- DNS-Abuse-Measurements - lists.icann.org

DAAR ccTLD news
by Samaneh Tajalizadehkhoob Feb. 1, 2021

Feb. 1, 2021

Dear all, We have published a brief blog post about ccTLDs participating in the DAAR project and the recent changes. For those that have not come across it yet here is the blog post. https://www.icann.org/news/blog/daar-activity-project-now-providing-persona… We have started sending ccTLDs personalized monthly report as a draft and looking forward to hear from those participating about their ideas and feedback on the draft. This mailing list is obviously one channel via which we can have the discussions. Please do not hesitate to contact us in case of further question. Thanks, Samaneh

1 0

abuse suspension of infrastructure domain names
by Andrey Nesterenko May 6, 2020

May 6, 2020

Dear community, I am a representative of a hosting service company. Today one of our domain names has been suspended by domain registrar because of spam abuse. The domain name is in fact infrastructure domain name which we used since 2005 for some dns servers and in server names. Here is what happened - spam was sent from a hacked script on one the cPanel shared hosting servers. And this server has this naming convention - sharedserver.$suspendeddomain.com Of course, this domain name has nothing to do with that spam, but this suspension resulted in a major outage (fortunately not that long) for many services and customers in our global infrastructure. I don't think it is a good idea to post here the domain name in question and corresponding registrar because my concern here is not how their abuse team handled that, but about some feedback from community and ICANN. Would it be a good idea to protect such kind of domain names use in infrastructure of certain businesses from being suspended immediately for such low priority cases? There are a lot of companies like us who have just a few domain names important for DNS and resolving routing infrastructure tasks and they have to be protected somehow. This is the second time it has happened to us so far. The first time it was with .host registry a few years ago when they suspend another domain name used in our PaaS cloud infra: each environment had a domain name set up in such a way - env-123456.mircloud.host - exactly the same way as other cloud providers. Of course, it is possible that one of the customers can host phishing tools or viruses on such subdomains, but it should never mean to block the whole domain name entirely. That time it was blocked directly by Radix btw. Any ideas and feedback here to help us deal with such situations other than becoming a registrar ourselves? Andrey Nesterenko MIRhosting

6 6

Re: [DNS-Abuse-Measurements] [Ext] Re: Detailed steps for ccTLD participation in the DAAR project
by Samaneh Tajalizadehkhoob Feb. 6, 2020

Feb. 6, 2020

Hi Michele, For ccTLDs there would be no cost at all. Just a one time process to provide their zone files to ICANN and use DAAR data that is pushed to them to monitor their own abuse. Cheers, Samaneh On Feb 5, 2020, at 11:32 AM, Michele Neylon - Blacknight <michele(a)blacknight.com<mailto:michele@blacknight.com>> wrote: Samaneh Dumb question, but is there a cost for the ccTLDs to do this? I assume there is a cost to ICANN. Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ [blacknight.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.blacknight.com_&d=…> http://blacknight.blog/ [blacknight.blog]<https://urldefense.proofpoint.com/v2/url?u=http-3A__blacknight.blog_&d=DwMG…> Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ [michele.blog]<https://urldefense.proofpoint.com/v2/url?u=https-3A__michele.blog_&d=DwMGaQ…> Some thoughts: https://ceo.hosting/ [ceo.hosting]<https://urldefense.proofpoint.com/v2/url?u=https-3A__ceo.hosting_&d=DwMGaQ&…> ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 From: DNS-Abuse-Measurements <dns-abuse-measurements-bounces(a)icann.org<mailto:dns-abuse-measurements-bounces@icann.org>> on behalf of Samaneh Tajalizadehkhoob via DNS-Abuse-Measurements <dns-abuse-measurements(a)icann.org<mailto:dns-abuse-measurements@icann.org>> Reply to: Samaneh Tajalizadehkhoob <samaneh.tajali(a)icann.org<mailto:samaneh.tajali@icann.org>> Date: Monday 3 February 2020 at 03:11 To: "dns-abuse-measurements(a)icann.org<mailto:dns-abuse-measurements@icann.org>" <dns-abuse-measurements(a)icann.org<mailto:dns-abuse-measurements@icann.org>> Subject: [DNS-Abuse-Measurements] Detailed steps for ccTLD participation in the DAAR project Dear all, Up to now we have had several ccTLDs contacting our global support department for joining the DAAR project by providing their zone files. Up to now, 3 TLDs have completed the process of providing their zones to ICANN and we are working with our contractor to start integrating their zones into the DAAR system and push them their daily abuse stats. This is to be up and running in the very near future. While going through this process, we have noticed certain details of the process is not fully clear. So decided to post the steps here and open the discussion in case of further questions. For the ccTLDs who are interested: 1- ccTLD makes a request by sending an email to globalsupport(a)icann.org<mailto:globalsupport@icann.org>. 2- The global support team will initiate a procedure to confirm the request by sending a couple of emails to both technical and administrative contact of the ccTLD as it is registered in IANA. 3- Once the request is confirmed by all parties, ICANN starts the procedure of taking the zone files in. 4- Once the zone file is in, it will be shared with iThreat Cyber Group, the contractor that maintains the DAAR system. 5- The DAAR system maps the domains in each TLD zone file to a series of Reputation Black Lists (RBLs) and produces abuse rankings per security threat type. 6- The ccTLDs will be able to access their own DAAR data via ICANN’s Monitoring System API (MOSAPI) on a daily basis. For now the data will be only published via the API to the ccTLDs themselves. We are further working on how to further publish general statistics of participating ccTLDs along with the DAAR monthly reports. Please feel free to contact me personally or reply to this email thread in case any of question. Cheers, Samaneh Tajalizadehkhoob Lead Security, Stability & Resiliency Specialist ICANN Office of CTO

1 0

Detailed steps for ccTLD participation in the DAAR project
by Samaneh Tajalizadehkhoob Feb. 3, 2020

Feb. 3, 2020

Dear all, Up to now we have had several ccTLDs contacting our global support department for joining the DAAR project by providing their zone files. Up to now, 3 TLDs have completed the process of providing their zones to ICANN and we are working with our contractor to start integrating their zones into the DAAR system and push them their daily abuse stats. This is to be up and running in the very near future. While going through this process, we have noticed certain details of the process is not fully clear. So decided to post the steps here and open the discussion in case of further questions. For the ccTLDs who are interested: 1- ccTLD makes a request by sending an email to globalsupport(a)icann.org<mailto:globalsupport@icann.org>. 2- The global support team will initiate a procedure to confirm the request by sending a couple of emails to both technical and administrative contact of the ccTLD as it is registered in IANA. 3- Once the request is confirmed by all parties, ICANN starts the procedure of taking the zone files in. 4- Once the zone file is in, it will be shared with iThreat Cyber Group, the contractor that maintains the DAAR system. 5- The DAAR system maps the domains in each TLD zone file to a series of Reputation Black Lists (RBLs) and produces abuse rankings per security threat type. 6- The ccTLDs will be able to access their own DAAR data via ICANN’s Monitoring System API (MOSAPI) on a daily basis. For now the data will be only published via the API to the ccTLDs themselves. We are further working on how to further publish general statistics of participating ccTLDs along with the DAAR monthly reports. Please feel free to contact me personally or reply to this email thread in case any of question. Cheers, Samaneh Tajalizadehkhoob Lead Security, Stability & Resiliency Specialist ICANN Office of CTO

1 0

Highlights of ICANN 66 DAAR session
by Samaneh Tajalizadehkhoob Nov. 13, 2019

Nov. 13, 2019

Again we welcome members of the DNS Abuse measurement mailing list. We have created this mailing list as a part of DAAR improvement process and followed by requests from the community for more transparency on the DAAR progress. The goal of the list is to facilitate DNS Abuse/security measurement discussions including but not limited to those related to DAAR. To start the discussion as the DAAR project owner and the mailing list facilitator, hereby I draft a couple of highlights of our DAAR session at ICANN66 in Montreal for those that were not able to attend the session: The feedback we have received up to now regarding the DAAR improvement process * Requests for more transparency on DAAR progress * Re-aggregating the DAAR data * Adding threat domain time-to-live data * Adding ccTLDs to DAAR * Adding registrar metrics to DAAR * Publishing DAAR detailed data * Distinguishing between maliciously registered domains and compromised one * Better articulation of DAAR’s goal in monthly reports and documentation The changes we have made * Sharing DAAR data with registries via MOSAPI: Now each gTLD registry can view their own reputation data per security threat type via MOSAPI. For more information please contact globalSupport(a)icann.org<mailto:globalSupport@icann.org>. * Re-Aggregating DAAR statistics including those in the monthly report from a snapshot metric (measures for a specific day of the month) to a monthly median metric. * We used Restriction Type as another metric to cut the data, on top of the TLD Type (based on our definition legacy versus new) that we already had. Plotting the data demonstrated that almost all threat types are populated with security threat domains within generic gTLDs. This is while certain security threat types such as Botnet C&C have 25% of their abuse (10000 domains) located in generic restricted gTLDs and Spam has around 5% of their total security threat domains (equal to 25000 domains) located in Brand gTLDs. * Carried out an inferential analysis of potential relationships with abuse drivers. For instance, showed that “Size of a zone file” can be an explanatory factor for the concentrations of security threat domains but it can also be an indicator of attack surface size for attackers. * Using a GLM statistical model we modeled all the security threat drivers that we could collect data on and demonstrated that size of a TLD, type of a TLD and restriction type of a TLD plays a statistically significant role in explaining security threat concentrations. * To bring more transparency on the DAAR project and its progress we made the dns-abuse-measurements(a)icann.org<mailto:dns-abuse-measurements@icann.org> mailing list * Upon many requests from ccTLDs, as of the ICANN66 meeting ccTLDs are able to provide their zone files for inclusion in DAAR. This means that they will be able to pull their own aggregated DAAR data via MOSAPI. The process is simple, ccTLDs need to send an email to globalSupport(a)icann.org<mailto:globalSupport@icann.org> with the subject: ccTLDs access to the DAAR data. We encourage those parties interested to come forward and participate. Moving forward we intend to work on * DAAR v2 * Incorporating more Reputation Black/Block lists (RBLs) * Developing RBL evaluation cycle * Developing Registrar metrics * Reviewing other factors that drive security threat within registrars and registries Cheers, Samaneh Tajalizadehkhoob, PhD Lead SSR specialist ICANN Office of CTO

3 3

Subscribe
by Norm Ritchie Nov. 12, 2019

Nov. 12, 2019

Subscribe

1 0