DNS Abuse Deep Dive - The Registry/Registrar/Registrant (3R) + Resellers problem
The conventional wisdom is that the gTLDs have a Registry/Registrar/Registrant model. Legally this is correct. As Alan mentioned on the call yesterday, the reality is much more complex with resellers and web service providers. Every month, I publish the HosterStats Registrars and Resellers report. It details the transactions and counts of the gTLD registrars and main resellers. It groups them as brands and those brands cover 95.52% of the gTLD market. There were 43,188 hosters (by DNS) in that group. That's the two main spreadsheets (Totals and Transactions (new/deleted/transferred counts). The registrars counts also have their own spreadsheet. At a DNS/hoster level, the registrars account for 78.21% of the gTLD market on their DNSes. Most of the ICANN accredited registrars are what is known as dropcatchers. They exist only to register deleting domain names and are not retail registrars. The domain names they register normally go to auction websites or sales websites. Approximately 8.62% of the gTLD market is on sale and 13.88% is on PPC Parking. (The gTLD Web Tracking spreadsheet which uses DNS and IP to determine these and other %s. The WEb Usage surveys have greater granularity on how domain names are used.). The off-registrar share of the gTLD market is 21.79%. That's effectively the visible reseller gTLD market. And this is where things get magitudes more complex. There are many resellers who don't use their own identifiable DNS and therefore they will be grouped with other registrars and hosters that host those domain names. The websites are not necessarily hosted on the webspace of the same registrar/hoster. One of the examples would be Godaddy's main DNS/hoster. It has over 3,611 identifed web service providers using the it. The majority of the websites are hosted on Godaddy linked webspace. But Godaddy, like many other major registrar operations has acquired other registrars and hosters over the years. The rise of website builders, DDoS prevention operations like Cloudflare, and Cloud hosting operations like Amazon AWS, Microsoft Azure and Google Cloud have made things a bit more complex. Website builders allow the registrants to build their own website or e-commerce sites. The domain name may be hosted on the website builder's DNS or the registrant's registrar DNS or own DNS. Some large website builder and hosting operations only exist in the Cloud and have no external DNS or web hosting of their own. Some of the more well-known web hosting providers like Amazon have large numbers of hosters (including their own DNS) using their ranges. (44,817). Google Cloud has an identified 27,400 hosters using it. With DDoS/CDN services like Cloudflare, other hosters might have websites hosted on their own IP ranges and DNS provided by Cloudflare. The above is the easy part compared to what follows. The GDPR and NIS-2 are the product of people who don't understand the impact of their legislation on the Internet, don't understand the impact of their legislation on the domain name industry and don't understand the security of the Internet. The GDPR has had massive unintended consequences and has made the Internet less secure. In May 2018, WHOIS effectively went dark and the contact information that could be used to identify registrants where DNS Abuse was happening was largely removed. That effectively destroyed a major link in the killchain for an abusive registration or compromised website. The usual contact would have been the registrar, but as seen above, a registrar may be responsible for thousands of resellers and getting to the web service provider is not always so easy. There have been some industry websites set up to query the abuse contact for and IP address of a website. But that doesn't work well when there is no abuse contact listed or the IP addresses have been leased though an IP broker. IP v4 addresses (aaa.bbb.ccc.ddd) have become quite valuable due to most of them being allocated. Businesses have been created to broker these IP addresses. The website IP address details might be that of the IP broker rather than the operator of the website. And that brings up another issue that will impact on the next gTLD round: countries rarely host all their websites on their country-allocated IP addresses. It would be nice if the Web was hosted with geographical boundaries. In this ideal web, the websites for country A would be hosted only on country A's IP addresses. This rarely happens because the Web is global and it is often cheaper to host in another country if the cost is lower and the infrastructure is not develped. (There is also the IP brokerage problem where much of a country's IP allocation can be acquired and used outside that country.) These are the December 2024 figures for the Nigerian gTLD market from the gTLD hosting market spreadsheet in the HosterStats Registrars and Resellers report: Country - ccTLD - Region - Hosted - Local sites - External - sites Nigeria ng AF 87,457 268 71,775 1,188 The 87K figure is the identified gTLD domain names hosted on hosters associated with Nigeria. The 268 figure is the number of Nigerian gTLD websites on Nigerian IP addresses. The 71K figure is for externally hosted websites. The 1,188 figure is for websites hosted on Nigerian IP addresses. The figures for South Africa are somewhat different. It has some Amazon AWS IP ranges that increase its hosting footprint: South Africa za AF 299,398 208,281 51,523 669,283 South Africa also provides hosting services for many other African countries. There are other countries, such as China and Hong Kong, that use the IP addresses of other countries for some of their large web and Cloud hosting operations. A lot of Aliyun's Cloud hosting is on US badged IPs. Cloud Hosting adds an extra layer of complexity to the reseller problem. The gTLD Hosting market spreadsheet is based on 98.46% of the market being identified by country of domain name hosting operation. In ICANN terms, the model is: Registry - Registrar - Registrant. In reality, the model is more like this: Registry / (registry owned registrar(s)) | Registrar / (may be Web Service Provider) | Reseller (may be Web Service Provider) | (Web Developer) (may be Web Service Provider and/or reseller) | Registrant (who may not even know where their domain name is hosted) I'm currently crunching the data for the January report so the figures above are from the December 2024 report. The current 3R model was great for the 1990s when the Web was much smaller. The Web has grown since then. The point was made in yesterday's meeting that gTLD resellers grow and become ICANN registrars. That is not happening at the same rate as ten or twenty years ago. The reason for this is the rise of the ccTLDs. It is often cheaper and more commercially efficient for a reseller to become a ccTLD registrar in their local ccTLD (if they are not already one) and outsource gTLD registrations to some of the larger registrars who provide reseller facilities. There is also the issue that gTLDs switch to being "Legacy" TLDs when their new registration volume is overtaken by that of the local ccTLD. This is the ICANN registrar geography for ICANN'sSeptember 2024 registry reports: Region - Registrars - gTLDs AF 13 191,789 AP 615 40,177,911 EUR 189 33,522,866 LAC 11 961,427 NA 2,042 156,835,805 This has implications for the next round of gTLDs. Some regions have already switched to their local ccTLDs being the First Choice TLD for registrants. The cost of registraion fees also has an impact. The .COM is still the main global TLD choice. From the January 2025 TLD website by country data, there are some examples of new gTLDs having an impact: Country - gTLD - websites - gTLD websites - % of TLD's sites | Turkey | org | 33,180 | 9,429,860 | 0.3519 | | Turkey | net | 78,222 | 10,120,094 | 0.7729 | | Turkey | online | 89,934 | 2,406,993 | 3.7364 | | Turkey | xyz | 120,619 | 2,730,343 | 4.4177 | | Turkey | com | 878,385 | 133,055,165 | 0.6602 | (361 TLDs) | Brazil | org | 7,960 | 9,429,860 | 0.0844 | | Brazil | site | 13,445 | 1,132,547 | 1.1871 | | Brazil | net | 14,525 | 10,120,094 | 0.1435 | | Brazil | online | 21,713 | 2,406,993 | 0.9021 | | Brazil | shop | 23,733 | 2,335,163 | 1.0163 | | Brazil | com | 226,991 | 133,055,165 | 0.1706 | (439 TLDs) | China | vip | 36,021 | 828,852 | 4.3459 | | China | xyz | 46,309 | 2,730,343 | 1.6961 | | China | net | 147,064 | 10,120,094 | 1.4532 | | China | top | 250,716 | 1,717,127 | 14.6009 | | China | com | 2,165,973 | 133,055,165 | 1.6279 | (359 TLDs) Regards...jmcc -- ********************************************************** John McCormac * e-mail: jmcc@hosterstats.com MC2 * web: http://www.hosterstats.com/ 22 Viewmount * Domain Registrations Statistics Waterford * Domnomics - the business of domain names Ireland * https://amzn.to/2OPtEIO IE * Skype: hosterstats.com ********************************************************** -- This email has been checked for viruses by Avast antivirus software. www.avast.com
Thank You John McCormac for a very useful mail in the trace. Jonathan Zuck's presentation on the subject of DNS Abuse was excellent and I wish that we have more such longish presentations [say 60 - 90 minutes]. This mail is no commentary on the statistical data. As you would appreciate, one can in principle develop a 4-year Undergraduate Programme say "ICANN" based on Multi-Stakeholder Model / IDN and their Implementation / Registry Models. Sufficient subjects will fall in place. Attached please find my quick presentation on Registry Models from a perspective of Safety and Liveness properties. Michelle DeSmyter: Please attach this PPT to my comment on the CPWG 15 / 16 January 2025 page. This provision is disabled for me. Your comments please. Sincerely, Gopal T V 0 9840121302 https://vidwan.inflibnet.ac.in/profile/57545 https://www.facebook.com/gopal.tadepalli ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Dr. T V Gopal Professor Department of Computer Science and Engineering & Director, Centre for Applied Research in Indic Technologies [CARIT] College of Engineering, Guindy Campus Anna University Chennai - 600 025, INDIA Ph : (Off) 22351723 Extn. 3340 (Res) 24454753 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ ________________________________ From: John McCormac via CPWG <cpwg@icann.org> Sent: 16 January 2025 20:52 To: CPWG <cpwg@icann.org> Subject: [CPWG] DNS Abuse Deep Dive - The Registry/Registrar/Registrant (3R) + Resellers problem The conventional wisdom is that the gTLDs have a Registry/Registrar/Registrant model. Legally this is correct. As Alan mentioned on the call yesterday, the reality is much more complex with resellers and web service providers. Every month, I publish the HosterStats Registrars and Resellers report. It details the transactions and counts of the gTLD registrars and main resellers. It groups them as brands and those brands cover 95.52% of the gTLD market. There were 43,188 hosters (by DNS) in that group. That's the two main spreadsheets (Totals and Transactions (new/deleted/transferred counts). The registrars counts also have their own spreadsheet. At a DNS/hoster level, the registrars account for 78.21% of the gTLD market on their DNSes. Most of the ICANN accredited registrars are what is known as dropcatchers. They exist only to register deleting domain names and are not retail registrars. The domain names they register normally go to auction websites or sales websites. Approximately 8.62% of the gTLD market is on sale and 13.88% is on PPC Parking. (The gTLD Web Tracking spreadsheet which uses DNS and IP to determine these and other %s. The WEb Usage surveys have greater granularity on how domain names are used.). The off-registrar share of the gTLD market is 21.79%. That's effectively the visible reseller gTLD market. And this is where things get magitudes more complex. There are many resellers who don't use their own identifiable DNS and therefore they will be grouped with other registrars and hosters that host those domain names. The websites are not necessarily hosted on the webspace of the same registrar/hoster. One of the examples would be Godaddy's main DNS/hoster. It has over 3,611 identifed web service providers using the it. The majority of the websites are hosted on Godaddy linked webspace. But Godaddy, like many other major registrar operations has acquired other registrars and hosters over the years. The rise of website builders, DDoS prevention operations like Cloudflare, and Cloud hosting operations like Amazon AWS, Microsoft Azure and Google Cloud have made things a bit more complex. Website builders allow the registrants to build their own website or e-commerce sites. The domain name may be hosted on the website builder's DNS or the registrant's registrar DNS or own DNS. Some large website builder and hosting operations only exist in the Cloud and have no external DNS or web hosting of their own. Some of the more well-known web hosting providers like Amazon have large numbers of hosters (including their own DNS) using their ranges. (44,817). Google Cloud has an identified 27,400 hosters using it. With DDoS/CDN services like Cloudflare, other hosters might have websites hosted on their own IP ranges and DNS provided by Cloudflare. The above is the easy part compared to what follows. The GDPR and NIS-2 are the product of people who don't understand the impact of their legislation on the Internet, don't understand the impact of their legislation on the domain name industry and don't understand the security of the Internet. The GDPR has had massive unintended consequences and has made the Internet less secure. In May 2018, WHOIS effectively went dark and the contact information that could be used to identify registrants where DNS Abuse was happening was largely removed. That effectively destroyed a major link in the killchain for an abusive registration or compromised website. The usual contact would have been the registrar, but as seen above, a registrar may be responsible for thousands of resellers and getting to the web service provider is not always so easy. There have been some industry websites set up to query the abuse contact for and IP address of a website. But that doesn't work well when there is no abuse contact listed or the IP addresses have been leased though an IP broker. IP v4 addresses (aaa.bbb.ccc.ddd) have become quite valuable due to most of them being allocated. Businesses have been created to broker these IP addresses. The website IP address details might be that of the IP broker rather than the operator of the website. And that brings up another issue that will impact on the next gTLD round: countries rarely host all their websites on their country-allocated IP addresses. It would be nice if the Web was hosted with geographical boundaries. In this ideal web, the websites for country A would be hosted only on country A's IP addresses. This rarely happens because the Web is global and it is often cheaper to host in another country if the cost is lower and the infrastructure is not develped. (There is also the IP brokerage problem where much of a country's IP allocation can be acquired and used outside that country.) These are the December 2024 figures for the Nigerian gTLD market from the gTLD hosting market spreadsheet in the HosterStats Registrars and Resellers report: Country - ccTLD - Region - Hosted - Local sites - External - sites Nigeria ng AF 87,457 268 71,775 1,188 The 87K figure is the identified gTLD domain names hosted on hosters associated with Nigeria. The 268 figure is the number of Nigerian gTLD websites on Nigerian IP addresses. The 71K figure is for externally hosted websites. The 1,188 figure is for websites hosted on Nigerian IP addresses. The figures for South Africa are somewhat different. It has some Amazon AWS IP ranges that increase its hosting footprint: South Africa za AF 299,398 208,281 51,523 669,283 South Africa also provides hosting services for many other African countries. There are other countries, such as China and Hong Kong, that use the IP addresses of other countries for some of their large web and Cloud hosting operations. A lot of Aliyun's Cloud hosting is on US badged IPs. Cloud Hosting adds an extra layer of complexity to the reseller problem. The gTLD Hosting market spreadsheet is based on 98.46% of the market being identified by country of domain name hosting operation. In ICANN terms, the model is: Registry - Registrar - Registrant. In reality, the model is more like this: Registry / (registry owned registrar(s)) | Registrar / (may be Web Service Provider) | Reseller (may be Web Service Provider) | (Web Developer) (may be Web Service Provider and/or reseller) | Registrant (who may not even know where their domain name is hosted) I'm currently crunching the data for the January report so the figures above are from the December 2024 report. The current 3R model was great for the 1990s when the Web was much smaller. The Web has grown since then. The point was made in yesterday's meeting that gTLD resellers grow and become ICANN registrars. That is not happening at the same rate as ten or twenty years ago. The reason for this is the rise of the ccTLDs. It is often cheaper and more commercially efficient for a reseller to become a ccTLD registrar in their local ccTLD (if they are not already one) and outsource gTLD registrations to some of the larger registrars who provide reseller facilities. There is also the issue that gTLDs switch to being "Legacy" TLDs when their new registration volume is overtaken by that of the local ccTLD. This is the ICANN registrar geography for ICANN'sSeptember 2024 registry reports: Region - Registrars - gTLDs AF 13 191,789 AP 615 40,177,911 EUR 189 33,522,866 LAC 11 961,427 NA 2,042 156,835,805 This has implications for the next round of gTLDs. Some regions have already switched to their local ccTLDs being the First Choice TLD for registrants. The cost of registraion fees also has an impact. The .COM is still the main global TLD choice. From the January 2025 TLD website by country data, there are some examples of new gTLDs having an impact: Country - gTLD - websites - gTLD websites - % of TLD's sites | Turkey | org | 33,180 | 9,429,860 | 0.3519 | | Turkey | net | 78,222 | 10,120,094 | 0.7729 | | Turkey | online | 89,934 | 2,406,993 | 3.7364 | | Turkey | xyz | 120,619 | 2,730,343 | 4.4177 | | Turkey | com | 878,385 | 133,055,165 | 0.6602 | (361 TLDs) | Brazil | org | 7,960 | 9,429,860 | 0.0844 | | Brazil | site | 13,445 | 1,132,547 | 1.1871 | | Brazil | net | 14,525 | 10,120,094 | 0.1435 | | Brazil | online | 21,713 | 2,406,993 | 0.9021 | | Brazil | shop | 23,733 | 2,335,163 | 1.0163 | | Brazil | com | 226,991 | 133,055,165 | 0.1706 | (439 TLDs) | China | vip | 36,021 | 828,852 | 4.3459 | | China | xyz | 46,309 | 2,730,343 | 1.6961 | | China | net | 147,064 | 10,120,094 | 1.4532 | | China | top | 250,716 | 1,717,127 | 14.6009 | | China | com | 2,165,973 | 133,055,165 | 1.6279 | (359 TLDs) Regards...jmcc -- ********************************************************** John McCormac * e-mail: jmcc@hosterstats.com MC2 * web: http://www.hosterstats.com/ 22 Viewmount * Domain Registrations Statistics Waterford * Domnomics - the business of domain names Ireland * https://amzn.to/2OPtEIO IE * Skype: hosterstats.com ********************************************************** -- This email has been checked for viruses by Avast antivirus software. www.avast.com<http://www.avast.com> _______________________________________________ CPWG mailing list -- cpwg@icann.org To unsubscribe send an email to cpwg-leave@icann.org _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.
participants (2)
-
gopal -
John McCormac