or some scam artist that goes by the name "Faux Burgular?" If he didn't and it was just because he found a loophole and wanted to see if he could use it, that's pretty funny in a cynical way, but the resell value is why I buy.


Last thing the industry needs is wannabe DN Traders selling shady extensions to the world. Ugh yuk man.

 

[oskaaay]

Earlier this month, KrebsOnSecurity received an email from a researcher who said he got a .gov domain simply by filling out and emailing an online form, grabbing some letterhead off the homepage of a small U.S. town that only has a “.us” domain name, and impersonating the town’s mayor in the application.

“I used a fake Google Voice number and fake Gmail address,” said the source, who asked to remain anonymous for this story but who said he did it mainly as a thought experiment. “The only thing that was real was the mayor’s name.”

read more (Krebsonsecurity)

An interesting experiment that uncovers such loophole.