April 2026 - Gnso-dnsabuse-pdp

Re: Another numbers request.
by Eberhard W Lisse April 15, 2026

April 15, 2026

Becky, you are the lawyer, I am not. I just mean a concept. Can you take down a Registered Name, just because (at least) another Name registered by same Registrant has been mitigated? If a single Registrant has 5 Names, 1 reported, investigated, proven as phishing, and mitigated accordingly, ADC done, and 3 of the others are mitigable, I still don't like that the 5th one would or could be mitigated as well. However as Marc wrote, you act against the Registrant (for violating the Terms and Conditions). How would that work? Can you really unilaterally decide to take Names down, or do you have to give notice of termination of the Registrant agreement (0 to n days notice)? So they transfer the Name elsewhere, and perhaps even register the mitigated Names again. Now you take a Reseller which has a Million Names. ADC finds 50, 500 or even 5000 in need of mitigation. Do you take the 50, 500 or 5000 names down or do you cancel the agreement with the Reseller (for violation the Terms and Conditions). What happens then to the Names left? Or if the Reseller is just irritated enough that they transfer significant Revenue elsewhere? There are enough accredited Registrars around, after all. The obviously even more difficult question is how to prevent them from becoming wise to the Policy and transferring the rest of a portfolio to another Registrar, when a single one is taken down, ie before the ADC can be done? We have not thought through the consequences of our considerations, and/or the cost. el -- Dr. Eberhard W. Lisse \ / Obstetrician & Gynaecologist (retired) el(a)lisse.NA / * | Telephone: +264 81 124 6733 (cell) PO Box 8421 Bachbrecht \ / If this email is signed with GPG/PGP 10007, Namibia ;____/ Sect 20 of Act No. 4 of 2019 may apply On Apr 14, 2026 at 18:50 +0200, Becky Burr <bburr(a)pir.org>, wrote: > I am confused by the use of the term “guilt by association” here. That usually means you consider one person guilty of some bad act because that person is associated with someone else who is a known bad guy. And yes, in that context, there are significant human rights concerns. > > Here, we are just saying that if a registrant/account holder is known to be using one domain for DNS abuse then we are going to check to make sure the same registrant/account holder isn’t using other domains for DNS abuse. And, if the answer is no, then nothing happens to the associated domains. So, unless you are arguing that domains themselves have human rights, I don’t see what the guilt by association issue is. > > Am I missing something? > > Becky Burr

8 10

Re: Proposed Agenda DNSAM PDP1 Monday 13 April 12:30 UTC
by Tan Tanaka, Dennis April 15, 2026

April 15, 2026

+1 From: Volker Greimann via Gnso-dnsabuse-pdp <gnso-dnsabuse-pdp(a)icann.org> Reply-To: Volker Greimann <volker.greimann(a)centralnic.com> Date: Tuesday, April 14, 2026 at 6:49 PM To: "gnso-dnsabuse-pdp(a)icann.org" <gnso-dnsabuse-pdp(a)icann.org>, Feodora Hamza <feodora.hamza(a)icann.org> Subject: [EXTERNAL] [Gnso-dnsabuse-pdp] Re: Proposed Agenda DNSAM PDP1 Monday 13 April 12:30 UTC Caution: This email originated from outside the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe. Hi Feodora, quick question: When papers are produced for our work and presentation at the next meeting, when are they published by ICANN so we can look at them? Would it be possible to publish them no later than Friday morning so everyone has the ability to review them during work hours? While us Europeans can review on the Monday, there are those of us who do enjoy their week-ends and for whom the call is at 4 am on Mondays, so a little lead time would be appreciated so everyone is on the same level and able to prepare before the meetings... Sincerely, Volker Greimann General Counsel & Head of Policy and Compliance - Online Division volker.greimann(a)centralnic.com Office: +49-172-6367025 Web: www.teaminternet.com Team Internet Group PLC (AIM:TIG). Registered Office: 4th Floor, Saddlers House, 44 Gutter Lane, London, United Kingdom, EC2V 6BR. Team Internet is a company registered in England and Wales with the company number 8576358. ________________________________ From: Feodora Hamza via Gnso-dnsabuse-pdp <gnso-dnsabuse-pdp(a)icann.org> Sent: 10 April 2026 5:08 PM To: gnso-dnsabuse-pdp(a)icann.org <gnso-dnsabuse-pdp(a)icann.org> Subject: [Gnso-dnsabuse-pdp] Proposed Agenda DNSAM PDP1 Monday 13 April 12:30 UTC Dear DNSAM PDP1, Please find below the proposed agenda for our call on Monday 13 April 12:30UTC. Agenda Item Time Welcome 5min Update Zoom Features/rules of engagement 5min Update on Milestones for April/May 2026 5min Update on iterative approach on impact assessment 5min Discussion Strawperson on CQ2 40min Deliberations on CQ 3 25min AOB 5min Kind regards, Feodora

1 0

Another numbers request.
by Naoum MENGOUDIS April 15, 2026

April 15, 2026

Dear all, Following the numbers being thrown around in the recent emails, It would be of interest to know the average number of domains an end customer holds. And maybe also the maximum number of domains an end customer holds, to have an idea of the extreme case scenario. This would give us a better estimate of the work needed to be done when doing ADC. [End customer means actual registrants, excluding Resellers and Privacy & Proxy Services] Having 100.000 abusive reports in total says nothing about the overhead of a possible ADC. Maybe ADC would actually help because the reports would be handled in groups instead of one by one (because, as you know, when you are "in the zone" you get more work done compared to starting and stopping and constantly switching contexts). For example, if the average ownership is 100 domains per end customer, you would have to check an additional 99 domains of that customer when one of his domains is reported. Better do it as a group, instead of waiting to do it 100 times in total at some point. PLUS, you can use heuristics, like, if you verify that 20 of the 100 domains of the customer are abusive, and using other available information and indicators (e.g. everything being registered via API and on the same day), you can just deactivate all 100 of the domains and nobody will complain about it (without even having to check further, saving lots and lots of resources). On the contrary, acting on each of the reports that will come in the future is way more resource intensive. And can we have some examples of real scenarios when an ADC would be detrimental to the resource use of the Registrar? So we can validate or not this argument, or any other related argument, or plan appropriate safeguards, instead of dismissing a good practice (i.e. the ADC triggered every time). Regards, Naoum ΜΕΓΓΟΥΔΗΣ Ναούμ Αστυνόμος Α' Διεύθυνση Δίωξης Κυβερνοεγκλήματος Τμήμα Διαδικτυακής Προστασίας Ανηλίκων Λ. Αλεξάνδρας 173, 115 22, Αθήνα<https://www.google.com/maps/place/%CE%94%CE%B9%CE%B5%CF%8D%CE%B8%CF%85%CE%B…> MENGOUDIS Naoum Police Major Cyber Crime Directorate Online Child Protection Department Alexandras Avenue 173, 115 22, Athens<https://www.google.com/maps/place/%CE%94%CE%B9%CE%B5%CF%8D%CE%B8%CF%85%CE%B…> T: (+30) 2106476475 E: n.mengoudis(a)cybercrimeunit.gov.gr<mailto:n.mengoudis@cybercrimeunit.gr> ------------------- Email Disclaimer This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this email. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system.If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. Think green before printing

11 24

Fwd: Namecheap phishing report data for 2025
by Reg Levy April 15, 2026

April 15, 2026

All— The below comes from an observer with more data about reported vs. actual to help get a sense of scale. /R -- Reg Levy | Associate General Counsel – Domains +1 (323) 880-0831 Tucows #MakingTheInternetBetter UTC -7 > Begin forwarded message: > > From: Owen Smigelski <owen.smigelski(a)namecheap.com> > Subject: Namecheap phishing report data for 2025 > Date: April 9, 2026 at 10:08:39 PDT > To: Reg Levy <rlevy(a)tucows.com> > > Hi Reg, > > I saw your email on the list for the ADC PDP regarding phishing reports at Tucows. I reached out to my abuse team, and obtained data for Namecheap and Spaceship for 2025 (which have over 27 million domains under management). The stats are: > > Total reports: 432,796 > Phishing confirmed: 116,871 (27%) > Phishing not confirmed: 315,925 (73%) > > Note: this counts tickets in our system, and some tickets may cover more than one domain name > > Can you please share this with the PDP as another data point regarding the volume of abuse complaints that are not actionable? Thanks! > > Regards, > > Owen > >

6 9

ADC examples
by Ching Chiao April 15, 2026

April 15, 2026

Dear all, Please review the attached 2023 research slides regarding typosquatting groups, which may be relevant to this PDP. In short, the research compares two different datasets -- typo groups vs. confirmed IoC domains . Feel free to ask any questions or comments via the list or privately. Best, Ching *Ching Chiao 乔敬* *Head of APAC & Corporate Development* Check our latest *Internet Abuse Signal* research: https://main.whoisxmlapi.com/blog/to-cache-a-predator-ilovepoop-toolkit-rea… *WhoisXMLAPI.com <http://WhoisXMLAPI.com>* *中文：https://zh.main.whoisxmlapi.com/ <https://zh.main.whoisxmlapi.com/>* *日本语：https://ja.main.whoisxmlapi.com/ <https://ja.main.whoisxmlapi.com/>* LinkedIn : https://www.linkedin.com/in/chiao/ Book a meeting now: https://calendar.app.google/9neWrkwvhPHRqGZ86

1 0

Meeting Invitation / DNS Abuse Mitigation PDP1 WG | Monday, 20 April 2026
by Julie Bisland April 15, 2026

April 15, 2026

Dear all, The next DNS Abuse Mitigation PDP1 WG call will take place on Monday, 20 April 2026 at 12:30 UTC for 90 minutes. Join from PC, Mac, iPad, or Android - Zoom Webinar: https://icann.zoom.us/j/91807711636?pwd=q6XCt8cWQU9m3fGgSojQ5X07pbnX6a.1 Passcode:+X8RaawVrW Phone one-tap: +13126266799,,91807711636#,,,,*0006343077# US (Chicago) +13462487799,,91807711636#,,,,*0006343077# US (Houston) Webinar ID: 918 0771 1636 Passcode: 0006343077 International numbers available: https://icann.zoom.us/u/a9jfXWLB8 * 2026 Meetings wiki: https://icann-community.atlassian.net/wiki/x/B4CWLQ ALL: Before joining the call * Please send apologies to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only (members: please include if an alternate is joining on your behalf) * Please be sure you have read the ICANN Expected Standards of Behavior<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…>, the ICANN Community Anti-Harassment Policy<https://www.icann.org/resources/pages/community-anti-harassment-policy-2017…>, and the ICANN Community Participant Code of Conduct<https://www.icann.org/en/system/files/files/adopted-icann-community-partici…>. * Staff will promote members, participants, and alternates to panelist once joined. OBSERVERS: * Observers will have ability to view member chat and information shared in the zoom webinar room. * Observers will not be able to use chat or raise hands. Thank you. Kind regards, Julie -- Julie Bisland Policy Operations Analyst (GNSO) Internet Corporation for Assigned Names and Numbers (ICANN) Find out more about the GNSO by visiting: https://learn.icann.org/<https://urldefense.proofpoint.com/v2/url?u=https-3A__learn.icann.org_&d=DwM…> Follow @GNSO on Twitter: https://twitter.com/ICANN_GNSO<https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_ICANN-5FGN…> Transcripts and recordings of GNSO Working Group and Council events are located on the GNSO Master Calendar <https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_grou…>

2 1

Proposed Agenda DNSAM PDP1 Monday 13 April 12:30 UTC
by Feodora Hamza April 14, 2026

April 14, 2026

Dear DNSAM PDP1, Please find below the proposed agenda for our call on Monday 13 April 12:30UTC. Agenda Item Time Welcome 5min Update Zoom Features/rules of engagement 5min Update on Milestones for April/May 2026 5min Update on iterative approach on impact assessment 5min Discussion Strawperson on CQ2 40min Deliberations on CQ 3 25min AOB 5min Kind regards, Feodora

2 1

Action Items and High- Level Notes DNSAM PDP1 Meeting 13April 12:30UTC
by Feodora Hamza April 13, 2026

April 13, 2026

Dear DNSAM PDP1, Please find below the high-level notes and action items from today`s meeting. Our next meeting is scheduled for Monday, 20 April at 12:30 UTC. Kind regards, Feodora on behalf of Support Staff 2026-04-13 DNS Abuse Mitigation PDP1 WG<https://icann-community.atlassian.net/wiki/spaces/DAMP1/pages/935755797/202…> Action Items: 1. Leadership with support from staff develop and circulate iterative assessment questionnaire/checklist/tool/document for WG consideration. 2. Staff to update strawpersons in Collaboration Document based on WG discussion. 3. Staff to summarize discussion on CQ3 for WG consideration and follow-up discussion. 4. WG members to review Collaboration Document and suggest edits, changes, data, considerations and alternative language to strawpersons on CQ1 and CQ2. Important Links: * Collaboration Document: https://docs.google.com/document/d/1GxM-Yrgv6sZPEYU8ikW4cRM5YqWsJuWGiQyO39p… * Wiki/Slides (below agenda): https://icann-community.atlassian.net/wiki/spaces/DAMP1/pages/935755797/202… * Recording: https://icann.zoom.us/rec/play/PxWfCxjeNcZxg9aCnPIiedR2Sq9GIJ-ky0jTB3GdxpmI… High Level Notes: 1. Welcome (5 min) 2. Update Zoom Features/rules of engagement (5 min) * Working group roles clarified: · Members expected to actively participate in meetings and in consensus call. · Participants can engage during deliberations but not in consensus call · Alternates only participate if the primary member is unavailable. · Observers can attend calls but no right of posting and communicating in chat or via Email. · If alternates/observers want to share input to the WG they can do so via their SG rep. 3. Update on Milestones for April/May 2026 ( 5 min) * 7 meetings completed. Achievements: · Leadership team finalized. · Work plan and timeline agreed and sent to Council. · Collaboration document established. · Deliberations continuing Charter Questions 1–3. · Strawperson progressing CQ1 and CQ2 · Remaining before ICANN86 - 6 meetings (around 9 hours total). · Planned work: · Discuss Cluster A (1-6) charter questions. · Consider early input for each question. · Develop strawperson draft text. · Begin initial impact assessment on draft language. 4. Update on iterative approach on impact assessment (5 min) * Proposed Approach: Based on WG member input during ICANN86 conduct initial “lightweight”, iterative assessments per charter cluster. Final comprehensive assessment conducted at the end. Aim to avoid discovering “untenable” or “not board-ready” outcomes at the end. Lightweight/iterative approaches do NOT replace final required assessment. * Impact Assessments include: · Human rights<https://docs.google.com/spreadsheets/d/1yuJuDXh_M9dvVhQWsH1pYS2MEpl-I2dDeSr…> · Global public interest<https://docs.google.com/spreadsheets/d/1uVOXywoowxvM1Hn5GuCkkinuZiMc4smc/ed…> · Existing consensus policies<https://www.icann.org/en/contracted-parties/consensus-policies> 5. Discussion Strawperson on CQ2 (40 min) * Reminder on strawperson to CQ1 was presented. * Strawperson for CQ2 was presented after. * Possible criteria for CQ2 MAY include but are not limited to: · Same account /customer /registrant /“end customer” · Common patterns or coordinated activity · Information reasonably available to registrar · Some WG members noted minimum baseline obligations are needed · Others emphasize variability across registrar business models · “Customer,” “registrant,” “account,” “end customer” differ across models. Language should be updated accordingly. · Not all registrars can access same data (e.g., IP, registrant info) · Some WG members suggested to focus on same threat actor, same abusive scheme/campaign 6. Deliberations on CQ 3 (25 min) * Chair presented CQ3 as well as the early input to CQ3 and themes from previous discussion that fit into this question. * Some WG members noted this CQ cannot be answered without agreeing on CQ2. * Some WG noted that “investigation must remain distinct from enforcement”. * Chat input suggested checking at least one reliable internal data point, such as “same account/registrant email,” and using additional technical or abuse-intelligence signals where needed. * Some Members noted the WG should consider the ICANN Advisory on DNS Abuse contract amendments: https://www.icann.org/en/contracted-parties/advisories/documents/advisory-c… 7. AOB (5 min)

1 0

Post Call / DNS Abuse Mitigation PDP1 WG / Monday, 13 April 2026
by Julie Bisland April 13, 2026

April 13, 2026

Dear all, All recordings for the DNS Abuse Mitigation PDP1 WG call held on Monday, 13 April 2026 at 12:30 UTC can be found on the agenda wiki page <https://icann-community.atlassian.net/wiki/x/FYDGNw> (attendance included), which can also be accessed via the GNSO Master calendar<https://gnso.icann.org/en/group-activities/calendar/2026>. These include: * Attendance * Audio recording * Zoom recording (including audio, visual, rough transcript, and chat) * Transcript * Agenda and Notes/Action Items For additional information, you may consult the mailing list archives<https://lists.icann.org/hyperkitty/list/gnso-dnsabuse-pdp@icann.org/> and the main wiki page<https://icann-community.atlassian.net/wiki/x/zoKmLQ>. Thank you. With kind regards, Julie -- Julie Bisland Policy Operations Analyst (GNSO) Internet Corporation for Assigned Names and Numbers (ICANN) Find out more about the GNSO by visiting: https://learn.icann.org/<https://urldefense.proofpoint.com/v2/url?u=https-3A__learn.icann.org_&d=DwM…> Follow @GNSO on Twitter: https://twitter.com/ICANN_GNSO<https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_ICANN-5FGN…> Transcripts and recordings of GNSO Working Group and Council events are located on the GNSO Master Calendar <https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_grou…>

1 0

**7-MINUTE REMINDER** Meeting Invitation / DNS Abuse Mitigation PDP1 WG | Monday, 13 April 2026
by Julie Bisland April 13, 2026

April 13, 2026

**7-MINUTE REMINDER** Dear all, The next DNS Abuse Mitigation PDP1 WG call will take place on Monday, 13 April 2026 at 12:30 UTC for 90 minutes. Join from PC, Mac, iPad, or Android - Zoom Webinar: https://icann.zoom.us/j/91807711636?pwd=q6XCt8cWQU9m3fGgSojQ5X07pbnX6a.1 Passcode:+X8RaawVrW Phone one-tap: +13126266799,,91807711636#,,,,*0006343077# US (Chicago) +13462487799,,91807711636#,,,,*0006343077# US (Houston) Webinar ID: 918 0771 1636 Passcode: 0006343077 International numbers available: https://icann.zoom.us/u/a9jfXWLB8 * 2026 Meetings wiki: https://icann-community.atlassian.net/wiki/x/B4CWLQ ALL: Before joining the call * Please send apologies to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only (members: please include if an alternate is joining on your behalf) * Please be sure you have read the ICANN Expected Standards of Behavior<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…>, the ICANN Community Anti-Harassment Policy<https://www.icann.org/resources/pages/community-anti-harassment-policy-2017…>, and the ICANN Community Participant Code of Conduct<https://www.icann.org/en/system/files/files/adopted-icann-community-partici…>. * Staff will promote members, participants, and alternates to panelist once joined. OBSERVERS: * Observers will have ability to view member chat and information shared in the zoom webinar room. * Observers will not be able to use chat or raise hands. Thank you. Kind regards, Julie -- Julie Bisland Policy Operations Analyst (GNSO) Internet Corporation for Assigned Names and Numbers (ICANN) Find out more about the GNSO by visiting: https://learn.icann.org/<https://urldefense.proofpoint.com/v2/url?u=https-3A__learn.icann.org_&d=DwM…> Follow @GNSO on Twitter: https://twitter.com/ICANN_GNSO<https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_ICANN-5FGN…> Transcripts and recordings of GNSO Working Group and Council events are located on the GNSO Master Calendar <https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_grou…>

1 0