IWF Domain Services

IWF Top-Level Domain Hopping List service

The TLD Hopping List allows you to pro-actively reserve known dedicated second-level domain strings that have been confirmed to move from TLD to TLD with the express purpose of selling or distributing child sexual abuse material.

Why has the IWF introduced this service? 

It has been proved without question that ‘bad actors’ profiting from the sale and or distribution of Child Sexual Abuse Material (CSAM) across the internet, do so by exploiting legitimate services and processes owned or under the control of legitimate business. The regular exploitation of Registry and Registrar services is part of the deception tool kit carried out by criminal actors.  Dedicated sites are registered and used to distribute, facilitate and or sell CSAM online and with a view to attaining a market share of traffic and revenue for the site owners.

When a domain is taken offline by the host or suspended by Registry/Registrar action, the site owners wish to retain their market position and will often seek to register the same familiar String under a different TLD suffix, making it easier for their users to find their site again after a takedown. IWF data shows that hundreds of sites seek to exploit this opportunity to hop domains to minimise the disruption to their site’s revenue stream and customer base. This IWF service is designed to disrupt and deter criminals from exploiting Registries, Registrars, and other stakeholders; this service will simultaneously protect children and the public from the distribution of criminal images and videos of child sexual abuse.

What are the criteria for domains to be added to the list?

For the string to be included in the list, the sites must meet all the tests set out below.

• The site will have been visually verified, as being in breach of UK Law, namely the Protection of Children Act 1978 and/or Sexual Offences Act 2003. Content will be digitally captured with a date and timestamp record and saved for evidential and quality assurance purposes.
• Sites must (in the opinion of an IWF analyst) have been produced primarily or exclusively for the sale, facilitation (Gateway sites and Referrers) and or distribution of Images of child sexual abuse; sites of this nature are referred to in this document as ‘dedicated’ domains.
• The unique strings under the TLD will have been identified to have been registered and made live over a minimum of three different TLDs having ‘hopped’ a minimum of two times*. In each consecutive hop, the site must have been assessed to be dedicated to the distribution of CSAM.

*Hops and listing criteria are confirmed as follows.

** Regardless of listing status, all dedicated websites will be notified individually to the appropriate Sponsored service user via the standard Domain Alert Service* with a view to achieving the suspension of each individual website as it is encountered, regardless of whether the site has reached the required two hop status for inclusion on the TLD Hopping list and potential reservation by the IWF Member. * Only sponsored service users taking the IWF Domain Alert Service in addition to the Hopping list will receive the domain single alerts (See Domain Alerts Service).

Domain Hopping Listing notifications

The list will be sent via email in an encrypted Excel file format, to all list takers every two weeks. Participants should inform the IWF of the email addresses or distribution mailbox they wish to receive the notifications.

The password provided will be consistent across all takers of the list but is subject to change by IWF. If the access password is changed, IWF will notify list takers.

The security of the data included in the Domain Hopping List is the responsibility of all those involved. Please be aware of your organisation’s security policies. The Domain Hopping List data is to be treated with the utmost care to limit the chances of inadvertent access to its contents.

How often will the list be checked and quality assured?

All listed items will be checked to confirm that they meet the criteria set out above and that the domain has not been repurposed for use by a legitimate entity. It should be noted that strings which are listed, the sites may or may not be live during their inclusion on the list, unlike the IWF URL list, the list will purposely contain the strings of suspended and offline sites.

When new domains are detected by the IWF Reporting system (RMS), they are not automatically added to the list. Each domain will undergo an additional review by a Senior Analyst to ensure that the identified domain string meets the criteria for listing. Participants will retain the right to query and report any listings or associated listings for 'special escalation' back to the IWF for review if there is a concern about the status, complicity or otherwise of a listed domain string. All such queries should be sent to [email protected] with the subject line ‘TLD Special Escalation’. The sender should identify the string in question and provide any other relevant information that may be of value. The IWF will endeavour to respond to all such enquiries as a priority and will respond as soon as practicable.

Size of the List

The number of strings on the list will fluctuate over time and has no set maximum or minimum number of entries, however, this will be kept under review and will be made available for as long as participants express that the list has value. If the list expands or reduces to impractical levels, then a review may be requested by the IWF or list subscribers to consider increasing or reducing the size of the list by considering factors not limited to, but including the number of Hops encountered before listing, or the dormancy period of a string before it is delisted.