Re: [dmarc-ietf] cousin domain definition (was Re: Fwd: Eliot's review of the DMARC spec)

[Scott Kitterman <[e-mail]>]

On Monday, July 08, 2013 05:12:26 PM Barry Leiba wrote:
> > How's this, if you'll pardon the XML?
> > 
> >  <t hangText="Cousin Domain:"> A registered domain name that
> >  
> >      is deceptively similar to a target name, which can be a
> >      domain name or the name of a known entity.  The target
> >      name is familiar to many end-users, and therefore
> >      imparts a degree of trust.  The deceptive similarity can
> >      trick the user by embedding the essential parts of the
> >      target name in a new string (e.g.,
> >      "companysecurity.example" to attack "company.example"),
> >      or it can use some variant of the target name, such as
> >      replacing 'i' with '1'.  This latter form is sometimes
> >      known as a "homograph attack".  </t>
> 
> If it's not too late to change the term "cousin domain" for this, I
> suggest finding another term.  "Cousin" implies a legitimate relation,
> which this isn't.  I would consider, say, "ibm.com" and "lotus.com" to
> be cousin domains.  I might consider "microsoft.com", "hotmail.com",
> and "skype.com" to be cousin domains.  Things that try to look like
> they're related, but *aren't*, are what we're talking about here, and
> I don't think of those as cousins.

Doppelganger domains.

Scott K