Domain Watch FAQs

What is Domain Watch? 

Domain Watch is designed to detect, identify, and alert on domains shortly after registration that are clearly deceptive and have a high-risk of use for phishing. It increases the security of the .UK zone and protects .UK end users. 

Why do Nominet use Domain Watch? 

Nominet’s analysis has shown that a large proportion of abuse seen in .UK relates to phishing activity. Domain Watch quickly identifies newly registered domains that are highly likely to be used for obvious phishing attempts and allows us to proactively prevent abuse in the .UK zone. 

What is the difference between Protective Holds and Domain Watch? 

Domain Watch detects and identifies potential phishing activity at the point of registration for .UK domains to then alert Nominet analysts for a decision. The analysts review each case and suspend domains shortly after registration to help prevent widespread abuse in a timely manner. These suspensions are classified under ‘Protective Hold Suspensions’.  

How are you identifying the domains that are flagged by Domain Watch? 

To prevent circumvention of our abuse detection we won’t go into the details on how we are identifying the domains to be suspended. What we will say is that is uses a combination of curated algorithms and machine learning.4. When will domains be suspended? 

Speed is key for this process as the average uptime for a phishing site is very limited. Domain Watch enables us to quickly detect, identify, and alert on domains highly likely to be used for phishing at the point of registration which can then be assessed for their suitability of suspension. 

How accurate is Domain Watch? 

Domain Watch is preventive but not a cure. Analysts review the output of the detection algorithms to decrease the risk of impacting legitimate users, and has processes in place so that any legitimate users suspended with what would be high risk domains can quickly get their domains unsuspended. We think this approach will enable us to further increase the security of the .UK zone and protect .UK end users from malicious activity, while also protecting .UK registrants.