For Phishing Wreaks Havoc — False Positive

What happens when your domain is mistakenly flagged as a phishing site?

Many domain name owners participate in multiple types of monetization. Pay-per-click is perhaps the most popular but is just the starting point. Many have found affiliate programs counting pay-per-action and lead programs to be quite lucrative.

Over the weekend I was uploading links for affiliate programs and testing them. Something interesting happened. As I followed one of the affiliate links I received a warning message from Microsoft’s (NASDAQ: MSFT) Internet Explorer 7 web browser (see graphic at end of story). IE had flagged the affiliate firm’s URL as a phishing site. Anyone using IE7 was warned to stay away from the site. And they did. My revenue over the weekend plummeted.

I can understand how an affiliate site might be wrongly accused of phishing. Many of these affiliate links lead to URLs of lead generation firms. For example, one might have a contract with Blockbuster (NYSE: BBI) to collect sign-ups for them, but the URL in the browser is for the contracted firm — not Blockbuster.com. A web user may think that it’s a phishing site.

Everyone wants to stop phishing, and phishing filters can stamp out much of the activity. But what happens when you become a false positive? Getting the attention of someone like Microsoft to fix the problem can be difficult. Even Google’s (NASDAQ: GOOG) Adsense program is a victim of over protective browsers. If you use IE7 to visit google.com/adsense you’ll get a warning that the site’s security certificate is different from its web address. (It’s just a different Google URL).

But Google is on both sides of the coin. In its effort to remove parked pages from its search index it may have gone too far, as Frank Schilling pointed out on his blog recently. When someone types Antarctica.com into the Google search box, it’s clear that they want to visit that URL. But you won’t find Antarctica anywhere in the search results. Antarctica points to a parking page. Google has decided that people typing in Antarctica.com don’t really want to go to Antartica.com. That decision is easy to question.

There’s danger ahead as the power of what’s right and what’s wrong is consolidated into a few firms’ hands.

Below: phishing message in IE7