| Registering a domain and hosting a phishing website usually comes at a small price (around 10$) which is just 1% of the VMC (I just learned that). “Expensive” is very subjective, I think it highly depends on the financial standard of the actor and the expected value. In the case of Apple: if it is expected to aid in phishing an interesting iCloud user, or scamming 100 users for 10$, then I expect that there will be actors that will pay this initial cost to make more later on. I agree that the classic mass-mail LQ phish actors would probably not go here, but the same holds for smaller organizations. With the current price-tag, end users then still have to trust non-BIMI and BIMI verified e-mails daily. That seems to leave plenty room for phishing. Also, if VMC prices drop, it will also attract more phish actors. Though I see your point, I do not think that a financial bar is effectively combatting phishing. I do not know how valid the paper trail concern is; I haven’t gone through the VMC procedure(s). |
> I do not know how valid the paper trail concern is; I haven’t gone through the VMC procedure(s).
You can currently steal a credit card, lie to a registrar and start your phishing campaign. Having to have a legal entity for a phish paints a nice target on your back.