- Gnso-dnsabuse-pdp - lists.icann.org

Post Call / DNS Abuse Mitigation PDP1 WG / Monday, 13 April 2026
by Julie Bisland April 13, 2026

April 13, 2026

Dear all, All recordings for the DNS Abuse Mitigation PDP1 WG call held on Monday, 13 April 2026 at 12:30 UTC can be found on the agenda wiki page <https://icann-community.atlassian.net/wiki/x/FYDGNw> (attendance included), which can also be accessed via the GNSO Master calendar<https://gnso.icann.org/en/group-activities/calendar/2026>. These include: * Attendance * Audio recording * Zoom recording (including audio, visual, rough transcript, and chat) * Transcript * Agenda and Notes/Action Items For additional information, you may consult the mailing list archives<https://lists.icann.org/hyperkitty/list/gnso-dnsabuse-pdp@icann.org/> and the main wiki page<https://icann-community.atlassian.net/wiki/x/zoKmLQ>. Thank you. With kind regards, Julie -- Julie Bisland Policy Operations Analyst (GNSO) Internet Corporation for Assigned Names and Numbers (ICANN) Find out more about the GNSO by visiting: https://learn.icann.org/<https://urldefense.proofpoint.com/v2/url?u=https-3A__learn.icann.org_&d=DwM…> Follow @GNSO on Twitter: https://twitter.com/ICANN_GNSO<https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_ICANN-5FGN…> Transcripts and recordings of GNSO Working Group and Council events are located on the GNSO Master Calendar <https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_grou…>

1 0

**7-MINUTE REMINDER** Meeting Invitation / DNS Abuse Mitigation PDP1 WG | Monday, 13 April 2026
by Julie Bisland April 13, 2026

April 13, 2026

**7-MINUTE REMINDER** Dear all, The next DNS Abuse Mitigation PDP1 WG call will take place on Monday, 13 April 2026 at 12:30 UTC for 90 minutes. Join from PC, Mac, iPad, or Android - Zoom Webinar: https://icann.zoom.us/j/91807711636?pwd=q6XCt8cWQU9m3fGgSojQ5X07pbnX6a.1 Passcode:+X8RaawVrW Phone one-tap: +13126266799,,91807711636#,,,,*0006343077# US (Chicago) +13462487799,,91807711636#,,,,*0006343077# US (Houston) Webinar ID: 918 0771 1636 Passcode: 0006343077 International numbers available: https://icann.zoom.us/u/a9jfXWLB8 * 2026 Meetings wiki: https://icann-community.atlassian.net/wiki/x/B4CWLQ ALL: Before joining the call * Please send apologies to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only (members: please include if an alternate is joining on your behalf) * Please be sure you have read the ICANN Expected Standards of Behavior<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…>, the ICANN Community Anti-Harassment Policy<https://www.icann.org/resources/pages/community-anti-harassment-policy-2017…>, and the ICANN Community Participant Code of Conduct<https://www.icann.org/en/system/files/files/adopted-icann-community-partici…>. * Staff will promote members, participants, and alternates to panelist once joined. OBSERVERS: * Observers will have ability to view member chat and information shared in the zoom webinar room. * Observers will not be able to use chat or raise hands. Thank you. Kind regards, Julie -- Julie Bisland Policy Operations Analyst (GNSO) Internet Corporation for Assigned Names and Numbers (ICANN) Find out more about the GNSO by visiting: https://learn.icann.org/<https://urldefense.proofpoint.com/v2/url?u=https-3A__learn.icann.org_&d=DwM…> Follow @GNSO on Twitter: https://twitter.com/ICANN_GNSO<https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_ICANN-5FGN…> Transcripts and recordings of GNSO Working Group and Council events are located on the GNSO Master Calendar <https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_grou…>

1 0

REMINDER | Meeting Invitation / DNS Abuse Mitigation PDP1 WG | Monday, 13 April 2026
by Terri Agnew April 10, 2026

April 10, 2026

Dear all, The next DNS Abuse Mitigation PDP1 WG call will take place on Monday, 13 April 2026 at 12:30 UTC for 90 minutes. Join from PC, Mac, iPad, or Android - Zoom Webinar: https://icann.zoom.us/j/91807711636?pwd=q6XCt8cWQU9m3fGgSojQ5X07pbnX6a.1 Passcode:+X8RaawVrW Phone one-tap: +13126266799,,91807711636#,,,,*0006343077# US (Chicago) +13462487799,,91807711636#,,,,*0006343077# US (Houston) Webinar ID: 918 0771 1636 Passcode: 0006343077 International numbers available: https://icann.zoom.us/u/a9jfXWLB8 * 2026 Meetings wiki: https://icann-community.atlassian.net/wiki/x/B4CWLQ ALL: Before joining the call * Please send apologies to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only (members: please include if an alternate is joining on your behalf) * Please be sure you have read the ICANN Expected Standards of Behavior<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…>, the ICANN Community Anti-Harassment Policy<https://www.icann.org/resources/pages/community-anti-harassment-policy-2017…>, and the ICANN Community Participant Code of Conduct<https://www.icann.org/en/system/files/files/adopted-icann-community-partici…>. * Staff will promote members, participants, and alternates to panelist once joined. OBSERVERS: * Observers will have ability to view member chat and information shared in the zoom webinar room. * Observers will not be able to use chat or raise hands. Thank you. Kind regards, Julie -- Julie Bisland Policy Operations Analyst (GNSO) Internet Corporation for Assigned Names and Numbers (ICANN) Find out more about the GNSO by visiting: https://learn.icann.org/<https://urldefense.proofpoint.com/v2/url?u=https-3A__learn.icann.org_&d=DwM…> Follow @GNSO on Twitter: https://twitter.com/ICANN_GNSO<https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_ICANN-5FGN…> Transcripts and recordings of GNSO Working Group and Council events are located on the GNSO Master Calendar <https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_grou…>

1 0

Re: Threshold - one domain vs a tiered approach
by Nitin Walia April 8, 2026

April 8, 2026

7 10

As promised
by Volker Greimann April 8, 2026

April 8, 2026

Colleagues, Following up on my comments on today’s call, and without revisiting the underlying policy debate, I wanted to elaborate briefly on some of the processes we use already to identify associated domains using data and signals that are squarely within our operational control. In practice, this is not a question of discovering new data, but of correlating existing indicators across registrations and post-registration activity. Common triggers we use include: * One report referencing multiple domains: very often, we see reports where reporters report more than one domain that they have detected through technical monitoring providers. When we see such reports, we analyse these domains for common denominators to check whether other domains match the same patterns. * Multiple reports referencing multiple domains: very often, we see multiple reports of similar domains at the same time or over a short amount of time. Agents recall these reports and start identifying common patterns that can be investigated. * Account-level linkage: on the end-customer level, we can detect other associated domains through shared registrant accounts. Note, some end customers are mere service providers (de-facto resellers). * Fraudulent payment transactions: (limited to end customer services) notices of payment fraud usually tend to lead to investigation of the services purchased with those transactions. * Linked accounts: sometimes, multiple end-customer accounts are detected that share billing credentials, payment instruments, common credentials. * Technical commonalities: repeated use of specific name servers, hosting infrastructure, IP ranges, particularly where patterns persist across otherwise distinct registrations. * Behavioural signals: synchronised registration timing * Common naming patterns: naming patterns such as bankname-country.TLD, phish54.TLD that immediately suggest the existence of similarly named (and used domains) * Account monitoring: in rare cases, new registrations with reseller accounts that have been determined to suffer from persistent abuse of their services by a threat actor may be monitored on a regular basis for suspicious signals matching one of the above triggers. None of this requires speculative inference about intent; it is pattern recognition grounded in registrar-held data and already widely used for fraud prevention, AML-style controls, and contractual compliance. The key policy point, in my view, is therefore not whether associated domains can be detected, but how expectations around the use of these existing capabilities should be framed, documented, and made auditable without creating disproportionate obligations or legal exposure. I hope this clarification is helpful.

1 0

Action Items DNSAM PDP1 - 7 April 12:30 UTC
by Feodora Hamza April 7, 2026

April 7, 2026

Dear DNSAM PDP1, please see below the high-level notes and action items from todays call. The session recording can be found here: https://icann.zoom.us/recording/detail?meeting_id=T7r3Qf8yTNm0QjfqG5q2Lg%3D… Our next meeting is scheduled for Monday, 13 April at 12:30 UTC. Kind regards, Feodora Action Items: * Staff to update straw person incorporating discussion on Q1 and 2 * WG to Review updated straw person and propose language adjustments toward convergence as well as rationale * WG to provide input on business models and potential impact/considerations e.g. Clarify direct vs. reseller models and any others to inform association criteria. Important Documents: * Collaboration Document: https://docs.google.com/document/d/1GxM-Yrgv6sZPEYU8ikW4cRM5YqWsJuWGiQyO39p… * WG wiki/ Session Slides: https://icann-community.atlassian.net/wiki/spaces/DAMP1/pages/935755777/202… * Recording: https://icann.zoom.us/recording/detail?meeting_id=T7r3Qf8yTNm0QjfqG5q2Lg%3D… High Level Notes: 1. Welcome (2 min) 2. Decision on WG Meeting Schedule & holidays (3 min) * Meeting schedule and holiday adjustments are “locked in”. Meetings to continue Mondays at 12:30 UTC. Some meeting conflicting w major holidays have been moved to Tuesday 12:30. Meeting invites have been updated. Please check your inbox. 1. Update on Workplan (5 min) · Work plan submitted to Council; expected to be discussed/acknowledged on 16 April. · Board liaisons confirmed: Jim Galvin, Chris Buckridge 4. Updates on CQ 1 (25 min) * Preliminary recommendation (strawperson): When a registrar has actionable evidence and has taken mitigation under 3.18.2, registrar must perform an associated domain check. * No convergence seems to exist on the following areas: · Disagreement on whether action must occur before conducting ADC. · Whether one abusive/malicious domain is sufficient trigger/threshold. · Some noted the risk of potentially low threshold, workload, and “guilt by association”. · Please see link to collaboration document for more details on proposed language: https://docs.google.com/document/d/1GxM-Yrgv6sZPEYU8ikW4cRM5YqWsJuWGiQyO39p… 5. Continue Deliberations to CQ 2 and CQ 3 (50 min) * Seems to be alignment on: · Association criteria should be flexible, non-prescriptive, and adaptable. · Avoid a fixed checklist, prefer examples/best practices. · Recognize variation across registrar models and evolving threat behaviour. · Further discussion needed on the relationship between “indicators” and contractual requirements? 6. AOB (5 min)

1 0

Post Call / DNS Abuse Mitigation PDP1 WG / Tuesday, 07 April 2026
by Julie Bisland April 7, 2026

April 7, 2026

Dear all, All recordings for the DNS Abuse Mitigation PDP1 WG call held on Tuesday, 07 April 2026 at 12:30 UTC can be found on the agenda wiki page <https://icann-community.atlassian.net/wiki/x/AYDGNw> (attendance included), which can also be accessed via the GNSO Master calendar<https://gnso.icann.org/en/group-activities/calendar/2026>. These include: * Attendance * Audio recording * Zoom recording (including audio, visual, rough transcript, and chat) * Transcript * Agenda and Notes/Action Items For additional information, you may consult the mailing list archives<https://lists.icann.org/hyperkitty/list/gnso-dnsabuse-pdp@icann.org/> and the main wiki page<https://icann-community.atlassian.net/wiki/x/zoKmLQ>. Thank you. With kind regards, Julie -- Julie Bisland Policy Operations Analyst (GNSO) Internet Corporation for Assigned Names and Numbers (ICANN) Find out more about the GNSO by visiting: https://learn.icann.org/<https://urldefense.proofpoint.com/v2/url?u=https-3A__learn.icann.org_&d=DwM…> Follow @GNSO on Twitter: https://twitter.com/ICANN_GNSO<https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_ICANN-5FGN…> Transcripts and recordings of GNSO Working Group and Council events are located on the GNSO Master Calendar <https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_grou…>

1 0

Meeting Invitation / DNS Abuse Mitigation PDP1 WG / Monday, 13 April 2026
by Julie Bisland April 7, 2026

April 7, 2026

Dear all, The next DNS Abuse Mitigation PDP1 WG call will take place on Monday, 13 April 2026 at 12:30 UTC for 90 minutes. Join from PC, Mac, iPad, or Android - Zoom Webinar: https://icann.zoom.us/j/91807711636?pwd=q6XCt8cWQU9m3fGgSojQ5X07pbnX6a.1 Passcode:+X8RaawVrW Phone one-tap: +13126266799,,91807711636#,,,,*0006343077# US (Chicago) +13462487799,,91807711636#,,,,*0006343077# US (Houston) Webinar ID: 918 0771 1636 Passcode: 0006343077 International numbers available: https://icann.zoom.us/u/a9jfXWLB8 * 2026 Meetings wiki: https://icann-community.atlassian.net/wiki/x/B4CWLQ * Check your time zone: Event Time Announcer - DNS Abuse Mitigation PDP1 WG call<https://tinyurl.com/mr3m4tc6> ALL: Before joining the call * Please send apologies to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only (members: please include if an alternate is joining on your behalf) * Staff will promote members, participants, and alternates to Panelist once joined. The prompt MUST be accepted to be moved to a Panelist. * Please be sure you have read the ICANN Expected Standards of Behavior<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…>, the ICANN Community Anti-Harassment Policy<https://www.icann.org/resources/pages/community-anti-harassment-policy-2017…>, and the ICANN Community Participant Code of Conduct<https://www.icann.org/en/system/files/files/adopted-icann-community-partici…>. OBSERVERS: * Observers will have ability to view member chat and information shared in the zoom webinar room. * Observers will not be able to use chat or raise hands. Thank you. Kind regards, Julie -- Julie Bisland Policy Operations Analyst (GNSO) Internet Corporation for Assigned Names and Numbers (ICANN) Find out more about the GNSO by visiting: https://learn.icann.org/<https://urldefense.proofpoint.com/v2/url?u=https-3A__learn.icann.org_&d=DwM…> Follow @GNSO on Twitter: https://twitter.com/ICANN_GNSO<https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_ICANN-5FGN…> Transcripts and recordings of GNSO Working Group and Council events are located on the GNSO Master Calendar <https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_grou…>

1 0

**15 MINUTE REMINDER** Meeting Invitation / DNS Abuse Mitigation PDP1 WG | Tuesday, 07 April 2026
by Julie Bisland April 7, 2026

April 7, 2026

**15 MINUTE REMINDER** Dear all, The next DNS Abuse Mitigation PDP1 WG call will take place on Tuesday, 07 April 2026 at 12:30 UTC for 90 minutes (moved from Monday, 06 April, holiday). Check your timezone.<https://tinyurl.com/dzwh626t> Join from PC, Mac, iPad, or Android - Zoom Webinar: https://icann.zoom.us/j/91807711636?pwd=q6XCt8cWQU9m3fGgSojQ5X07pbnX6a.1 Passcode:+X8RaawVrW Phone one-tap: +13126266799,,91807711636#,,,,*0006343077# US (Chicago) +13462487799,,91807711636#,,,,*0006343077# US (Houston) Webinar ID: 918 0771 1636 Passcode: 0006343077 International numbers available: https://icann.zoom.us/u/a9jfXWLB8 * 2026 Meetings wiki: https://icann-community.atlassian.net/wiki/x/B4CWLQ ALL: Before joining the call * Please send apologies to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only (members: please include if an alternate is joining on your behalf) * Please be sure you have read the ICANN Expected Standards of Behavior<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…>, the ICANN Community Anti-Harassment Policy<https://www.icann.org/resources/pages/community-anti-harassment-policy-2017…>, and the ICANN Community Participant Code of Conduct<https://www.icann.org/en/system/files/files/adopted-icann-community-partici…>. * Staff will promote members, participants, and alternates to panelist once joined. OBSERVERS: * Observers will have ability to view member chat and information shared in the zoom webinar room. * Observers will not be able to use chat or raise hands. Thank you. Kind regards, Julie -- Julie Bisland Policy Operations Analyst (GNSO) Internet Corporation for Assigned Names and Numbers (ICANN) Find out more about the GNSO by visiting: https://learn.icann.org/<https://urldefense.proofpoint.com/v2/url?u=https-3A__learn.icann.org_&d=DwM…> Follow @GNSO on Twitter: https://twitter.com/ICANN_GNSO<https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_ICANN-5FGN…> Transcripts and recordings of GNSO Working Group and Council events are located on the GNSO Master Calendar <https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_grou…>

2 1

SME, weighing in (fork)
by Reg Levy April 7, 2026

April 7, 2026

I’d like to respond to Ching’s request for data: > It would be very helpful if the SMEs (such as NetBeason or NetCraft) & the Registrars could kindly share the following information (i.e. as required by by RAA <https://itp.cdn.icann.org/en/files/accredited-registrars/registrar-accredit…> 3.18.4) which will help ascertain to the level of effort that will actually be needed to conduct ADC: > Number of complaints received in 2025 > Number of complaints that were valid > Number of complaints that were actioned I would submit that the number of complaints received by reporters is less relevant than those received by registrars, since we are the ones acting (and upon whom the onus of the new policy or best practices will fall). I’d also like to note that we are required to maintain records but not create them; what follows should not be understood to be readily available to any registrar and is only available to me because of an unrelated internal project. In 2025, IANA 69, one of the four registrars my team manages, received just under 100k abuse complaints marked as “phishing” through our online forms. Note that this does not include any other type of DNS Abuse or other abuse and does not include phishing reported through different means. Fewer than 10,000 were legitimate phishing complaints. We have to sift through 90% chaff to even get to the phishing reports—and that doesn’t look at the validity of the reports in the first place. ────────────────────────────┼───────── │ Category │ Tickets │ ├────────────────────────────┼─────────┤ │ TOTAL │ 98,212 │ ├────────────────────────────┼─────────┤ │ Noise │ 39,267 │ ├────────────────────────────┼─────────┤ │ Legitimate (all others) │ 58,945 │ ├────────────────────────────┼─────────┤ ├────────────────────────────┼─────────┤ │ MISROUTED REQUESTS │ 12,298 │ ├────────────────────────────┼─────────┤ │ Support request │ 6.142 │ ├────────────────────────────┼─────────┤ │ Sales inquiry │ 3,133 │ ├────────────────────────────┼─────────┤ │ Technical support │ 1,569 │ ├────────────────────────────┼─────────┤ │ Complaint, all other │ 1,454 │ ├────────────────────────────┼─────────┤ ├────────────────────────────┼─────────┤ │ DOMAIN DISPUTES │ 13,609 │ ├────────────────────────────┼─────────┤ │ Domain ownership │ 6,120 │ ├────────────────────────────┼─────────┤ │ Registry compliance │ 4,243 │ ├────────────────────────────┼─────────┤ │ UDRP │ 1,828 │ ├────────────────────────────┼─────────┤ │ Whois issues │ 841 │ ├────────────────────────────┼─────────┤ │ Whois inaccuracy │ 577 │ ├────────────────────────────┼─────────┤ ├────────────────────────────┼─────────┤ │ CONTENT CONCERNS │ 15,062 │ ├────────────────────────────┼─────────┤ │ Hosting (non-DMCA) │ 7,833 │ ├────────────────────────────┼─────────┤ │ DMCA │ 3,888 │ ├────────────────────────────┼─────────┤ │ Law enforcement │ 3,341 │ ├────────────────────────────┼─────────┤ ├────────────────────────────┼─────────┤ │ Phishing │ 8,291 │ ────────────────────────────┴───────── I hope this is helpful context for the conversation. Servus, Reg -- Reg Levy | Associate General Counsel – Domains +1 (323) 880-0831 Tucows #MakingTheInternetBetter UTC -7

5 7