Threat Intelligence Blog

Posted June 5, 2015


Author: Camille Stewart

We recently wrote about the launch of the new generic top-level domain (gTLD) .SUCKS, and the potential problems this extension may cause for branding and security professionals. While .SUCKS is an open gTLD, which many believe is the most concerning type of gTLD, you should also monitor restricted gTLDs.

The Internet Corporation for Assigned Names and Numbers’ (ICANN) new gTLD Program specifies two types of new gTLD extensions: standard – or open – gTLDs, and community-based – or restricted – gTLDs. Open gTLDs can be registered by anyone, whereas restricted gTLDs have to be associated with a community, and are often regulated so they are not available for public registration. Additionally, when registering for a restricted domain name, there is a 30-day Sunrise period where eligible members can register their trademarks with ICANN’s Trademark Clearinghouse.

.BANK and .CREDITUNION are two examples of restricted gTLDs; only verified members of those communities can register domain names with those extensions. In fact, due to its vetting process and heightened security requirements, .BANK is one of the most restricted gTLDs thus far.

Unlike with open gTLDs, the concern around restricted gTLDs like .BANK and .CREDITUNION is not that a malicious actor can register an organization’s domain name, it is around preventing consumer confusion, as many banking and financial services marks are similar. Financial services providers should register their brands on .BANK, .CREDITUNION and others if they meet the qualifications, since these gTLDs have the potential to be a standard for security and consumer recognition of legitimate financial services sites.

The .BANK extension, which is operated by the American Bankers Association (ABA) and the technology policy division of the Financial Services Roundtable (BITS), enters general availability on June 24, 2015.

The following types of businesses are eligible to apply for approval to register a .BANK domain name:

  • National, state, regional, and provincial banks chartered and supervised by a government regulatory authority;
  • Savings associations chartered and supervised by a government regulatory authority;
  • Associations composed of national, state, regional, and provincial banks; and
  • Service providers principally owned by banks or savings associations identified above.

The .CREDITUNION gTLD, which will be run by the Credit Union National Association (CUNA), is also likely to launch sometime this year. The CUA designed this gTLD “to provide a trusted, hierarchical, and intuitive namespace for entities that have a meaningful nexus with the credit union sector,” but have not yet put qualification restrictions in place.

.BANK and .CREDITUNION are not the only new gTLDs financial services institutions should monitor, nor are restricted gTLDs limited to the financial services industry. Organizations should identify new gTLDs that are industry-related and either register their brand on that gTLD, or monitor for relevant registrations. It is also beneficial to take advantage of the new gTLD Sunrise periods to have the first opportunity to secure a brand name.

These domains are covered under LookingGlass Domain Alerts.  Contact us for more information on our domain name monitoring solutions and other services for brand and legal professionals.

Additional Posts

Cyveillance Phishing Report: Top 20 Targets – June 8, 2015

  Phishing Report: Top 20 Targets Week of May 31 - June 6, 2015   This week saw more ...

Negating Cybersecurity Threats From Within

Real-time web and mobile event analytics tools, such as the DetACT solution pictured above from the ...