IETF Logo Mail Archive

Re: [dmarc-ietf] cousin domain definition (was Re: Fwd: Eliot's review of the DMARC spec)

"John Levine" <johnl@taugh.com> Sun, 07 July 2013 02:41 UTC

Return-Path: <johnl@iecc.com>
X-Original-To: dmarc@ietfa.amsl.com
Delivered-To: dmarc@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B961D21F9DBF for <dmarc@ietfa.amsl.com>; Sat, 6 Jul 2013 19:41:09 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -100.832
X-Spam-Level:
X-Spam-Status: No, score=-100.832 tagged_above=-999 required=5 tests=[AWL=-9.633, BAYES_00=-2.599, HABEAS_ACCREDITED_SOI=-4.3, RCVD_IN_BSP_TRUSTED=-4.3, URIBL_BLACK=20, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Z-Cas+JiOFHr for <dmarc@ietfa.amsl.com>; Sat, 6 Jul 2013 19:41:05 -0700 (PDT)
Received: from leila.iecc.com (leila6.iecc.com [IPv6:2001:470:1f07:1126:0:4c:6569:6c61]) by ietfa.amsl.com (Postfix) with ESMTP id 85D8021F9CE9 for <dmarc@ietf.org>; Sat, 6 Jul 2013 19:41:05 -0700 (PDT)
Received: (qmail 50447 invoked from network); 7 Jul 2013 02:41:04 -0000
Received: from leila.iecc.com (64.57.183.34) by mail1.iecc.com with QMQP; 7 Jul 2013 02:41:04 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:cc:subject:in-reply-to:mime-version:content-type:content-transfer-encoding; s=51d8d53f.xn--i8sz2z.k1307; i=johnl@user.iecc.com; bh=wRGev7hF0TA1L/Mz/JFevqbz/FMLWiRkLIGjasCai/s=; b=3FFdfLtywW4Du+6m9rtJZvOC/ARVDE4afyX0qLIw6kNfkc6fmPskUePOTOwOVUUNAO9ubVYeYeOYixzBiCdpR0AMjHpjCpr3KgudWw1aoUaPd/j/dXrihXCE9PRtxg455VubU/SZptsJzj+Jd82HRs/6Fw08WIInTWrI3YissHkQr6fkM0XuqWuv+2GEDX6XSXqSAv4sQjdD9SZUMBfu7dqbT5obtkw9qKaIY7t/CtEI8+nn9xkipUggtFXt97Sh
DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:cc:subject:in-reply-to:mime-version:content-type:content-transfer-encoding; s=51d8d53f.xn--i8sz2z.k1307; olt=johnl@user.iecc.com; bh=wRGev7hF0TA1L/Mz/JFevqbz/FMLWiRkLIGjasCai/s=; b=VBeHMz3mZ7SUWkpGZGYvMI1hV20my30x07g9vmHBPe1XXtSvWCFLXxlPIgaB9bIMYSxopEbbnWCO0J8meWSdUErNgYNSFV3jDjyOvPggUE802A+akWoW5DRfjTdag0mBbcMl5syJkPnUIs6vCQsgxt/e6402BfUw0JznVcDcoNw48JvUSCwzLQRPKXas2sMy3Lw/Hj6oWugv5gzR7HII9ue+QIaTFzhZ1RwKZc2Er8m1p/SLaR+mqq8/axlBs/5R
Date: Sun, 07 Jul 2013 02:40:41 -0000
Message-ID: <20130707024041.55347.qmail@joyce.lan>
From: John Levine <johnl@taugh.com>
To: dmarc@ietf.org
In-Reply-To: <51D86DE8.8060103@gmail.com>
Organization:
X-Headerized: yes
Mime-Version: 1.0
Content-type: text/plain; charset="utf-8"
Content-transfer-encoding: 8bit
Cc: dcrocker@gmail.com
Subject: Re: [dmarc-ietf] cousin domain definition (was Re: Fwd: Eliot's review of the DMARC spec)
X-BeenThere: dmarc@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" <dmarc.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dmarc>, <mailto:dmarc-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/dmarc>
List-Post: <mailto:dmarc@ietf.org>
List-Help: <mailto:dmarc-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dmarc>, <mailto:dmarc-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 07 Jul 2013 02:41:09 -0000

>> Why not remove the domain familiarity part entirely? The essence of a cousin domain is not in the
>victims familiarity with the target domain name (which is less common than technophiles would hope)
>but in the victims familiarity with the organizational name in the domain.
>
>
>well, /that's/ an interesting point.
>
>comments?

Sounds right to me.  paypaI.com is a phish because it resembles Paypal.

v2.14.0 | Report a Bug | By Email