I asked Olivier to look at whether we needed to comment on a recent study on DNS abuse (commissioned by the CCT-RT). His report followed and is an excellent example of what we should be doing to evaluate whether ALAC action is required. See https://community.icann.org/x/bRUhB. In this case, Olivier is recommending no comment, a recommendation I support. Alan
Subject: Re: SADAG Public Comment To: Ariel Liang <ariel.liang@icann.org>, Alan Greenberg <alan.greenberg@mcgill.ca> CC: 'At Large Staff' <Staff@atlarge.icann.org> From: Olivier MJ Crépin-Leblond <ocl@gih.com> Date: Wed, 6 Sep 2017 03:07:33 +0200
Dear Ariel, Dear Alan,
thanks for your follow-up. I have read the SADAG report and have found it very interesting.
First thing, I was surprised to see that .pharmacy was seen as community TLD. (p.2) but then that's not the topic of the report. There are a few other grammatical errors, but that's no big deal either. What matters is the substance of the paper.
It basically confirms our suspicions when we spoke of misuse of TLDs and made our case regarding sensitive strings. Alan will remember this episode in Singapore when Alan, Evan and I had a meeting with the NGPC and several members of the GNSO - including contracted parties. What we are seeing now is the proof of the pudding - that:
"While legacy gTLDs collectively had a spam-domains-per-10,000 rate of 56.9, in the last quarter of 2016, the new gTLDs experienced a rate of 526.6which is almostt one order of magnitude higher. "
The methodology and technical details of the analysis are of good quality. The model which they used to perform the crawl of the domain name space appears to be thorough, thus I have no reason to believe that the analysis would be flawed.
Some of the report's findings show that some new gTLDs are very affected by misuse/malware domains. Gibraltar (surprise!) figures on the top of Registrars with most malware domains. Community gTLDs are less likely to be used for malware that standard gTLDs. Cheaper domains appear to be more used for malware - although the authors do writein their conclusions: "It is not clear, however, if pricing is the only factor driving high concentra- tions of maliciously registered domains."
But they do also say:
"Our findings suggest that some new gTLDs have become a growing target for malicious actors." (page 25)
Well, nothing really new in this, but it corroborates the work that ICANN has done, as well as many other groups like the APWG.
But at present, short of congratulating the authors of the report and asking the CCT-RT to take strong note of the report's finding, including expressing the concern that we have about the use of new gTLD for malware, I don't see any other reason to write a Statement/Comment. I asked Tatiana Tropina to also go through the report. She did note that one thing was missing: whether abuse correlates with semantic properties of the gTLD names, e.g. some names are more attractive to abuse because of the words themselves. As the authors are explaining that they are seeing some potential for further work, it might be interesting to suggest this to them.
Last, I note that there is a Webinar about the topic: <https://www.icann.org/news/announcement-2017-08-31-en>https://www.icann.org/news/announcement-2017-08-31-en I would encourage At-Large participants to participate in the Webinar. Perhaps during that Webinar should many At-Large participants express their concerns.
Kindest regards,
Olivier
On 01/09/2017 22:10, Ariel Liang wrote:
Hello Olivier,
Any update on this public comment? <https://community.icann.org/x/bRUhB>https://community.icann.org/x/bRUhB
Saw this action item has been checked but just want to reconfirm whether a statement will be needed or not.
Thank you, Ariel