Thank You John McCormac for a very useful mail in the trace. 

Jonathan Zuck's presentation on the subject of DNS Abuse was excellent and I wish that we have more such longish presentations [say 60 - 90 minutes].

This mail is no commentary on the statistical data.

As you would appreciate, one can in principle develop a 4-year Undergraduate Programme say "ICANN" based on Multi-Stakeholder Model / IDN and their Implementation / Registry Models. Sufficient subjects will fall in place.

Attached please find my quick presentation on Registry Models from a perspective of Safety and Liveness properties.

Michelle DeSmyter:

Please attach this PPT to my comment on the CPWG 15 / 16 January 2025 page. This provision is disabled for me.

Your comments please.

Sincerely,



Gopal T V
0 9840121302
https://vidwan.inflibnet.ac.in/profile/57545
https://www.facebook.com/gopal.tadepalli
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Dr. T V Gopal
Professor
Department of Computer Science and Engineering &
Director, Centre for Applied Research in Indic Technologies [CARIT]
College of Engineering, Guindy Campus
Anna University
Chennai - 600 025, INDIA
Ph : (Off) 22351723 Extn. 3340
       (Res) 24454753
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
From: John McCormac via CPWG <cpwg@icann.org>
Sent: 16 January 2025 20:52
To: CPWG <cpwg@icann.org>
Subject: [CPWG] DNS Abuse Deep Dive - The Registry/Registrar/Registrant (3R) + Resellers problem
 
The conventional wisdom is that the gTLDs have a
Registry/Registrar/Registrant model. Legally this is correct. As Alan
mentioned on the call yesterday, the reality is much more complex with
resellers and web service providers.

Every month, I publish the HosterStats Registrars and Resellers report.
It details the transactions and counts of the gTLD registrars and main
resellers. It groups them as brands and those brands cover 95.52% of the
gTLD market. There were 43,188 hosters (by DNS) in that group. That's
the two main spreadsheets (Totals and Transactions
(new/deleted/transferred counts).

The registrars counts also have their own spreadsheet. At a DNS/hoster
level, the registrars account for 78.21% of the gTLD market on their DNSes.

Most of the ICANN accredited registrars are what is known as
dropcatchers. They exist only to register deleting domain names and are
not retail registrars. The domain names they register normally go to
auction websites or sales websites. Approximately 8.62% of the gTLD
market is on sale and 13.88% is on PPC Parking. (The gTLD Web Tracking
spreadsheet which uses DNS and IP to determine these and other %s. The
WEb Usage surveys have greater granularity on how domain names are used.).

The off-registrar share of the gTLD market is 21.79%. That's effectively
the visible reseller gTLD market. And this is where things get magitudes
more complex.

There are many resellers who don't use their own identifiable DNS and
therefore they will be grouped with other registrars and hosters that
host those domain names. The websites are not necessarily hosted on the
webspace of the same registrar/hoster.

One of the examples would be Godaddy's main DNS/hoster. It has over
3,611 identifed web service providers using the it. The majority of the
websites are hosted on Godaddy linked webspace. But Godaddy, like many
other major registrar operations has acquired other registrars and
hosters over the years.

The rise of website builders, DDoS prevention operations like
Cloudflare, and Cloud hosting operations like Amazon AWS, Microsoft
Azure and Google Cloud have made things a bit more complex. Website
builders allow the registrants to build their own website or e-commerce
sites. The domain name may be hosted on the website builder's DNS or the
registrant's registrar DNS or own DNS. Some large website builder and
hosting operations only exist in the Cloud and have no external DNS or
web hosting of their own.

Some of the more well-known web hosting providers like Amazon have large
numbers of hosters (including their own DNS) using their ranges.
(44,817). Google Cloud has an identified 27,400 hosters using it. With
DDoS/CDN services like Cloudflare, other hosters might have websites
hosted on their own IP ranges and DNS provided by Cloudflare.

The above is the easy part compared to what follows. The GDPR and NIS-2
are the product of people who don't understand the impact of their
legislation on the Internet, don't understand the impact of their
legislation on the domain name industry and don't understand the
security of the Internet. The GDPR has had massive unintended
consequences and has made the Internet less secure.

In May 2018, WHOIS effectively went dark and the contact information
that could be used to identify registrants where DNS Abuse was happening
was largely removed. That effectively destroyed a major link in the
killchain for an abusive registration or compromised website.

The usual contact would have been the registrar, but as seen above, a
registrar may be responsible for thousands of resellers and getting to
the web service provider is not always so easy. There have been some
industry websites set up to query the abuse contact for and IP address
of a website. But that doesn't work well when there is no abuse contact
listed or the IP addresses have been leased though an IP broker.

IP v4 addresses (aaa.bbb.ccc.ddd) have become quite valuable due to most
of them being allocated. Businesses have been created to broker these IP
addresses. The website IP address details might be that of the IP broker
rather than the operator of the website. And that brings up another
issue that will impact on the next gTLD round: countries rarely host all
their websites on their country-allocated IP addresses.

It would be nice if the Web was hosted with geographical boundaries. In
this ideal web, the websites for country A would be hosted only on
country A's IP addresses. This rarely happens because the Web is global
and it is often cheaper to host in another country if the cost is lower
and the infrastructure is not develped. (There is also the IP brokerage
problem where much of a country's IP allocation can be acquired and used
outside that country.)

These are the December 2024 figures for the Nigerian gTLD market from
the gTLD hosting market spreadsheet in the HosterStats Registrars and
Resellers report:

Country - ccTLD - Region - Hosted - Local sites - External - sites

Nigeria ng      AF      87,457  268     71,775  1,188

The 87K figure is the identified gTLD domain names hosted on hosters
associated with Nigeria. The 268 figure is the number of Nigerian gTLD
websites on  Nigerian IP addresses. The 71K figure is for externally
hosted websites. The 1,188 figure is for websites hosted on Nigerian IP
addresses.

The figures for South Africa are somewhat different. It has some Amazon
AWS IP ranges that increase its hosting footprint:

South Africa    za      AF      299,398 208,281 51,523  669,283

South Africa also provides hosting services for many other African
countries.  There are other countries, such as China and Hong Kong, that
use the IP addresses of other countries for some of their large web and
Cloud hosting operations. A lot of Aliyun's Cloud hosting is on US
badged IPs. Cloud Hosting adds an extra layer of complexity to the
reseller problem. The gTLD Hosting market spreadsheet is based on 98.46%
of the market being identified by country of domain name hosting operation.

In ICANN terms, the model is:

Registry - Registrar - Registrant.

In reality, the model is more like this:

Registry / (registry owned registrar(s))
|
Registrar / (may be Web Service Provider)
|
Reseller (may be Web Service Provider)
|
(Web Developer) (may be Web Service Provider and/or reseller)
|
Registrant (who may not even know where their domain name is hosted)

I'm currently crunching the data for the January report so the figures
above are from the December 2024 report.

The current 3R model was great for the 1990s when the Web was much
smaller. The Web has grown since then. The point was made in yesterday's
meeting that gTLD resellers grow and become ICANN registrars. That is
not happening at the same rate as ten or twenty years ago. The reason
for this is the rise of the ccTLDs. It is often cheaper and more
commercially efficient for a reseller to become a ccTLD registrar in
their local ccTLD (if they are not already one) and outsource gTLD
registrations to some of the larger registrars who provide reseller
facilities. There is also the issue that gTLDs switch to being "Legacy"
TLDs when their new registration volume is overtaken by that of the
local ccTLD.

This is the ICANN registrar geography for ICANN'sSeptember 2024 registry
reports:

Region - Registrars - gTLDs
AF      13      191,789
AP      615     40,177,911
EUR     189     33,522,866
LAC     11      961,427
NA      2,042   156,835,805

This has implications for the next round of gTLDs. Some regions have
already switched to their local ccTLDs being the First Choice TLD for
registrants. The cost of registraion fees also has an impact. The .COM
is still the main global TLD choice. From the January 2025 TLD website
by country data, there are some examples of new gTLDs having an impact:

Country - gTLD - websites - gTLD websites - % of TLD's sites

| Turkey      | org           | 33,180  | 9,429,860   |  0.3519 |
| Turkey      | net           | 78,222  | 10,120,094  |  0.7729 |
| Turkey      | online        | 89,934  | 2,406,993   |  3.7364 |
| Turkey      | xyz           | 120,619 | 2,730,343   |  4.4177 |
| Turkey      | com           | 878,385 | 133,055,165 |  0.6602 |
(361 TLDs)

| Brazil      | org           | 7,960   | 9,429,860   |   0.0844 |
| Brazil      | site          | 13,445  | 1,132,547   |   1.1871 |
| Brazil      | net           | 14,525  | 10,120,094  |   0.1435 |
| Brazil      | online        | 21,713  | 2,406,993   |   0.9021 |
| Brazil      | shop          | 23,733  | 2,335,163   |   1.0163 |
| Brazil      | com           | 226,991 | 133,055,165 |   0.1706 |
(439 TLDs)

| China       | vip             | 36,021    | 828,852     |   4.3459 |
| China       | xyz             | 46,309    | 2,730,343   |   1.6961 |
| China       | net             | 147,064   | 10,120,094  |   1.4532 |
| China       | top             | 250,716   | 1,717,127   |  14.6009 |
| China       | com             | 2,165,973 | 133,055,165 |   1.6279 |
(359 TLDs)

Regards...jmcc
--
**********************************************************
John McCormac  *  e-mail: jmcc@hosterstats.com
MC2            *  web: http://www.hosterstats.com/
22 Viewmount   *  Domain Registrations Statistics
Waterford      *  Domnomics - the business of domain names
Ireland        *  https://amzn.to/2OPtEIO
IE             *  Skype: hosterstats.com
**********************************************************


--
This email has been checked for viruses by Avast antivirus software.
www.avast.com
_______________________________________________
CPWG mailing list -- cpwg@icann.org
To unsubscribe send an email to cpwg-leave@icann.org

_______________________________________________
By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.