- Gnso-dnsabuse-pdp - lists.icann.org

Fwd: Namecheap phishing report data for 2025
by Reg Levy April 15, 2026

April 15, 2026

All— The below comes from an observer with more data about reported vs. actual to help get a sense of scale. /R -- Reg Levy | Associate General Counsel – Domains +1 (323) 880-0831 Tucows #MakingTheInternetBetter UTC -7 > Begin forwarded message: > > From: Owen Smigelski <owen.smigelski(a)namecheap.com> > Subject: Namecheap phishing report data for 2025 > Date: April 9, 2026 at 10:08:39 PDT > To: Reg Levy <rlevy(a)tucows.com> > > Hi Reg, > > I saw your email on the list for the ADC PDP regarding phishing reports at Tucows. I reached out to my abuse team, and obtained data for Namecheap and Spaceship for 2025 (which have over 27 million domains under management). The stats are: > > Total reports: 432,796 > Phishing confirmed: 116,871 (27%) > Phishing not confirmed: 315,925 (73%) > > Note: this counts tickets in our system, and some tickets may cover more than one domain name > > Can you please share this with the PDP as another data point regarding the volume of abuse complaints that are not actionable? Thanks! > > Regards, > > Owen > >

6 9

ADC examples
by Ching Chiao April 15, 2026

April 15, 2026

Dear all, Please review the attached 2023 research slides regarding typosquatting groups, which may be relevant to this PDP. In short, the research compares two different datasets -- typo groups vs. confirmed IoC domains . Feel free to ask any questions or comments via the list or privately. Best, Ching *Ching Chiao 乔敬* *Head of APAC & Corporate Development* Check our latest *Internet Abuse Signal* research: https://main.whoisxmlapi.com/blog/to-cache-a-predator-ilovepoop-toolkit-rea… *WhoisXMLAPI.com <http://WhoisXMLAPI.com>* *中文：https://zh.main.whoisxmlapi.com/ <https://zh.main.whoisxmlapi.com/>* *日本语：https://ja.main.whoisxmlapi.com/ <https://ja.main.whoisxmlapi.com/>* LinkedIn : https://www.linkedin.com/in/chiao/ Book a meeting now: https://calendar.app.google/9neWrkwvhPHRqGZ86

1 0

Meeting Invitation / DNS Abuse Mitigation PDP1 WG | Monday, 20 April 2026
by Julie Bisland April 15, 2026

April 15, 2026

Dear all, The next DNS Abuse Mitigation PDP1 WG call will take place on Monday, 20 April 2026 at 12:30 UTC for 90 minutes. Join from PC, Mac, iPad, or Android - Zoom Webinar: https://icann.zoom.us/j/91807711636?pwd=q6XCt8cWQU9m3fGgSojQ5X07pbnX6a.1 Passcode:+X8RaawVrW Phone one-tap: +13126266799,,91807711636#,,,,*0006343077# US (Chicago) +13462487799,,91807711636#,,,,*0006343077# US (Houston) Webinar ID: 918 0771 1636 Passcode: 0006343077 International numbers available: https://icann.zoom.us/u/a9jfXWLB8 * 2026 Meetings wiki: https://icann-community.atlassian.net/wiki/x/B4CWLQ ALL: Before joining the call * Please send apologies to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only (members: please include if an alternate is joining on your behalf) * Please be sure you have read the ICANN Expected Standards of Behavior<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…>, the ICANN Community Anti-Harassment Policy<https://www.icann.org/resources/pages/community-anti-harassment-policy-2017…>, and the ICANN Community Participant Code of Conduct<https://www.icann.org/en/system/files/files/adopted-icann-community-partici…>. * Staff will promote members, participants, and alternates to panelist once joined. OBSERVERS: * Observers will have ability to view member chat and information shared in the zoom webinar room. * Observers will not be able to use chat or raise hands. Thank you. Kind regards, Julie -- Julie Bisland Policy Operations Analyst (GNSO) Internet Corporation for Assigned Names and Numbers (ICANN) Find out more about the GNSO by visiting: https://learn.icann.org/<https://urldefense.proofpoint.com/v2/url?u=https-3A__learn.icann.org_&d=DwM…> Follow @GNSO on Twitter: https://twitter.com/ICANN_GNSO<https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_ICANN-5FGN…> Transcripts and recordings of GNSO Working Group and Council events are located on the GNSO Master Calendar <https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_grou…>

2 1

Proposed Agenda DNSAM PDP1 Monday 13 April 12:30 UTC
by Feodora Hamza April 14, 2026

April 14, 2026

Dear DNSAM PDP1, Please find below the proposed agenda for our call on Monday 13 April 12:30UTC. Agenda Item Time Welcome 5min Update Zoom Features/rules of engagement 5min Update on Milestones for April/May 2026 5min Update on iterative approach on impact assessment 5min Discussion Strawperson on CQ2 40min Deliberations on CQ 3 25min AOB 5min Kind regards, Feodora

2 1

Action Items and High- Level Notes DNSAM PDP1 Meeting 13April 12:30UTC
by Feodora Hamza April 13, 2026

April 13, 2026

Dear DNSAM PDP1, Please find below the high-level notes and action items from today`s meeting. Our next meeting is scheduled for Monday, 20 April at 12:30 UTC. Kind regards, Feodora on behalf of Support Staff 2026-04-13 DNS Abuse Mitigation PDP1 WG<https://icann-community.atlassian.net/wiki/spaces/DAMP1/pages/935755797/202…> Action Items: 1. Leadership with support from staff develop and circulate iterative assessment questionnaire/checklist/tool/document for WG consideration. 2. Staff to update strawpersons in Collaboration Document based on WG discussion. 3. Staff to summarize discussion on CQ3 for WG consideration and follow-up discussion. 4. WG members to review Collaboration Document and suggest edits, changes, data, considerations and alternative language to strawpersons on CQ1 and CQ2. Important Links: * Collaboration Document: https://docs.google.com/document/d/1GxM-Yrgv6sZPEYU8ikW4cRM5YqWsJuWGiQyO39p… * Wiki/Slides (below agenda): https://icann-community.atlassian.net/wiki/spaces/DAMP1/pages/935755797/202… * Recording: https://icann.zoom.us/rec/play/PxWfCxjeNcZxg9aCnPIiedR2Sq9GIJ-ky0jTB3GdxpmI… High Level Notes: 1. Welcome (5 min) 2. Update Zoom Features/rules of engagement (5 min) * Working group roles clarified: · Members expected to actively participate in meetings and in consensus call. · Participants can engage during deliberations but not in consensus call · Alternates only participate if the primary member is unavailable. · Observers can attend calls but no right of posting and communicating in chat or via Email. · If alternates/observers want to share input to the WG they can do so via their SG rep. 3. Update on Milestones for April/May 2026 ( 5 min) * 7 meetings completed. Achievements: · Leadership team finalized. · Work plan and timeline agreed and sent to Council. · Collaboration document established. · Deliberations continuing Charter Questions 1–3. · Strawperson progressing CQ1 and CQ2 · Remaining before ICANN86 - 6 meetings (around 9 hours total). · Planned work: · Discuss Cluster A (1-6) charter questions. · Consider early input for each question. · Develop strawperson draft text. · Begin initial impact assessment on draft language. 4. Update on iterative approach on impact assessment (5 min) * Proposed Approach: Based on WG member input during ICANN86 conduct initial “lightweight”, iterative assessments per charter cluster. Final comprehensive assessment conducted at the end. Aim to avoid discovering “untenable” or “not board-ready” outcomes at the end. Lightweight/iterative approaches do NOT replace final required assessment. * Impact Assessments include: · Human rights<https://docs.google.com/spreadsheets/d/1yuJuDXh_M9dvVhQWsH1pYS2MEpl-I2dDeSr…> · Global public interest<https://docs.google.com/spreadsheets/d/1uVOXywoowxvM1Hn5GuCkkinuZiMc4smc/ed…> · Existing consensus policies<https://www.icann.org/en/contracted-parties/consensus-policies> 5. Discussion Strawperson on CQ2 (40 min) * Reminder on strawperson to CQ1 was presented. * Strawperson for CQ2 was presented after. * Possible criteria for CQ2 MAY include but are not limited to: · Same account /customer /registrant /“end customer” · Common patterns or coordinated activity · Information reasonably available to registrar · Some WG members noted minimum baseline obligations are needed · Others emphasize variability across registrar business models · “Customer,” “registrant,” “account,” “end customer” differ across models. Language should be updated accordingly. · Not all registrars can access same data (e.g., IP, registrant info) · Some WG members suggested to focus on same threat actor, same abusive scheme/campaign 6. Deliberations on CQ 3 (25 min) * Chair presented CQ3 as well as the early input to CQ3 and themes from previous discussion that fit into this question. * Some WG members noted this CQ cannot be answered without agreeing on CQ2. * Some WG noted that “investigation must remain distinct from enforcement”. * Chat input suggested checking at least one reliable internal data point, such as “same account/registrant email,” and using additional technical or abuse-intelligence signals where needed. * Some Members noted the WG should consider the ICANN Advisory on DNS Abuse contract amendments: https://www.icann.org/en/contracted-parties/advisories/documents/advisory-c… 7. AOB (5 min)

1 0

Post Call / DNS Abuse Mitigation PDP1 WG / Monday, 13 April 2026
by Julie Bisland April 13, 2026

April 13, 2026

Dear all, All recordings for the DNS Abuse Mitigation PDP1 WG call held on Monday, 13 April 2026 at 12:30 UTC can be found on the agenda wiki page <https://icann-community.atlassian.net/wiki/x/FYDGNw> (attendance included), which can also be accessed via the GNSO Master calendar<https://gnso.icann.org/en/group-activities/calendar/2026>. These include: * Attendance * Audio recording * Zoom recording (including audio, visual, rough transcript, and chat) * Transcript * Agenda and Notes/Action Items For additional information, you may consult the mailing list archives<https://lists.icann.org/hyperkitty/list/gnso-dnsabuse-pdp@icann.org/> and the main wiki page<https://icann-community.atlassian.net/wiki/x/zoKmLQ>. Thank you. With kind regards, Julie -- Julie Bisland Policy Operations Analyst (GNSO) Internet Corporation for Assigned Names and Numbers (ICANN) Find out more about the GNSO by visiting: https://learn.icann.org/<https://urldefense.proofpoint.com/v2/url?u=https-3A__learn.icann.org_&d=DwM…> Follow @GNSO on Twitter: https://twitter.com/ICANN_GNSO<https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_ICANN-5FGN…> Transcripts and recordings of GNSO Working Group and Council events are located on the GNSO Master Calendar <https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_grou…>

1 0

**7-MINUTE REMINDER** Meeting Invitation / DNS Abuse Mitigation PDP1 WG | Monday, 13 April 2026
by Julie Bisland April 13, 2026

April 13, 2026

**7-MINUTE REMINDER** Dear all, The next DNS Abuse Mitigation PDP1 WG call will take place on Monday, 13 April 2026 at 12:30 UTC for 90 minutes. Join from PC, Mac, iPad, or Android - Zoom Webinar: https://icann.zoom.us/j/91807711636?pwd=q6XCt8cWQU9m3fGgSojQ5X07pbnX6a.1 Passcode:+X8RaawVrW Phone one-tap: +13126266799,,91807711636#,,,,*0006343077# US (Chicago) +13462487799,,91807711636#,,,,*0006343077# US (Houston) Webinar ID: 918 0771 1636 Passcode: 0006343077 International numbers available: https://icann.zoom.us/u/a9jfXWLB8 * 2026 Meetings wiki: https://icann-community.atlassian.net/wiki/x/B4CWLQ ALL: Before joining the call * Please send apologies to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only (members: please include if an alternate is joining on your behalf) * Please be sure you have read the ICANN Expected Standards of Behavior<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…>, the ICANN Community Anti-Harassment Policy<https://www.icann.org/resources/pages/community-anti-harassment-policy-2017…>, and the ICANN Community Participant Code of Conduct<https://www.icann.org/en/system/files/files/adopted-icann-community-partici…>. * Staff will promote members, participants, and alternates to panelist once joined. OBSERVERS: * Observers will have ability to view member chat and information shared in the zoom webinar room. * Observers will not be able to use chat or raise hands. Thank you. Kind regards, Julie -- Julie Bisland Policy Operations Analyst (GNSO) Internet Corporation for Assigned Names and Numbers (ICANN) Find out more about the GNSO by visiting: https://learn.icann.org/<https://urldefense.proofpoint.com/v2/url?u=https-3A__learn.icann.org_&d=DwM…> Follow @GNSO on Twitter: https://twitter.com/ICANN_GNSO<https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_ICANN-5FGN…> Transcripts and recordings of GNSO Working Group and Council events are located on the GNSO Master Calendar <https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_grou…>

1 0

REMINDER | Meeting Invitation / DNS Abuse Mitigation PDP1 WG | Monday, 13 April 2026
by Terri Agnew April 10, 2026

April 10, 2026

Dear all, The next DNS Abuse Mitigation PDP1 WG call will take place on Monday, 13 April 2026 at 12:30 UTC for 90 minutes. Join from PC, Mac, iPad, or Android - Zoom Webinar: https://icann.zoom.us/j/91807711636?pwd=q6XCt8cWQU9m3fGgSojQ5X07pbnX6a.1 Passcode:+X8RaawVrW Phone one-tap: +13126266799,,91807711636#,,,,*0006343077# US (Chicago) +13462487799,,91807711636#,,,,*0006343077# US (Houston) Webinar ID: 918 0771 1636 Passcode: 0006343077 International numbers available: https://icann.zoom.us/u/a9jfXWLB8 * 2026 Meetings wiki: https://icann-community.atlassian.net/wiki/x/B4CWLQ ALL: Before joining the call * Please send apologies to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only (members: please include if an alternate is joining on your behalf) * Please be sure you have read the ICANN Expected Standards of Behavior<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…>, the ICANN Community Anti-Harassment Policy<https://www.icann.org/resources/pages/community-anti-harassment-policy-2017…>, and the ICANN Community Participant Code of Conduct<https://www.icann.org/en/system/files/files/adopted-icann-community-partici…>. * Staff will promote members, participants, and alternates to panelist once joined. OBSERVERS: * Observers will have ability to view member chat and information shared in the zoom webinar room. * Observers will not be able to use chat or raise hands. Thank you. Kind regards, Julie -- Julie Bisland Policy Operations Analyst (GNSO) Internet Corporation for Assigned Names and Numbers (ICANN) Find out more about the GNSO by visiting: https://learn.icann.org/<https://urldefense.proofpoint.com/v2/url?u=https-3A__learn.icann.org_&d=DwM…> Follow @GNSO on Twitter: https://twitter.com/ICANN_GNSO<https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_ICANN-5FGN…> Transcripts and recordings of GNSO Working Group and Council events are located on the GNSO Master Calendar <https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_grou…>

1 0

Re: Threshold - one domain vs a tiered approach
by Nitin Walia April 8, 2026

April 8, 2026

7 10

As promised
by Volker Greimann April 8, 2026

April 8, 2026

Colleagues, Following up on my comments on today’s call, and without revisiting the underlying policy debate, I wanted to elaborate briefly on some of the processes we use already to identify associated domains using data and signals that are squarely within our operational control. In practice, this is not a question of discovering new data, but of correlating existing indicators across registrations and post-registration activity. Common triggers we use include: * One report referencing multiple domains: very often, we see reports where reporters report more than one domain that they have detected through technical monitoring providers. When we see such reports, we analyse these domains for common denominators to check whether other domains match the same patterns. * Multiple reports referencing multiple domains: very often, we see multiple reports of similar domains at the same time or over a short amount of time. Agents recall these reports and start identifying common patterns that can be investigated. * Account-level linkage: on the end-customer level, we can detect other associated domains through shared registrant accounts. Note, some end customers are mere service providers (de-facto resellers). * Fraudulent payment transactions: (limited to end customer services) notices of payment fraud usually tend to lead to investigation of the services purchased with those transactions. * Linked accounts: sometimes, multiple end-customer accounts are detected that share billing credentials, payment instruments, common credentials. * Technical commonalities: repeated use of specific name servers, hosting infrastructure, IP ranges, particularly where patterns persist across otherwise distinct registrations. * Behavioural signals: synchronised registration timing * Common naming patterns: naming patterns such as bankname-country.TLD, phish54.TLD that immediately suggest the existence of similarly named (and used domains) * Account monitoring: in rare cases, new registrations with reseller accounts that have been determined to suffer from persistent abuse of their services by a threat actor may be monitored on a regular basis for suspicious signals matching one of the above triggers. None of this requires speculative inference about intent; it is pattern recognition grounded in registrar-held data and already widely used for fraud prevention, AML-style controls, and contractual compliance. The key policy point, in my view, is therefore not whether associated domains can be detected, but how expectations around the use of these existing capabilities should be framed, documented, and made auditable without creating disproportionate obligations or legal exposure. I hope this clarification is helpful.

1 0