Record low .UK domains suspended by law enforcement

Nominet, the .UK registry, has today published its update on .UK domains suspended for criminal activity over the 12 months to 31 October 2021.

Nominet suspends domains following notification from the police or other law enforcement agencies that the domain is being used for criminal activity. It also puts on hold domains at registration where criminal activity such as phishing is suspected by Nominet’s Domain Watch initiative.

The statistics

• The criminality report shows a dramatic overall reduction in the number of .UK domain names suspended compared with the previous 12 months, 3,434 vs 22,158. This is entirely due to the reduction in counterfeit sites using .UK as reported by the Police Intellectual Property Crime Unit (PIPCU).
• This year Nominet received a total of 539 separate requests by law enforcement agencies for domain suspensions. Requests came from 11 out of 13 of its reporting organisations.
• The Police Intellectual Property Crime Unit (PIPCU), which processes and co-ordinates requests relating to IP infringements from nationwide sources, is the main reporting agency with 2,487 domains requested for suspension (down from 21,632), followed by the National Fraud Intelligence Bureau 841 (up from 266) and the Financial Conduct Authority at 75 requests (down from 232).
• The number of domains that didn’t result in a suspension was 18 – down from 47 in the previous year. Reasons for domains not resulting in suspension include the domain already being suspended due to a parallel process, the domain already being transferred on a court order, or the registrant modifying the website to become compliant following notification.
• The number of suspensions that were reversed was 25 (up from 15). A suspension is reversed if the offending behaviour has stopped and the enforcing agency has since confirmed that the suspension can be lifted. We have seen similar fluctuations year on year since 2014.
• The report also provides an update on domains flagged under Nominet’s proscribed terms policy, introduced in May 2014. Over 1012 newly registered domains were identified as potential breaches, but no suspensions were made, indicating a high number of false positives. Over the same period there were no suspension requests from the Internet Watch Foundation on Child Sexual Abuse Images (CSAM) on .UK domains.

Nick Wenban-Smith, General Counsel and head of Stakeholder Relations at Nominet comments: “We have seen an increase in some reporting agencies this year, particularly around online fraud, and financial crime. However, the overall number of .UK domains associated with criminality is still lower than previous years which is a positive outcome for all users.

“The trend is largely due to a very large reduction in suspensions related to intellectual property crime. This is testament to the success of a joint initiative – Operation Ashiko in collaboration with PIPCU and Nominet – working to reduce the amount of counterfeit sites following a full mapped assessment on the DNS of websites selling and distributing counterfeit goods. For obvious reasons we won’t go into detail of the project, but it has delivered a positive outcome as online criminals are no longer seeing .UK as a viable option.”

DS Sophina Deed, of the City of London Police’s Cyber Prevention & Disruption Team of the National Fraud Intelligence Bureau said:  “Our focus is to disrupt criminals using technology as a facilitator for fraud, we focus on preventing and disrupting their activity enabling us to prevent people and business’s being victims of this type of crime, which can have devastating consequences. On behalf of our team, I’d like to thank Nominet for our continued positive partnership in this area enabling us all to continue our united fight against this type of criminality in the .UK arena.”

Detective Superintendent Gary Miles, at the National Fraud Intelligence Bureau, said: “The team are an integral part of our fight against fraud and cybercrime in the UK providing a unique service to Action Fraud, and law enforcement across the country. They have worked at incredible pace this last year, showing innovation and commitment to prevent and disrupt fraudulent activity in the .UK space. I am incredibly proud of the team’s achievements and look forward to supporting them in their continued success.”

For the same period, Domain Watch – Nominet’s anti-phishing initiative that suspends suspicious domains at the point of registration – saw 5,484 domains suspended (up from 5,006). When identified as high risk of phishing, domains will not be usable until extra diligence is conducted to satisfy us the registration does not pose a phishing risk. If a domain is suspended, the registrant will receive an email informing them what has happened, together with the next steps required if they feel the suspension was not correctly applied. Of these, 450 (down from 558) successfully passed our additional due diligence and completed the registration process.

Nominet continues to implement enhanced checks on new domain registrations to mitigate against fraudulent activity related to Covid-19. As of 28 October 2021, 4,330 .UK domains related to Covid-19 remain suspended, including those suspended at the point of registration, pending further registrant checks. 2,749 domains have passed this due diligence and are now registered in the namespace. Nine domains suspended for criminal activity to date were related to Covid-19.

Eleanor Bradley, MD of Registry and Public Benefit at Nominet comments: “As guardian of the .UK namespace it’s in our DNA to ensure it is safe and secure for the millions of individuals and business who use it. It’s always encouraging to see that our collaborative approach with LEAs and our Domain Watch initiative is making a significant dent in the number of domains requiring suspension as .UK becomes increasingly unattractive to criminals.”