May 2026 - Gnso-dnsabuse-pdp

Post Call / DNS Abuse Mitigation PDP1 WG / Monday, 04 May 2026
by Julie Bisland May 4, 2026

May 4, 2026

Dear all, All recordings for the DNS Abuse Mitigation PDP1 WG call held on Monday, 04 May 2026 at 12:30 UTC can be found on the agenda wiki page <https://icann-community.atlassian.net/wiki/x/KYDJNw> (attendance included), which can also be accessed via the GNSO Master calendar<https://gnso.icann.org/en/group-activities/calendar/2026>. These include: * Attendance * Audio recording * Zoom recording (including audio, visual, rough transcript, and chat) * Transcript * Agenda and Notes/Action Items For additional information, you may consult the mailing list archives<https://lists.icann.org/hyperkitty/list/gnso-dnsabuse-pdp@icann.org/> and the main wiki page<https://icann-community.atlassian.net/wiki/x/zoKmLQ>. Thank you. With kind regards, Julie -- Julie Bisland Policy Operations Analyst (GNSO) Internet Corporation for Assigned Names and Numbers (ICANN) Find out more about the GNSO by visiting: https://learn.icann.org/<https://urldefense.proofpoint.com/v2/url?u=https-3A__learn.icann.org_&d=DwM…> Follow @GNSO on Twitter: https://twitter.com/ICANN_GNSO<https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_ICANN-5FGN…> Transcripts and recordings of GNSO Working Group and Council events are located on the GNSO Master Calendar <https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_grou…>

1 0

Meeting Invitation / DNS Abuse Mitigation PDP1 WG | Monday, 11 May 2026
by Julie Bisland May 4, 2026

May 4, 2026

Dear all, The next DNS Abuse Mitigation PDP1 WG call will take place on Monday, 11 May 2026 at 12:30 UTC for 90 minutes. Join from PC, Mac, iPad, or Android - Zoom Webinar: https://icann.zoom.us/j/91807711636?pwd=q6XCt8cWQU9m3fGgSojQ5X07pbnX6a.1 Passcode:+X8RaawVrW Phone one-tap: +13126266799,,91807711636#,,,,*0006343077# US (Chicago) +13462487799,,91807711636#,,,,*0006343077# US (Houston) Webinar ID: 918 0771 1636 Passcode: 0006343077 International numbers available: https://icann.zoom.us/u/a9jfXWLB8 * 2026 Meetings wiki: https://icann-community.atlassian.net/wiki/x/B4CWLQ ALL: Before joining the call * Please send apologies to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only (members: please include if an alternate is joining on your behalf) * Please be sure you have read the ICANN Expected Standards of Behavior<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…>, the ICANN Community Anti-Harassment Policy<https://www.icann.org/resources/pages/community-anti-harassment-policy-2017…>, and the ICANN Community Participant Code of Conduct<https://www.icann.org/en/system/files/files/adopted-icann-community-partici…>. * Staff will promote members, participants, and alternates to panelist once joined. OBSERVERS: * Observers will have ability to view member chat and information shared in the zoom webinar room. * Observers will not be able to use chat or raise hands. Thank you. Kind regards, Julie -- Julie Bisland Policy Operations Analyst (GNSO) Internet Corporation for Assigned Names and Numbers (ICANN) Find out more about the GNSO by visiting: https://learn.icann.org/<https://urldefense.proofpoint.com/v2/url?u=https-3A__learn.icann.org_&d=DwM…> Follow @GNSO on Twitter: https://twitter.com/ICANN_GNSO<https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_ICANN-5FGN…> Transcripts and recordings of GNSO Working Group and Council events are located on the GNSO Master Calendar <https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_grou…>

1 0

**11-MINUTE REMINDER** Meeting Invitation / DNS Abuse Mitigation PDP1 WG | Monday, 04 May 2026
by Julie Bisland May 4, 2026

May 4, 2026

**11-MINUTE REMINDER** Dear all, The next DNS Abuse Mitigation PDP1 WG call will take place on Monday, 04 May 2026 at 12:30 UTC for 90 minutes. Join from PC, Mac, iPad, or Android - Zoom Webinar: https://icann.zoom.us/j/91807711636?pwd=q6XCt8cWQU9m3fGgSojQ5X07pbnX6a.1 Passcode:+X8RaawVrW Phone one-tap: +13126266799,,91807711636#,,,,*0006343077# US (Chicago) +13462487799,,91807711636#,,,,*0006343077# US (Houston) Webinar ID: 918 0771 1636 Passcode: 0006343077 International numbers available: https://icann.zoom.us/u/a9jfXWLB8 * 2026 Meetings wiki: https://icann-community.atlassian.net/wiki/x/B4CWLQ ALL: Before joining the call * Please send apologies to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only (members: please include if an alternate is joining on your behalf) * Please be sure you have read the ICANN Expected Standards of Behavior<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…>, the ICANN Community Anti-Harassment Policy<https://www.icann.org/resources/pages/community-anti-harassment-policy-2017…>, and the ICANN Community Participant Code of Conduct<https://www.icann.org/en/system/files/files/adopted-icann-community-partici…>. * Staff will promote members, participants, and alternates to panelist once joined. OBSERVERS: * Observers will have ability to view member chat and information shared in the zoom webinar room. * Observers will not be able to use chat or raise hands. Thank you. Kind regards, Julie -- Julie Bisland Policy Operations Analyst (GNSO) Internet Corporation for Assigned Names and Numbers (ICANN) Find out more about the GNSO by visiting: https://learn.icann.org/<https://urldefense.proofpoint.com/v2/url?u=https-3A__learn.icann.org_&d=DwM…> Follow @GNSO on Twitter: https://twitter.com/ICANN_GNSO<https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_ICANN-5FGN…> Transcripts and recordings of GNSO Working Group and Council events are located on the GNSO Master Calendar <https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_grou…>

1 0

DNSAM PDP1 Proposed Agenda 4 May 12:30 UTC
by Feodora Hamza May 4, 2026

May 4, 2026

Dear DNSAM PDP1, Please find below the proposed agenda for our call on Monday, 4 May at 12:30 UTC. 1. Welcome (5min) 2. PDP Updates (10min) 3. Refine strawperson on CQ3 (20min) 4. Discussion on strawperson CQ4 (30min) 5. Start deliberations on CQ5 (20min) 6. AOB (5min) Please also note the below Action Item for the WG: Collaboration Document for review and feedback on CQ1-4: https://docs.google.com/document/d/1GxM-Yrgv6sZPEYU8ikW4cRM5YqWsJuWGiQyO39p… The main adjustments include (highlighted in green text or in suggestion mode): * Adjusted language to CQ1 – CQ3 based on last week’s discussion * Added preliminary language to CQ4 * Some language has been moved as it might fit better to other CQs based on last week’s discussion Please provide your input directly into the document and be ready to discuss it during the next WG call. Kind regards, Feodora on behalf of Support Staff

5 4

ADC detection strategy - define association (Q2)
by Ching Chiao May 1, 2026

May 1, 2026

Dear colleagues, Recently my research team completed an analysis of ~4.3 million domains spanning 2025-12-01 to 2026-03-31, identifying approximately *1.25 million potential clusters (i.e. associated domain groups)*. Here's our cluster breakdown by detection strategy: - Prefix + TLD clustering (Strategy A): ~469K clusters — domains sharing a fixed alphanumeric prefix with variant suffixes under the same TLD. (example below) - Exact apex clustering (Strategy B): ~726K clusters — identical second-level domain registered across multiple TLDs. - N-gram fuzzy clustering (Strategy C): ~50K clusters — near-duplicate apex names detected via trigram locality-sensitive hashing. [image: image.png] Happy to share the original report / ADC group file offline once it's available. Hope this further helps shape the answers to Charter Question 2. Thanks! Best, Ching *Ching Chiao * *Head of APAC & Corporate Development* Check our latest *Internet Abuse Signal* research: https://main.whoisxmlapi.com/blog/to-cache-a-predator-ilovepoop-toolkit-rea… *WhoisXMLAPI.com <http://WhoisXMLAPI.com>* *中文：https://zh.main.whoisxmlapi.com/ <https://zh.main.whoisxmlapi.com/>* *日本语：https://ja.main.whoisxmlapi.com/ <https://ja.main.whoisxmlapi.com/>* LinkedIn : https://www.linkedin.com/in/chiao/ Book a meeting now: https://calendar.app.google/9neWrkwvhPHRqGZ86

2 1

Another numbers request.
by Naoum MENGOUDIS May 1, 2026

May 1, 2026

Dear all, Following the numbers being thrown around in the recent emails, It would be of interest to know the average number of domains an end customer holds. And maybe also the maximum number of domains an end customer holds, to have an idea of the extreme case scenario. This would give us a better estimate of the work needed to be done when doing ADC. [End customer means actual registrants, excluding Resellers and Privacy & Proxy Services] Having 100.000 abusive reports in total says nothing about the overhead of a possible ADC. Maybe ADC would actually help because the reports would be handled in groups instead of one by one (because, as you know, when you are "in the zone" you get more work done compared to starting and stopping and constantly switching contexts). For example, if the average ownership is 100 domains per end customer, you would have to check an additional 99 domains of that customer when one of his domains is reported. Better do it as a group, instead of waiting to do it 100 times in total at some point. PLUS, you can use heuristics, like, if you verify that 20 of the 100 domains of the customer are abusive, and using other available information and indicators (e.g. everything being registered via API and on the same day), you can just deactivate all 100 of the domains and nobody will complain about it (without even having to check further, saving lots and lots of resources). On the contrary, acting on each of the reports that will come in the future is way more resource intensive. And can we have some examples of real scenarios when an ADC would be detrimental to the resource use of the Registrar? So we can validate or not this argument, or any other related argument, or plan appropriate safeguards, instead of dismissing a good practice (i.e. the ADC triggered every time). Regards, Naoum ΜΕΓΓΟΥΔΗΣ Ναούμ Αστυνόμος Α' Διεύθυνση Δίωξης Κυβερνοεγκλήματος Τμήμα Διαδικτυακής Προστασίας Ανηλίκων Λ. Αλεξάνδρας 173, 115 22, Αθήνα<https://www.google.com/maps/place/%CE%94%CE%B9%CE%B5%CF%8D%CE%B8%CF%85%CE%B…> MENGOUDIS Naoum Police Major Cyber Crime Directorate Online Child Protection Department Alexandras Avenue 173, 115 22, Athens<https://www.google.com/maps/place/%CE%94%CE%B9%CE%B5%CF%8D%CE%B8%CF%85%CE%B…> T: (+30) 2106476475 E: n.mengoudis(a)cybercrimeunit.gov.gr<mailto:n.mengoudis@cybercrimeunit.gr> ------------------- Email Disclaimer This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this email. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system.If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. Think green before printing

11 27

Re: RrSG Explainer Documents: Registrar Models and Malicious vs. Compromised Domains
by Tan Tanaka, Dennis May 1, 2026

May 1, 2026

I find this useful information, Natalie. Thank you for sharing. From: Natalie Howatson via Gnso-dnsabuse-pdp <gnso-dnsabuse-pdp(a)icann.org> Reply-To: Natalie Howatson <natalie.howatson(a)comlaude.com> Date: Thursday, April 30, 2026 at 10:04 AM To: "gnso-dnsabuse-pdp(a)icann.org" <gnso-dnsabuse-pdp(a)icann.org> Subject: [EXTERNAL] [Gnso-dnsabuse-pdp] RrSG Explainer Documents: Registrar Models and Malicious vs. Compromised Domains Caution: This email originated from outside the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe. Hello ADC PDP WG members, As a result of the ongoing WG discussions, the RrSG has prepared two explainer documents on Registrar Models and Data Availability and Malicious vs. Compromised Domains. Please find them attached. Furthermore, both documents are also published on the RrSG website: Registrar Models and Data Availability<https://secure-web.cisco.com/1orXpqo6a0G0Vf_VoxmWqiyssELqB0aeiXE3tG5Gk6PT9O…> - Showcases our different business models/relationships, along with types of data we have available to us. Malicious vs Compromised<https://secure-web.cisco.com/1j2kuRQCxIOXvAewbwzFDxuYLVnXEyx34j33VPTkwIrtTQ…> - Definitions related to malicious and compromised domain activity, including examples of each. We hope these help with the continuing discussions on ADC. Natalie Natalie Howatson She/Her Domain Strategist [image]<https://secure-web.cisco.com/1xnXB4RuDUFlV-D3W3oL1P4lrLzvr-CiQ-Chy4KJTSZGm_…> Suite 332, Securities Building, 1904 Third Ave, Seattle, 98101, USA D +1 689 240 5542 comlaude.us<http://secure-web.cisco.com/1Ch0U-IKdvmNWcvv6kTS_Q7zLbci6zWF_rLWdj_jPzl6gEg…> Out of hours emergency helpline: UK +44 20 8213 5922; USA +1 2064877683 Follow us on LinkedIn<https://secure-web.cisco.com/14g4CrG9Q0UWA1VZImqAonk80M82x_JHE1wEMDeWA2PKrX…> and Youtube<https://secure-web.cisco.com/1SeEvWezIK0BZbyQnCxdS80O1l12tcrwayUFhFgd4VI_F2…> [image]<https://secure-web.cisco.com/1CEObgunedsQZxjDaKUaOexcjwZskArjL0baOFmc6DPQhA…> [image] <https://twitter.com/comlaude?lang=en> [image] <https://www.facebook.com/ComLaude/> [image] <https://www.youtube.com/@comlaude> [image] ________________________________ The contents of this email and any attachments are confidential to the intended recipient. They may not be disclosed, used by or copied in any way by anyone other than the intended recipient. If you have received this message in error, please return it to the sender (deleting the body of the email and attachments in your reply) and immediately and permanently delete it. Please note that Com Laude Group Limited (the “Com Laude Group”) does not accept any responsibility for viruses and it is your responsibility to scan or otherwise check this email and any attachments. The Com Laude Group does not accept liability for statements which are clearly the sender's own and not made on behalf of the group or one of its member entities. The Com Laude Group is a limited company registered in England and Wales with company number 10689074 and registered office at 28 Little Russell Street, London, WC1A 2HN England. The Com Laude Group includes Nom-IQ Limited t/a Com Laude, a company registered in England and Wales with company number 5047655 and registered office at 28 Little Russell Street, London, WC1A 2HN England; Valideus Limited, a company registered in England and Wales with company number 6181291 and registered office at 28 Little Russell Street, London, WC1A 2HN England; Demys Limited, a company registered in Scotland with company number SC197176 and registered office at 15 William Street, South West Lane, Edinburgh, EH3 7LL Scotland; Consonum, Inc. dba Com Laude USA and Valideus USA, a corporation incorporated in the State of Washington and principal office address at Suite 332, Securities Building, 1904 Third Ave, Seattle, WA 98101; Com Laude (Japan) Corporation, a company registered in Japan with company number 0100-01-190853 and registered office at 1-3-21 Shinkawa, Chuo-ku, Tokyo, 104-0033, Japan; Com Laude Domain ESP S.L.U., a company registered in Spain and registered office address at Calle Barcas 2, 2, Valencia, 46002, Spain. For further information see www.comlaude.com<https://secure-web.cisco.com/1xnXB4RuDUFlV-D3W3oL1P4lrLzvr-CiQ-Chy4KJTSZGm_…>

1 0

**REMINDER** Meeting Invitation / DNS Abuse Mitigation PDP1 WG | Monday, 04 May 2026
by Julie Bisland May 1, 2026

May 1, 2026

Dear all, The next DNS Abuse Mitigation PDP1 WG call will take place on Monday, 04 May 2026 at 12:30 UTC for 90 minutes. Join from PC, Mac, iPad, or Android - Zoom Webinar: https://icann.zoom.us/j/91807711636?pwd=q6XCt8cWQU9m3fGgSojQ5X07pbnX6a.1 Passcode:+X8RaawVrW Phone one-tap: +13126266799,,91807711636#,,,,*0006343077# US (Chicago) +13462487799,,91807711636#,,,,*0006343077# US (Houston) Webinar ID: 918 0771 1636 Passcode: 0006343077 International numbers available: https://icann.zoom.us/u/a9jfXWLB8 * 2026 Meetings wiki: https://icann-community.atlassian.net/wiki/x/B4CWLQ ALL: Before joining the call * Please send apologies to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only (members: please include if an alternate is joining on your behalf) * Please be sure you have read the ICANN Expected Standards of Behavior<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…>, the ICANN Community Anti-Harassment Policy<https://www.icann.org/resources/pages/community-anti-harassment-policy-2017…>, and the ICANN Community Participant Code of Conduct<https://www.icann.org/en/system/files/files/adopted-icann-community-partici…>. * Staff will promote members, participants, and alternates to panelist once joined. OBSERVERS: * Observers will have ability to view member chat and information shared in the zoom webinar room. * Observers will not be able to use chat or raise hands. Thank you. Kind regards, Julie -- Julie Bisland Policy Operations Analyst (GNSO) Internet Corporation for Assigned Names and Numbers (ICANN) Find out more about the GNSO by visiting: https://learn.icann.org/<https://urldefense.proofpoint.com/v2/url?u=https-3A__learn.icann.org_&d=DwM…> Follow @GNSO on Twitter: https://twitter.com/ICANN_GNSO<https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_ICANN-5FGN…> Transcripts and recordings of GNSO Working Group and Council events are located on the GNSO Master Calendar <https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_grou…>

1 0