- Gnso-dnsabuse-pdp - lists.icann.org

Re: Another numbers request.
by Eberhard W Lisse April 20, 2026

April 20, 2026

Becky, you are the lawyer, I am not. I just mean a concept. Can you take down a Registered Name, just because (at least) another Name registered by same Registrant has been mitigated? If a single Registrant has 5 Names, 1 reported, investigated, proven as phishing, and mitigated accordingly, ADC done, and 3 of the others are mitigable, I still don't like that the 5th one would or could be mitigated as well. However as Marc wrote, you act against the Registrant (for violating the Terms and Conditions). How would that work? Can you really unilaterally decide to take Names down, or do you have to give notice of termination of the Registrant agreement (0 to n days notice)? So they transfer the Name elsewhere, and perhaps even register the mitigated Names again. Now you take a Reseller which has a Million Names. ADC finds 50, 500 or even 5000 in need of mitigation. Do you take the 50, 500 or 5000 names down or do you cancel the agreement with the Reseller (for violation the Terms and Conditions). What happens then to the Names left? Or if the Reseller is just irritated enough that they transfer significant Revenue elsewhere? There are enough accredited Registrars around, after all. The obviously even more difficult question is how to prevent them from becoming wise to the Policy and transferring the rest of a portfolio to another Registrar, when a single one is taken down, ie before the ADC can be done? We have not thought through the consequences of our considerations, and/or the cost. el -- Dr. Eberhard W. Lisse \ / Obstetrician & Gynaecologist (retired) el(a)lisse.NA / * | Telephone: +264 81 124 6733 (cell) PO Box 8421 Bachbrecht \ / If this email is signed with GPG/PGP 10007, Namibia ;____/ Sect 20 of Act No. 4 of 2019 may apply On Apr 14, 2026 at 18:50 +0200, Becky Burr <bburr(a)pir.org>, wrote: > I am confused by the use of the term “guilt by association” here. That usually means you consider one person guilty of some bad act because that person is associated with someone else who is a known bad guy. And yes, in that context, there are significant human rights concerns. > > Here, we are just saying that if a registrant/account holder is known to be using one domain for DNS abuse then we are going to check to make sure the same registrant/account holder isn’t using other domains for DNS abuse. And, if the answer is no, then nothing happens to the associated domains. So, unless you are arguing that domains themselves have human rights, I don’t see what the guilt by association issue is. > > Am I missing something? > > Becky Burr

9 15

Meeting Invitation / DNS Abuse Mitigation PDP1 WG | Monday, 04 May 2026
by Julie Bisland April 20, 2026

April 20, 2026

Reminder: The call for 27 April was cancelled due to the CP Summit. The next team call is 04 May: Dear all, The next DNS Abuse Mitigation PDP1 WG call will take place on Monday, 04 May 2026 at 12:30 UTC for 90 minutes. Join from PC, Mac, iPad, or Android - Zoom Webinar: https://icann.zoom.us/j/91807711636?pwd=q6XCt8cWQU9m3fGgSojQ5X07pbnX6a.1 Passcode:+X8RaawVrW Phone one-tap: +13126266799,,91807711636#,,,,*0006343077# US (Chicago) +13462487799,,91807711636#,,,,*0006343077# US (Houston) Webinar ID: 918 0771 1636 Passcode: 0006343077 International numbers available: https://icann.zoom.us/u/a9jfXWLB8 * 2026 Meetings wiki: https://icann-community.atlassian.net/wiki/x/B4CWLQ ALL: Before joining the call * Please send apologies to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only (members: please include if an alternate is joining on your behalf) * Please be sure you have read the ICANN Expected Standards of Behavior<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…>, the ICANN Community Anti-Harassment Policy<https://www.icann.org/resources/pages/community-anti-harassment-policy-2017…>, and the ICANN Community Participant Code of Conduct<https://www.icann.org/en/system/files/files/adopted-icann-community-partici…>. * Staff will promote members, participants, and alternates to panelist once joined. OBSERVERS: * Observers will have ability to view member chat and information shared in the zoom webinar room. * Observers will not be able to use chat or raise hands. Thank you. Kind regards, Julie -- Julie Bisland Policy Operations Analyst (GNSO) Internet Corporation for Assigned Names and Numbers (ICANN) Find out more about the GNSO by visiting: https://learn.icann.org/<https://urldefense.proofpoint.com/v2/url?u=https-3A__learn.icann.org_&d=DwM…> Follow @GNSO on Twitter: https://twitter.com/ICANN_GNSO<https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_ICANN-5FGN…> Transcripts and recordings of GNSO Working Group and Council events are located on the GNSO Master Calendar <https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_grou…>

2 1

High-Level Notes and AIs DNSAM PDP1 20 April 12:30 UTC
by Feodora Hamza April 20, 2026

April 20, 2026

Dear DNSAM PDP1, Please find below the high-level notes and Action Items from today’s meeting, Out next meeting is scheduled for Monday, 4 May 2026 at 12:30. There is no meeting on 27 April due to the CP Summit. Safe Travels and a good time to all travelling to Manchester. Kind regards, Feodora on behalf of Support Staff 2026-04-20 DNS Abuse Mitigation PDP1 WG<https://icann-community.atlassian.net/wiki/spaces/DAMP1/pages/935952385/202…> Action Items: WG Members · Review preliminary language for Charter Questions 3 and provide alternative language/changes/suggestions/etc. · Add comments and specific drafting suggestions for all “preliminary language/ CQ1-3” were relevant. · Review early input for Charter Questions 4 and 5 and provide comments and feedback to be discussed during next meeting. Leadership/Staff * Update collaboration document, develop preliminary language with today’s comments. Important documents/links: * Collaboration document: https://docs.google.com/document/d/1GxM-Yrgv6sZPEYU8ikW4cRM5YqWsJuWGiQyO39p… * Wiki space/slides: https://icann-community.atlassian.net/wiki/spaces/DAMP1/pages/935952385/202… * Recording: https://icann.zoom.us/rec/share/g9IUiTa38Sh-KUIzBeSMewHH70lrvVTQyHgHf_0Txki… [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/rec/share/g9IUiTa38Sh-KUIz…> High Level Notes: 1. Welcome (5 min) · Farzaneh Badi noted she joined an organization as part of Digital Medusa work called Future of Freedom of Speech, based in Nashville. · Reminder given on ICANN standards of behaviour, anti-harassment policy, and code of conduct. · Zoom settings have been updated and no Email will be asked to join the webinar. This was an unintentional setting change and has been addressed during the meeting. 2. Update ICANN86 planning (5 min) · Prep-Week webinar: Wed, 20 May 15:00 - 16:00 UTC · ICANN86: 4 DNS Abuse sessions (local time) planned for ICANN86. · 2 on Monday 8 June - 11:45 to 13:15 and 14:45 to 16:00 · 1 on Wednesday 10 June - 10:00 - 11:15 · 1 on Thursday 11 June - 11:45 - 13:15. 3. Continue discussion on strawperson CQ2 (20 min) · Chair presented revised text with new green-highlighted language reflecting prior working group comments and mailing list input. · General support for language allowing registrars to use a flexible set of criteria rather than a fixed checklist. · Discussion focused on whether there should be: · a minimum baseline expectation of checks using reasonably available information, while · preserving flexibility across different registrar business models. · Some WG members suggested, if registrars are given flexibility in methods, there should be some transparency around what factors are used. Could be periodic reports (6-month or annual), not necessarily incident-by-incident. · Some WG members noted obligations should be business model agnostic. · Other WG members noted, this could give threat actors a roadmap to evade detection. · Transparency reporting is not currently required under the RAA. · May be broader than this PDP and outside scope of Question 2. · Chair noted to include the Transparency topic as “interesting topic” to the list of topics to keep in mind and potentially communicate to Council. · Some WG Members linked transparency to Charter Question 5. 4. Discussion on preliminary language on CQ3 (25 min) * Chair presented preliminary language on CQ3. * Some WG Members objected to wording requiring a “reliable” internal data point due to ambiguity. * Also objected to language that could imply mandatory purchase/use of third-party intelligence feeds. * Split language into: · Must check one internal data point. · May use additional technical or abuse intelligence signals. · WG members noted one abusive domain should clearly be enough to trigger ADC and wording should not retreat from that. · WG members noted noted potential inconsistency in CQ1 and CQ3: · Earlier language suggested ADC would occur after mitigation. · Preliminary language in CQ3 noted flexible ADC before/during/after mitigation. 5. Deliberation on CQ4 (20 min) * WG members said registrars already must comply with: RAA, GDPR where applicable, National/local privacy laws * Investigations must follow evidence where it leads. “Strictly necessary” is too restrictive and unclear. * Better wording might be reasonable or reasonably necessary. * WG members noted raised distinction between: · Investigations yielding no result · Investigations leading to mitigation · Data needed for compliance etc. · Others noted against creating new retention rules where RAA already covers record retention. 6. AOB (5 min)

1 0

Post Call / DNS Abuse Mitigation PDP1 WG / Monday, 20 April 2026
by Julie Bisland April 20, 2026

April 20, 2026

Dear all, All recordings for the DNS Abuse Mitigation PDP1 WG call held on Monday, 20 April 2026 at 12:30 UTC can be found on the agenda wiki page <https://icann-community.atlassian.net/wiki/x/AYDJNw> (attendance included), which can also be accessed via the GNSO Master calendar<https://gnso.icann.org/en/group-activities/calendar/2026>. These include: * Attendance * Audio recording * Zoom recording (including audio, visual, rough transcript, and chat) * Transcript * Agenda and Notes/Action Items For additional information, you may consult the mailing list archives<https://lists.icann.org/hyperkitty/list/gnso-dnsabuse-pdp@icann.org/> and the main wiki page<https://icann-community.atlassian.net/wiki/x/zoKmLQ>. Thank you. With kind regards, Julie -- Julie Bisland Policy Operations Analyst (GNSO) Internet Corporation for Assigned Names and Numbers (ICANN) Find out more about the GNSO by visiting: https://learn.icann.org/<https://urldefense.proofpoint.com/v2/url?u=https-3A__learn.icann.org_&d=DwM…> Follow @GNSO on Twitter: https://twitter.com/ICANN_GNSO<https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_ICANN-5FGN…> Transcripts and recordings of GNSO Working Group and Council events are located on the GNSO Master Calendar <https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_grou…>

1 0

**15-MINUTE REMINDER** Meeting Invitation / DNS Abuse Mitigation PDP1 WG | Monday, 20 April 2026
by Julie Bisland April 20, 2026

April 20, 2026

**15-MINUTE REMINDER** Dear all, The next DNS Abuse Mitigation PDP1 WG call will take place on Monday, 20 April 2026 at 12:30 UTC for 90 minutes. Join from PC, Mac, iPad, or Android - Zoom Webinar: https://icann.zoom.us/j/91807711636?pwd=q6XCt8cWQU9m3fGgSojQ5X07pbnX6a.1 Passcode:+X8RaawVrW Phone one-tap: +13126266799,,91807711636#,,,,*0006343077# US (Chicago) +13462487799,,91807711636#,,,,*0006343077# US (Houston) Webinar ID: 918 0771 1636 Passcode: 0006343077 International numbers available: https://icann.zoom.us/u/a9jfXWLB8 * 2026 Meetings wiki: https://icann-community.atlassian.net/wiki/x/B4CWLQ ALL: Before joining the call * Please send apologies to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only (members: please include if an alternate is joining on your behalf) * Please be sure you have read the ICANN Expected Standards of Behavior<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…>, the ICANN Community Anti-Harassment Policy<https://www.icann.org/resources/pages/community-anti-harassment-policy-2017…>, and the ICANN Community Participant Code of Conduct<https://www.icann.org/en/system/files/files/adopted-icann-community-partici…>. * Staff will promote members, participants, and alternates to panelist once joined. OBSERVERS: * Observers will have ability to view member chat and information shared in the zoom webinar room. * Observers will not be able to use chat or raise hands. Thank you. Kind regards, Julie -- Julie Bisland Policy Operations Analyst (GNSO) Internet Corporation for Assigned Names and Numbers (ICANN) Find out more about the GNSO by visiting: https://learn.icann.org/<https://urldefense.proofpoint.com/v2/url?u=https-3A__learn.icann.org_&d=DwM…> Follow @GNSO on Twitter: https://twitter.com/ICANN_GNSO<https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_ICANN-5FGN…> Transcripts and recordings of GNSO Working Group and Council events are located on the GNSO Master Calendar <https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_grou…>

3 4

Re: Proposed Agenda for DNSAM PDP1 Monday 20 April 2026 12:30 UTC
by Eberhard W Lisse April 17, 2026

April 17, 2026

Julie, I see... I was thinking we'd get prep-material via the email. el -- Sent from my iPhone On Apr 17, 2026 at 14:28 +0200, Julie Bisland <julie.bisland(a)icann.org>, wrote: > Hello Eberhard, > > Feodora’s email did not have an attachment, the body of the email contains the agenda and the link to the collab doc. > > Kind regards, > > Julie > -- > Julie Bisland > Policy Team Supporting the GNSO > > > From: Eberhard W Lisse via Gnso-dnsabuse-pdp <gnso-dnsabuse-pdp(a)icann.org> > Reply-To: Eberhard W Lisse <el(a)lisse.na> > Date: Friday, April 17, 2026 at 7:23 AM > To: Bruna Martins dos Santos via Gnso-dnsabuse-pdp <gnso-dnsabuse-pdp(a)icann.org> > Subject: [Gnso-dnsabuse-pdp] Re: Proposed Agenda for DNSAM PDP1 Monday 20 April 2026 12:30 UTC > > Fedora, > > in my email there was nothing attached. > > el > > -- > Sent from my iPhone > On Apr 17, 2026 at 10:04 +0200, Feodora Hamza via Gnso-dnsabuse-pdp <gnso-dnsabuse-pdp(a)icann.org>, wrote: > > > Dear DNSAM PDP1, > > > > Please find below the proposed agenda for our next call on Monday, 20 April at 12:30 UTC. > > > > Agenda Item > > Time > > Welcome > > 5min > > Update ICANN86 planning > > 5min > > Continue discussion on strawperson CQ2 > > 20min > > Discussion on preliminary language on CQ3 > > 25min > > Deliberation on CQ4 > > 20min > > AOB > > 5min > > > > Please also find here the updated collaboration document for discussion during the meeting. > > The updates include: > > > > • Suggested additional language highlighted in green to CQ2 > > • Preliminary draft language based on WG discussion to CQ3 > > • Collab Doc: https://docs.google.com/document/d/1GxM-Yrgv6sZPEYU8ikW4cRM5YqWsJuWGiQyO39p… [docs.google.com] > > > > > > Kind regards, > > Feodora > > > > _______________________________________________ > > Gnso-dnsabuse-pdp mailing list -- gnso-dnsabuse-pdp(a)icann.org > > To unsubscribe send an email to gnso-dnsabuse-pdp-leave(a)icann.org

2 1

Proposed Agenda for DNSAM PDP1 Monday 20 April 2026 12:30 UTC
by Feodora Hamza April 17, 2026

April 17, 2026

Dear DNSAM PDP1, Please find below the proposed agenda for our next call on Monday, 20 April at 12:30 UTC. Agenda Item Time Welcome 5min Update ICANN86 planning 5min Continue discussion on strawperson CQ2 20min Discussion on preliminary language on CQ3 25min Deliberation on CQ4 20min AOB 5min Please also find here the updated collaboration document for discussion during the meeting. The updates include: * Suggested additional language highlighted in green to CQ2 * Preliminary draft language based on WG discussion to CQ3 * Collab Doc: https://docs.google.com/document/d/1GxM-Yrgv6sZPEYU8ikW4cRM5YqWsJuWGiQyO39p… Kind regards, Feodora

2 1

**REMINDER** Meeting Invitation / DNS Abuse Mitigation PDP1 WG | Monday, 20 April 2026
by Julie Bisland April 17, 2026

April 17, 2026

Dear all, The next DNS Abuse Mitigation PDP1 WG call will take place on Monday, 20 April 2026 at 12:30 UTC for 90 minutes. Join from PC, Mac, iPad, or Android - Zoom Webinar: https://icann.zoom.us/j/91807711636?pwd=q6XCt8cWQU9m3fGgSojQ5X07pbnX6a.1 Passcode:+X8RaawVrW Phone one-tap: +13126266799,,91807711636#,,,,*0006343077# US (Chicago) +13462487799,,91807711636#,,,,*0006343077# US (Houston) Webinar ID: 918 0771 1636 Passcode: 0006343077 International numbers available: https://icann.zoom.us/u/a9jfXWLB8 * 2026 Meetings wiki: https://icann-community.atlassian.net/wiki/x/B4CWLQ ALL: Before joining the call * Please send apologies to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only (members: please include if an alternate is joining on your behalf) * Please be sure you have read the ICANN Expected Standards of Behavior<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…>, the ICANN Community Anti-Harassment Policy<https://www.icann.org/resources/pages/community-anti-harassment-policy-2017…>, and the ICANN Community Participant Code of Conduct<https://www.icann.org/en/system/files/files/adopted-icann-community-partici…>. * Staff will promote members, participants, and alternates to panelist once joined. OBSERVERS: * Observers will have ability to view member chat and information shared in the zoom webinar room. * Observers will not be able to use chat or raise hands. Thank you. Kind regards, Julie -- Julie Bisland Policy Operations Analyst (GNSO) Internet Corporation for Assigned Names and Numbers (ICANN) Find out more about the GNSO by visiting: https://learn.icann.org/<https://urldefense.proofpoint.com/v2/url?u=https-3A__learn.icann.org_&d=DwM…> Follow @GNSO on Twitter: https://twitter.com/ICANN_GNSO<https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_ICANN-5FGN…> Transcripts and recordings of GNSO Working Group and Council events are located on the GNSO Master Calendar <https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_grou…>

1 0

Re: Proposed Agenda DNSAM PDP1 Monday 13 April 12:30 UTC
by Tan Tanaka, Dennis April 16, 2026

April 16, 2026

+1 From: Volker Greimann via Gnso-dnsabuse-pdp <gnso-dnsabuse-pdp(a)icann.org> Reply-To: Volker Greimann <volker.greimann(a)centralnic.com> Date: Tuesday, April 14, 2026 at 6:49 PM To: "gnso-dnsabuse-pdp(a)icann.org" <gnso-dnsabuse-pdp(a)icann.org>, Feodora Hamza <feodora.hamza(a)icann.org> Subject: [EXTERNAL] [Gnso-dnsabuse-pdp] Re: Proposed Agenda DNSAM PDP1 Monday 13 April 12:30 UTC Caution: This email originated from outside the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe. Hi Feodora, quick question: When papers are produced for our work and presentation at the next meeting, when are they published by ICANN so we can look at them? Would it be possible to publish them no later than Friday morning so everyone has the ability to review them during work hours? While us Europeans can review on the Monday, there are those of us who do enjoy their week-ends and for whom the call is at 4 am on Mondays, so a little lead time would be appreciated so everyone is on the same level and able to prepare before the meetings... Sincerely, Volker Greimann General Counsel & Head of Policy and Compliance - Online Division volker.greimann(a)centralnic.com Office: +49-172-6367025 Web: www.teaminternet.com Team Internet Group PLC (AIM:TIG). Registered Office: 4th Floor, Saddlers House, 44 Gutter Lane, London, United Kingdom, EC2V 6BR. Team Internet is a company registered in England and Wales with the company number 8576358. ________________________________ From: Feodora Hamza via Gnso-dnsabuse-pdp <gnso-dnsabuse-pdp(a)icann.org> Sent: 10 April 2026 5:08 PM To: gnso-dnsabuse-pdp(a)icann.org <gnso-dnsabuse-pdp(a)icann.org> Subject: [Gnso-dnsabuse-pdp] Proposed Agenda DNSAM PDP1 Monday 13 April 12:30 UTC Dear DNSAM PDP1, Please find below the proposed agenda for our call on Monday 13 April 12:30UTC. Agenda Item Time Welcome 5min Update Zoom Features/rules of engagement 5min Update on Milestones for April/May 2026 5min Update on iterative approach on impact assessment 5min Discussion Strawperson on CQ2 40min Deliberations on CQ 3 25min AOB 5min Kind regards, Feodora

2 1

Another numbers request.
by Naoum MENGOUDIS April 15, 2026

April 15, 2026

Dear all, Following the numbers being thrown around in the recent emails, It would be of interest to know the average number of domains an end customer holds. And maybe also the maximum number of domains an end customer holds, to have an idea of the extreme case scenario. This would give us a better estimate of the work needed to be done when doing ADC. [End customer means actual registrants, excluding Resellers and Privacy & Proxy Services] Having 100.000 abusive reports in total says nothing about the overhead of a possible ADC. Maybe ADC would actually help because the reports would be handled in groups instead of one by one (because, as you know, when you are "in the zone" you get more work done compared to starting and stopping and constantly switching contexts). For example, if the average ownership is 100 domains per end customer, you would have to check an additional 99 domains of that customer when one of his domains is reported. Better do it as a group, instead of waiting to do it 100 times in total at some point. PLUS, you can use heuristics, like, if you verify that 20 of the 100 domains of the customer are abusive, and using other available information and indicators (e.g. everything being registered via API and on the same day), you can just deactivate all 100 of the domains and nobody will complain about it (without even having to check further, saving lots and lots of resources). On the contrary, acting on each of the reports that will come in the future is way more resource intensive. And can we have some examples of real scenarios when an ADC would be detrimental to the resource use of the Registrar? So we can validate or not this argument, or any other related argument, or plan appropriate safeguards, instead of dismissing a good practice (i.e. the ADC triggered every time). Regards, Naoum ΜΕΓΓΟΥΔΗΣ Ναούμ Αστυνόμος Α' Διεύθυνση Δίωξης Κυβερνοεγκλήματος Τμήμα Διαδικτυακής Προστασίας Ανηλίκων Λ. Αλεξάνδρας 173, 115 22, Αθήνα<https://www.google.com/maps/place/%CE%94%CE%B9%CE%B5%CF%8D%CE%B8%CF%85%CE%B…> MENGOUDIS Naoum Police Major Cyber Crime Directorate Online Child Protection Department Alexandras Avenue 173, 115 22, Athens<https://www.google.com/maps/place/%CE%94%CE%B9%CE%B5%CF%8D%CE%B8%CF%85%CE%B…> T: (+30) 2106476475 E: n.mengoudis(a)cybercrimeunit.gov.gr<mailto:n.mengoudis@cybercrimeunit.gr> ------------------- Email Disclaimer This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this email. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system.If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. Think green before printing

11 24