Comment by gnfargbl | Hacker News Reader

Comment by gnfargbl | Hacker News Reader

Parent Full thread

Have you ever tried reporting a phishing site through those legitimate channels?

I have, and my experiences have been that:

* The domain registrars are apologetic and well-meaning, but tend to explain that they aren't empowered to take this stuff down without being ordered to by Law Enforcement or similar. There typically isn't a mechanism available for getting LE to respond before the phish campaign is over.

* The hosting providers chosen by phishing sites are either "bulletproof hosts" who are tacitly complicit, or more commonly are so low-end that the support departments are massively underfunded and abuse reports take eons to be processed.

Either way, the phisher achieves their objectives before the site is taken down. That being the state of affairs then, although I don't choose to use the kind of tactics outlined in the blog myself, I find it pretty hard to condemn those who do.

EDIT: I do agree with you that submitting the URL/IP to abuse blacklists is a helpful and positive thing to do. Here are a couple of submission URLs (there are many more): https://pulsedive.com/submit/, https://www.abuseipdb.com/report.

I've had a similar experience. I ran into a scam that was masquerading as a popular Canadian clothing store (Roots) where everything was 50% off. I reported the domain to Namecheap and they said they're not responsible for the content since its hosted elsewhere. I pointed out that the domain itself was also trying to pass as legitimate and they told me unless I was the trademark owner they couldn't do anything. I also e-mailed the hosting provider but never heard back.

Fortunately I got ahold of Roots via Twitter and the scam seems to have been shut down.

Did you expect the domain company to take down the domain based on a copyright issue reported by an entity where they are not the copyright holder?

Think of all of the false take down requests registers would receive.

I had. My experience is mixed, sometimes all you wrote happens (like, it takes days to get processed), sometimes it doesn't (you might be surprised how fast some small providers can react, sometimes faster than bigger ones). If you want to speedup the process, contacting the legitimate owner is the way (and hope their response is faster).

I understand the will to take action, but doxing a phishing site can cause collaterals you did not foresee and you want to avoid, legally and otherwise. And it doesn't solve anything, as previously explained, it just temporarily turns them down, which leads to a comparison between the time invested by the adversary (who will block your source as first thing) and yours (and you don't want to go there). Definitely is not something to suggest to inexperienced people as "a good way to fight phishing" (which they'll take literally, because it looks cool). There might be exceptions to this (as in, calculated risks) but they go far beyond what makes sense for someone alone to do.

Reply on news.ycombinator.com