Domain Watch FAQs

1. What is Domain Watch?

Domain Watch is designed to identify and suspend domains shortly after registration that are clearly deceptive, to further increase the security of the .UK zone and protect .UK end users from malicious activity.

2. Why are you introducing Domain Watch?

Following the introduction of Domain Health – a free service for registrars to reduce the levels of abuse in .UK – our analysis has shown that a large proportion of the technical abuse seen relates to phishing activity. Domain Watch quickly identifies and suspends newly registered domains that are obvious phishing attempts.

3. What is the difference between Domain Health and Domain Watch?

Domain Health compiles data and reports regarding technical abuse and sends the information to registrars to act upon. Domain Watch targets phishing activity in particular and suspends domains shortly after registration to help prevent widespread disruption.

4. What does this mean for registrars?

There is no action required of the registrar unless they wish to respond on behalf of the registrant or cancel the domain. Registrars will receive a notification about any suspended domains – Domain Watch.

5. How will you notify registrars about the suspension of a domain name on their tag?

For any suspended domains, Registrars will receive a notification (notification reason: “Suspension Notification”) via the usual channels (EPP and/or email – notification settings can be set within Online Services on a per tag basis) with the Process Type ‘Domain Watch’.

6. How are you identifying the domains you are trapping / removing?

For obvious reasons we can’t go into the details on how we are identifying the domains to be suspended. What we can say is that we are using a combination of manual and automated processes.

7. When will domains be suspended?

Speed is key for this process as the average uptime for a phishing site is very limited. Domain Watch enables us to quickly identify domains likely to be used for phishing and to suspend them shortly after registration.

8. Will you be notifying registrars in advance about an upcoming domain suspension?

No, due to the nature of phishing and the quick turnaround time required, notifying registrars would reduce the effectiveness of the initiative. Domain Watch enables us to quickly identify domains likely to be used for phishing and to suspend them shortly after registration.  For any suspended domains, Registrars will receive a workflow commenced message (type: notification reason: <msg>Domain Watch process commenced notification</msg>) via the usual channels (EPP and/or email – notification settings can be set within Online Services on a per tag basis).

9. Can these domains be unsuspended if there has been an error?

Domains that are suspended by Domain Watch will be unsuspended if the registrant or registrar is able to confirm the legitimate use of the domain to our satisfaction. We will work with registrars to ensure any query regarding the suspension runs smoothly for registrants. If a domain is suspended, the registrant will receive an email informing them what has happened, together with the next steps required if they feel the suspension was not correctly applied.

10. How will a registrant query the suspension?

The registrant will receive an e-mail advising of the suspension and will be asked to provide supporting documentation for the legitimate use of the domain.

11. What, if any, is the interaction with the existing Phishing Lock?

Domain Watch will operate separately to the existing Phishing Lock and will require no input from Registrars as the action to suspend a suspicious domain name will be taken by Nominet.  The Phishing Lock will remain available for Registrars to use where they uncover phishing or malicious use of a .uk domain name that is on their tag.

12. How accurate is Domain Watch?

Domain Watch is preventive not a cure, however we think it will enable us to further increase the security of the .UK zone and protect .UK end users from malicious activity.