Top-level domain hopping
What is Top-level domain hopping?
“Top-level domain hopping” is when a site (e.g. ‘badsite.ru’) keeps its second-level domain name (‘badsite’) but changes its top-level domain (‘.ru’), creating a whole new website with different hosting details but retaining its ‘name brand’. So from ‘badsite.ru’, the additional sites ‘badsite.ga’, ‘badsite.ml’ or ‘badsite.tk’ could be created. This allows instances of a website to persist online after the original has been taken down while keeping the website recognisable and easy to find.
- 219 dedicated commercial second-level domains were identified to have hopped domain at least once in 2021.
- A total of 63 unique TLDs were identified as being abused in domain hopping in 2021.
- 202 second-level domains were found to have hopped once.
- 13 hopped twice.
- Two hopped three times.
- Two hopped four times in a bid to remain online and active in the 12-month monitoring period.
We first work with partners to ensure that the site is removed from the internet. Every subsequent hop, however, then requires a new action by our analysts to re-enforce the previous take down(s) by actioning the site again on the new TLD.
- 22 countries were identified as hosting domain hopping sites.
When tracking hosting country, we noted that some sites often changed TLD but remained hosted in the original host country; other sites showed a preference to change hosting country after each TLD domain change, sometimes returning to the originally identified hosting country after a period of hosting elsewhere under a different TLD.
.png){kind=link}
What can we do about this?
Domains are allocated and managed by internet registries and registrars. Our ongoing work in this area will enable us to identify domains exploiting the legitimate TLD marketplace. We continue to work with Members to not only identify and remove criminal sites but offer new preventative measures to guard against domains hopping to unsuspecting TLDs. We hope to involve more registrars and registries in the fight against this exploitative practice in 2022.