Re: New Interisle Study
We should be doing policy to address the risk and that’s legitimate and appropriate, just like we do for human rights impact assessment. We consider the risk to human rights. But the urgency of this issue and the effectiveness of whatever policy we produce should not be inflated based on data whose methodology we cannot fully audit, and sometimes not produced by neutral parties and without validation of definitions etc. We need to be proportionate and rigorous, so that we don’t come up with a policy that causes overreach, could impact people’s access to domains and increase political and legal risk. Auerbach is making some interesting comments about the report which I have pasted here: From where I sit claims of "malicious" and "abuse" are often mere whining about acts that are neither actually malicious nor actually abusive. What I am suggesting is that when writing about domain names (or in this case, about the mere registration of a name) as being malicious or abusive that those terms not only ought to be clearly defined, but that those definitions be front and center on any report about such domains. The Interisle report says this (on page 35): *How does Interisle determine if a domain has been “maliciously registered?”* *We consider domains blocklisted within 90 days of registration to be malicious.* I note that Interisle seems to distinguish between malicious *registration* and malicious *use*. There us a vast gap there - the same as the difference between a) buying a glass cutter and b) using that glass cutter in a crime (such as cutting through a window pane in order to commit a burglary.) In other words in the minds of Interisle, a domain that somebody puts onto some block lists within three months is adjudged, usually without further inquiry, as "malicious". Or to put it another way around, what is "malicious" depends on the opinions of some unknown block listing agencies. That is not not a definition. Rather it is an invitation to vigilante and inconsistent behaviour. A true definition would dig into real actions that have been actually performed through the use of an accused domain name. Perhaps the Interisle definition could be useful as a sieve to identify registrations that deserve deeper inquiry. But saying that a domain name is malicious simply on the basis of block list entries is a process based on third party rumor (in law we would call that "hearsay", a thing that is usually excluded by our rules of evidence) rather than on a presentation of relevant, directly obtained, supporting facts. Farzaneh On Wed, Jun 3, 2026 at 1:52 AM Nitin Walia via Gnso-dnsabuse-pdp < gnso-dnsabuse-pdp@icann.org> wrote:
ICANN Published Two Years of Enforcing DNS Abuse Mitigation Requirements: Progress & Next Steps
https://www.icann.org/en/blogs/details/two-years-of-enforcing-dns-abuse-miti...
Warm Regards
*Nitin Walia*Director Data Ingenious Global nitin@data.in | नितिन@डाटा.भारत www.data.in -------------------------------------------------------------- The content of this email is confidential and intended only for the recipient specified. If you received this message in error, please delete it and inform the sender. ------------------------------
*From:* David Hughes via Gnso-dnsabuse-pdp <gnso-dnsabuse-pdp@icann.org> MailId : [154969301] *To:* trachtenbergm@gtlaw.com,gnso-dnsabuse-pdp@icann.org *Subject: *[Gnso-dnsabuse-pdp] Re: New Interisle Study *Date:* 03 Jun 2026 06:24:57 AM
thank you Marc,
You beat me to the punch.
Very useful study, none of it surprising. but Shockingly high levels of abuse levels at some registrars. (if I read it correctly, one has 80% plus abuse?, please correct me if i am reading it wrong).
*From: *trachtenbergm--- via Gnso-dnsabuse-pdp < gnso-dnsabuse-pdp@icann.org> *Date: *Tuesday, June 2, 2026 at 9:58 AM *To: *gnso-dnsabuse-pdp@icann.org <gnso-dnsabuse-pdp@icann.org> *Subject: *[Gnso-dnsabuse-pdp] New Interisle Study
FYI fellow members of the DNS Abuse PDP Part 1,
The new Interisle study is out and underscores the importance of this PDP getting it right and resulting in something that is meaningful, including in particular, having measurable and enforceable obligations (see *https://interisle.net/insights/cybercriminaldomaindemand* <https://urldefense.com/v3/__https:/interisle.net/insights/cybercriminaldomai...> ).
The report indicates that *10% to 20% of domains are registered for bad purposes, but it might be even higher. *The report further indicated that 10% of gTLD domains registered in 2025 have been added to blocklists,* and almost all of these were registered for malicious purposes rather than being compromised. *As an aside, WhoisXML API analyzes 8-10 million new registrations every month and *generally estimates that about a quarter of them are registered for malicious purposes* <https://main.whoisxmlapi.com/blog/april-2026-domain-activity-highlights> ).
Notably for this PDP, the report also addresses Associated Domains - see in particular pg 17:
A recent study about associated domains was performed by the research team in ICANN’s Office of the CTO (OCTO). This study found that “at least 16% of newly registered gTLD domains, [created] in the first quarter of 2025, exhibited batch registration patterns.” Starting with an initial set of “seed” RBL- listed domains, the researchers found an additional 80% more domains that were associated with the blocklisted ones. This “indicates that for every three newly registered malicious domains reported through RBL feeds, batch expansion (using conservative filtering) identifies an additional two neighboring domains.” The researchers stated that “the true rate is likely to be higher” since they excluded ”many valid batches” such as those containing more than 1,000 domains. The results “indicate that batch registrations are prevalent, significantly predict overall abuse rates, and are useful for pivoting and expanding from known malicious ‘seed’ domain sets, particularly in certain TLDs and registrar environments.”
Best regards,
*Marc H. Trachtenberg* Shareholder
Chair, Internet, Domain Name, e-Commerce and Social Media Practice Greenberg Traurig, LLP
*Aspen Chicago*
411 E. Main Street <https://www.google.com/maps/search/411+E.+Main+Street?entry=gmail&source=g> 360 North Green Street
Suite 207 | Aspen, CO 81611 Suite 1300 | Chicago, IL 60607
T +1.970.300.5313 T +1.312.456.1020
M +1.773.677.3305 M +1.773.677.3305 *trac@gtlaw.com* <trachtenbergm@gtlaw.com> | *www.gtlaw.com* <http://www.gtlaw.com/> | *View GT Biography* <https://www.gtlaw.com/en/professionals/t/trachtenberg-marc-h>
[image: image001.png]
[image: image002.png]
------------------------------ If you are not an intended recipient of confidential and privileged information in this email, please delete it, notify us immediately at postmaster@gtlaw.com, and do not use or disseminate the information.
_______________________________________________ Gnso-dnsabuse-pdp mailing list -- gnso-dnsabuse-pdp@icann.org To unsubscribe send an email to gnso-dnsabuse-pdp-leave@icann.org
Do not Remove: [HID]20260603062457190[-HID]
[XGENFOOTER]
[-XGENFOOTER] _______________________________________________ Gnso-dnsabuse-pdp mailing list -- gnso-dnsabuse-pdp@icann.org To unsubscribe send an email to gnso-dnsabuse-pdp-leave@icann.org
I also find that paper unhelpful. But in some jurisdictions, for example Germany, transporting burglary equipment can be a crime in itself, and carrying tools or specialized equipment to overcome security measures significantly increases potential penalties during a theft conviction. In other words registration of names like govnaa.TOP AND using them or a subdomain like nampol.govnaa.TOP for pharming already requires mitigation under current RAA. Registering additionally govbw.TOP would in itself not require ADV. But if govNAA.TOP were mitigated (for actionable evidence of malicious abuse) THEN the ADC MUST be conducted. The ADC should catch (the (malicious) registrations of govbw.TOP and similar like gobbr.TOP gouvfr.TOP. Now how to automate the search is a matter for Claude and Levenshstein but doable, and so the subsequent decision by a human should not take that long. While I do not want to mansplain Human Rights, I HAVE lived under occupation myself (before Namibian Independence), and HAVE in my day job had some experience with the combatting of Child Abuse and Gender Based Violence, but I think our Human Rights considerations should not go overboard. el -- Dr. Eberhard W. Lisse \ / Obstetrician & Gynaecologist (retired) el@lisse.NA / * | Telephone: +264 81 124 6733 (cell) PO Box 8421 Bachbrecht \ / If this email is signed with GPG/PGP 10007, Namibia ;____/ Sect 20 of Act No. 4 of 2019 may apply On Jun 5, 2026 at 22:21 +0200, farzaneh badii via Gnso-dnsabuse-pdp <gnso-dnsabuse-pdp@icann.org>, wrote:
[…] The Interisle report says this (on page 35): How does Interisle determine if a domain has been “maliciously registered?” We consider domains blocklisted within 90 days of registration to be malicious. I note that Interisle seems to distinguish between malicious *registration* and malicious *use*. There us a vast gap there - the same as the difference between a) buying a glass cutter and b) using that glass cutter in a crime (such as cutting through a window pane in order to commit a burglary.) In other words in the minds of Interisle, a domain that somebody puts onto some block lists within three months is adjudged, usually without further inquiry, as "malicious". […]
One of the primary goals for ADC should be to provide better consumer protection and reduce economic harm to businesses. Currently, it is far too easy for bad-faith actors (human, or human + bot) to create large volumes of associated domains -- as shown in the Interisle report, and it is increasingly difficult for third parties to perform effective ADC, even with AI / ML . We must remember that registrars are in a much better position to perform ADC than external parties. Let's not deviate from such goal. Best regards, Ching On Sat, Jun 6, 2026 at 6:08 PM Eberhard W Lisse via Gnso-dnsabuse-pdp < gnso-dnsabuse-pdp@icann.org> wrote:
I also find that paper unhelpful.
But in some jurisdictions, for example Germany, transporting burglary equipment can be a crime in itself, and *carrying tools or specialized equipment to overcome security measures significantly increases potential penalties during a theft conviction.*
In other words registration of names like govnaa.TOP AND using them or a subdomain like nampol.govnaa.TOP for pharming already requires mitigation under current RAA.
Registering additionally govbw.TOP would in itself not require ADV.
But if govNAA.TOP were mitigated (for actionable evidence of malicious abuse) THEN the ADC MUST be conducted.
The ADC should catch (the (malicious) registrations of govbw.TOP and similar like gobbr.TOP gouvfr.TOP.
Now how to automate the search is a matter for Claude and Levenshstein but doable, and so the subsequent decision by a human should not take that long.
While I do not want to mansplain Human Rights, I HAVE lived under occupation myself (before Namibian Independence), and HAVE in my day job had some experience with the combatting of Child Abuse and Gender Based Violence, but I think our Human Rights considerations should not go overboard.
el
-- Dr. Eberhard W. Lisse \ / Obstetrician & Gynaecologist (retired) el@lisse.NA / * | Telephone: +264 81 124 6733 (cell) PO Box 8421 Bachbrecht \ / If this email is signed with GPG/PGP 10007, Namibia ;____/ Sect 20 of Act No. 4 of 2019 may apply On Jun 5, 2026 at 22:21 +0200, farzaneh badii via Gnso-dnsabuse-pdp < gnso-dnsabuse-pdp@icann.org>, wrote:
[…] The Interisle report says this (on page 35): *How does Interisle determine if a domain has been “maliciously registered?”* *We consider domains blocklisted within 90 days of registration to be malicious.* I note that Interisle seems to distinguish between malicious *registration* and malicious *use*. There us a vast gap there - the same as the difference between a) buying a glass cutter and b) using that glass cutter in a crime (such as cutting through a window pane in order to commit a burglary.) In other words in the minds of Interisle, a domain that somebody puts onto some block lists within three months is adjudged, usually without further inquiry, as "malicious". […]
_______________________________________________ Gnso-dnsabuse-pdp mailing list -- gnso-dnsabuse-pdp@icann.org To unsubscribe send an email to gnso-dnsabuse-pdp-leave@icann.org
You mention "currently" and "the Interisle report". The one I can find was from 2020. Is there a more recent one? i refuse to even consider 6 year old data. el -- Dr. Eberhard W. Lisse \ / Obstetrician & Gynaecologist (retired) el@lisse.NA / * | Telephone: +264 81 124 6733 (cell) PO Box 8421 Bachbrecht \ / If this email is signed with GPG/PGP 10007, Namibia ;____/ Sect 20 of Act No. 4 of 2019 may apply On Jun 7, 2026 at 00:04 +0200, Ching Chiao via Gnso-dnsabuse-pdp <gnso-dnsabuse-pdp@icann.org>, wrote:
One of the primary goals for ADC should be to provide better consumer protection and reduce economic harm to businesses. Currently, it is far too easy for bad-faith actors (human, or human + bot) to create large volumes of associated domains -- as shown in the Interisle report, and it is increasingly difficult for third parties to perform effective ADC, even with AI / ML .
We must remember that registrars are in a much better position to perform ADC than external parties. Let's not deviate from such goal.
Best regards,
Ching […]
that’s the one…sponsored by Meta... Cheers, CD Chris Disspain Senior Advisor on Policy and Internet Governance 
On 7 Jun 2026, at 14:23, David Hughes via Gnso-dnsabuse-pdp <gnso-dnsabuse-pdp@icann.org> wrote:
Eberhard,
I believe they are referencing the aisle study that was released June 1, 2026
https://interisle.net/insights/cybercriminaldomaindemand
On Jun 7, 2026, at 08:47, Eberhard W Lisse via Gnso-dnsabuse-pdp <gnso-dnsabuse-pdp@icann.org> wrote:
You mention "currently" and "the Interisle report".
The one I can find was from 2020. Is there a more recent one? i refuse to even consider 6 year old data.
el
-- Dr. Eberhard W. Lisse \ / Obstetrician & Gynaecologist (retired) el@lisse.NA <mailto:el@lisse.NA> / * | Telephone: +264 81 124 6733 (cell) PO Box 8421 Bachbrecht \ / If this email is signed with GPG/PGP 10007, Namibia ;____/ Sect 20 of Act No. 4 of 2019 may apply On Jun 7, 2026 at 00:04 +0200, Ching Chiao via Gnso-dnsabuse-pdp <gnso-dnsabuse-pdp@icann.org <mailto:gnso-dnsabuse-pdp@icann.org>>, wrote:
One of the primary goals for ADC should be to provide better consumer protection and reduce economic harm to businesses. Currently, it is far too easy for bad-faith actors (human, or human + bot) to create large volumes of associated domains -- as shown in the Interisle report, and it is increasingly difficult for third parties to perform effective ADC, even with AI / ML .
We must remember that registrars are in a much better position to perform ADC than external parties. Let's not deviate from such goal.
Best regards,
Ching […] _______________________________________________ Gnso-dnsabuse-pdp mailing list -- gnso-dnsabuse-pdp@icann.org To unsubscribe send an email to gnso-dnsabuse-pdp-leave@icann.org
Gnso-dnsabuse-pdp mailing list -- gnso-dnsabuse-pdp@icann.org To unsubscribe send an email to gnso-dnsabuse-pdp-leave@icann.org
thank you, el -- Dr. Eberhard W. Lisse \ / Obstetrician & Gynaecologist (retired) el@lisse.NA / * | Telephone: +264 81 124 6733 (cell) PO Box 8421 Bachbrecht \ / If this email is signed with GPG/PGP 10007, Namibia ;____/ Sect 20 of Act No. 4 of 2019 may apply On Jun 7, 2026 at 14:25 +0100, Chris Disspain <chris.disspain@identity.digital>, wrote:
that’s the one…sponsored by Meta...
Cheers,
CD
Chris Disspain Senior Advisor on Policy and Internet Governance
On 7 Jun 2026, at 14:23, David Hughes via Gnso-dnsabuse-pdp <gnso-dnsabuse-pdp@icann.org> wrote:
Eberhard,
I believe they are referencing the aisle study that was released June 1, 2026
<Interisle-Consulting-Group---Malicious-Registrations-in-the-Domain-Market.jpg> Malicious Registrations in the Domain Name Market: An Analysis of 2025 gTLD Registrations and Cybercriminal Demand — Interisle Consulting Group interisle.net
On Jun 7, 2026, at 08:47, Eberhard W Lisse via Gnso-dnsabuse-pdp <gnso-dnsabuse-pdp@icann.org> wrote:
You mention "currently" and "the Interisle report".
The one I can find was from 2020. Is there a more recent one? i refuse to even consider 6 year old data.
el
-- Dr. Eberhard W. Lisse \ / Obstetrician & Gynaecologist (retired) el@lisse.NA / * | Telephone: +264 81 124 6733 (cell) PO Box 8421 Bachbrecht \ / If this email is signed with GPG/PGP 10007, Namibia ;____/ Sect 20 of Act No. 4 of 2019 may apply On Jun 7, 2026 at 00:04 +0200, Ching Chiao via Gnso-dnsabuse-pdp <gnso-dnsabuse-pdp@icann.org>, wrote:
One of the primary goals for ADC should be to provide better consumer protection and reduce economic harm to businesses. Currently, it is far too easy for bad-faith actors (human, or human + bot) to create large volumes of associated domains -- as shown in the Interisle report, and it is increasingly difficult for third parties to perform effective ADC, even with AI / ML .
We must remember that registrars are in a much better position to perform ADC than external parties. Let's not deviate from such goal.
Best regards,
Ching […]
Gnso-dnsabuse-pdp mailing list -- gnso-dnsabuse-pdp@icann.org To unsubscribe send an email to gnso-dnsabuse-pdp-leave@icann.org
Gnso-dnsabuse-pdp mailing list -- gnso-dnsabuse-pdp@icann.org To unsubscribe send an email to gnso-dnsabuse-pdp-leave@icann.org
While one perhaps should not equate "being on a block list" with "Malicious Registration" I think the methodology they used to identify Associated Domain Names can be helpful el On 2026-06-07 17:24, Eberhard W Lisse via Gnso-dnsabuse-pdp wrote:
thank you,
el [...] <chris.disspain@identity.digital>, wrote:>> that’s the one…sponsored by Meta...
Cheers,
CD
Chris Disspain Senior Advisor on Policy and Internet Governance
[...]
On 7 Jun 2026, at 14:23, David Hughes via Gnso-dnsabuse-pdp <gnso- dnsabuse-pdp@icann.org> wrote:
Eberhard,
I believe they are referencing the aisle study that was released June 1, 2026
[...]
Malicious Registrations in the Domain Name Market: An Analysis of 2025 gTLD Registrations and Cybercriminal Demand — Interisle Consulting Group <https://interisle.net/insights/ cybercriminaldomaindemand> [...]
-- Eberhard W. Lisse \ /Obstetrician & Gynaecologist (retired) el@lisse.NA / * | Telephone: +264 81 124 6733 (cell) PO Box 8421 Bachbrecht\ / If this email is signed with GPG/PGP 10007, Namibia ;____/ Sect 20 of Act No. 4 of 2019 may apply
Farzi, You appear to have selected quotes from something written by Karl Auerbach, but did not state where we can find Karl’s comments. Can you give us the source and where we can find these comments and also clarify if you agree with these comments? Best regards, Marc H. Trachtenberg Shareholder Chair, Internet, Domain Name, e-Commerce and Social Media Practice Greenberg Traurig, LLP Aspen Chicago 411 E. Main Street 360 North Green Street Suite 207 | Aspen, CO 81611 Suite 1300 | Chicago, IL 60607 T +1.970.300.5313 T +1.312.456.1020 M +1.773.677.3305 M +1.773.677.3305 trac@gtlaw.com<mailto:trachtenbergm@gtlaw.com> | www.gtlaw.com<http://www.gtlaw.com/> | View GT Biography <https://www.gtlaw.com/en/professionals/t/trachtenberg-marc-h> [Greenberg Traurig Logo] [Greenberg Traurig Logo] From: farzaneh badii via Gnso-dnsabuse-pdp <gnso-dnsabuse-pdp@icann.org> Sent: Friday, June 5, 2026 3:20 PM To: Nitin Walia <nitin@data.in> Cc: david hughes via gnso-dnsabuse-pdp <gnso-dnsabuse-pdp@icann.org> Subject: [Gnso-dnsabuse-pdp] Re: New Interisle Study *EXTERNAL TO GT* We should be doing policy to address the risk and that’s legitimate and appropriate, just like we do for human rights impact assessment. We consider the risk to human rights. But the urgency of this issue and the effectiveness of whatever policy we produce should not be inflated based on data whose methodology we cannot fully audit, and sometimes not produced by neutral parties and without validation of definitions etc. We need to be proportionate and rigorous, so that we don’t come up with a policy that causes overreach, could impact people’s access to domains and increase political and legal risk. Auerbach is making some interesting comments about the report which I have pasted here: From where I sit claims of "malicious" and "abuse" are often mere whining about acts that are neither actually malicious nor actually abusive. What I am suggesting is that when writing about domain names (or in this case, about the mere registration of a name) as being malicious or abusive that those terms not only ought to be clearly defined, but that those definitions be front and center on any report about such domains. The Interisle report says this (on page 35): How does Interisle determine if a domain has been “maliciously registered?” We consider domains blocklisted within 90 days of registration to be malicious. I note that Interisle seems to distinguish between malicious *registration* and malicious *use*. There us a vast gap there - the same as the difference between a) buying a glass cutter and b) using that glass cutter in a crime (such as cutting through a window pane in order to commit a burglary.) In other words in the minds of Interisle, a domain that somebody puts onto some block lists within three months is adjudged, usually without further inquiry, as "malicious". Or to put it another way around, what is "malicious" depends on the opinions of some unknown block listing agencies. That is not not a definition. Rather it is an invitation to vigilante and inconsistent behaviour. A true definition would dig into real actions that have been actually performed through the use of an accused domain name. Perhaps the Interisle definition could be useful as a sieve to identify registrations that deserve deeper inquiry. But saying that a domain name is malicious simply on the basis of block list entries is a process based on third party rumor (in law we would call that "hearsay", a thing that is usually excluded by our rules of evidence) rather than on a presentation of relevant, directly obtained, supporting facts. Farzaneh On Wed, Jun 3, 2026 at 1:52 AM Nitin Walia via Gnso-dnsabuse-pdp <gnso-dnsabuse-pdp@icann.org<mailto:gnso-dnsabuse-pdp@icann.org>> wrote: ICANN Published Two Years of Enforcing DNS Abuse Mitigation Requirements: Progress & Next Steps https://www.icann.org/en/blogs/details/two-years-of-enforcing-dns-abuse-mitigation-requirements-progress-next-steps-02-06-2026-en<https://urldefense.com/v3/__https:/www.icann.org/en/blogs/details/two-years-of-enforcing-dns-abuse-mitigation-requirements-progress-next-steps-02-06-2026-en__;!!DUT_TFPxUQ!CHFepM5qOjRdd6UGNFVPNHHeOdQZZV_GM2IA9ioTV-xYpqWZy_fv6u2OdTOB3IxyD1U684hsYTFr_wlEkS-MldpbeVySOw$> Warm Regards Nitin Walia Director Data Ingenious Global nitin@data.in<mailto:nitin@data.in> | नितिन@डाटा.भारत<mailto:नितिन@डाटा.भारत> www.data.in <https://urldefense.com/v3/__http:/www.data.in__;!!DUT_TFPxUQ!CHFepM5qOjRdd6UGNFVPNHHeOdQZZV_GM2IA9ioTV-xYpqWZy_fv6u2OdTOB3IxyD1U684hsYTFr_wlEkS-MldptDEzFTg$>-------------------------------------------------------------- The content of this email is confidential and intended only for the recipient specified. If you received this message in error, please delete it and inform the sender. ________________________________ From: David Hughes via Gnso-dnsabuse-pdp <gnso-dnsabuse-pdp@icann.org<mailto:gnso-dnsabuse-pdp@icann.org>> MailId : [154969301] To: trachtenbergm@gtlaw.com<mailto:trachtenbergm@gtlaw.com>,gnso-dnsabuse-pdp@icann.org<mailto:gnso-dnsabuse-pdp@icann.org> Subject: [Gnso-dnsabuse-pdp] Re: New Interisle Study Date: 03 Jun 2026 06:24:57 AM thank you Marc, You beat me to the punch. Very useful study, none of it surprising. but Shockingly high levels of abuse levels at some registrars. (if I read it correctly, one has 80% plus abuse?, please correct me if i am reading it wrong). From: trachtenbergm--- via Gnso-dnsabuse-pdp <gnso-dnsabuse-pdp@icann.org<mailto:gnso-dnsabuse-pdp@icann.org>> Date: Tuesday, June 2, 2026 at 9:58 AM To: gnso-dnsabuse-pdp@icann.org<mailto:gnso-dnsabuse-pdp@icann.org> <gnso-dnsabuse-pdp@icann.org<mailto:gnso-dnsabuse-pdp@icann.org>> Subject: [Gnso-dnsabuse-pdp] New Interisle Study FYI fellow members of the DNS Abuse PDP Part 1, The new Interisle study is out and underscores the importance of this PDP getting it right and resulting in something that is meaningful, including in particular, having measurable and enforceable obligations (see https://interisle.net/insights/cybercriminaldomaindemand<https://urldefense.com/v3/__https:/interisle.net/insights/cybercriminaldomaindemand__;!!DUT_TFPxUQ!FfDi89N72mvRDxT00WYlsd9yGjYu4CACzJeSlj8hPxfqnhjnPDX11kS4-ERuAR7I5x1ANhp2Ri3erNn8Qw$>). The report indicates that 10% to 20% of domains are registered for bad purposes, but it might be even higher. The report further indicated that 10% of gTLD domains registered in 2025 have been added to blocklists, and almost all of these were registered for malicious purposes rather than being compromised. As an aside, WhoisXML API analyzes 8-10 million new registrations every month and generally estimates that about a quarter of them are registered for malicious purposes<https://urldefense.com/v3/__https:/main.whoisxmlapi.com/blog/april-2026-doma...>). Notably for this PDP, the report also addresses Associated Domains - see in particular pg 17: A recent study about associated domains was performed by the research team in ICANN’s Office of the CTO (OCTO). This study found that “at least 16% of newly registered gTLD domains, [created] in the first quarter of 2025, exhibited batch registration patterns.” Starting with an initial set of “seed” RBL- listed domains, the researchers found an additional 80% more domains that were associated with the blocklisted ones. This “indicates that for every three newly registered malicious domains reported through RBL feeds, batch expansion (using conservative filtering) identifies an additional two neighboring domains.” The researchers stated that “the true rate is likely to be higher” since they excluded ”many valid batches” such as those containing more than 1,000 domains. The results “indicate that batch registrations are prevalent, significantly predict overall abuse rates, and are useful for pivoting and expanding from known malicious ‘seed’ domain sets, particularly in certain TLDs and registrar environments.” Best regards, Marc H. Trachtenberg Shareholder Chair, Internet, Domain Name, e-Commerce and Social Media Practice Greenberg Traurig, LLP Aspen Chicago 411 E. Main Street<https://urldefense.com/v3/__https:/www.google.com/maps/search/411*E.*Main*St...> 360 North Green Street Suite 207 | Aspen, CO 81611 Suite 1300 | Chicago, IL 60607 T +1.970.300.5313 T +1.312.456.1020 M +1.773.677.3305 M +1.773.677.3305 trac@gtlaw.com<mailto:trachtenbergm@gtlaw.com> | www.gtlaw.com<http://www.gtlaw.com/> | View GT Biography<https://www.gtlaw.com/en/professionals/t/trachtenberg-marc-h> [cid:image005.png@01DCF704.E98E9E00] [cid:image004.png@01DCF704.E98E9E00] ________________________________ If you are not an intended recipient of confidential and privileged information in this email, please delete it, notify us immediately at postmaster@gtlaw.com<mailto:postmaster@gtlaw.com>, and do not use or disseminate the information. _______________________________________________ Gnso-dnsabuse-pdp mailing list -- gnso-dnsabuse-pdp@icann.org<mailto:gnso-dnsabuse-pdp@icann.org> To unsubscribe send an email to gnso-dnsabuse-pdp-leave@icann.org<mailto:gnso-dnsabuse-pdp-leave@icann.org> Do not Remove: [HID]20260603062457190[-HID] [XGENFOOTER] [-XGENFOOTER] [https://mail.data.in/XGenPlusMessageID:17804659545892562data-][https://dlr.tbms.in/XET5680:202606.jpg] _______________________________________________ Gnso-dnsabuse-pdp mailing list -- gnso-dnsabuse-pdp@icann.org<mailto:gnso-dnsabuse-pdp@icann.org> To unsubscribe send an email to gnso-dnsabuse-pdp-leave@icann.org<mailto:gnso-dnsabuse-pdp-leave@icann.org>
Hi, Thank you for sharing this study. The findings are certainly noteworthy, particularly the data on malicious registrations and the prevalence of associated domains identified through batch registration analysis. The indication that a significant proportion of abuse-related domains may be proactively identifiable through association patterns suggests that there may be opportunities for earlier detection and mitigation of DNS abuse. At the same time, I believe these findings reinforce the importance of ensuring that any recommendations emerging from this PDP are both evidence-based and proportionate. While studies such as this provide valuable insights into abuse trends, we should carefully consider issues such as accuracy, false positives, due process, and the potential impact on legitimate registrants when discussing measurable and enforceable obligations. The observations regarding associated domains are especially relevant to our discussions. It may be useful for the PDP to further examine how such indicators could be incorporated into abuse detection and response frameworks while maintaining appropriate safeguards and accountability mechanisms. I look forward to hearing the perspectives of other members on how these findings might inform our ongoing work. On Mon, Jun 8, 2026 at 11:10 AM trachtenbergm--- via Gnso-dnsabuse-pdp < gnso-dnsabuse-pdp@icann.org> wrote:
Farzi,
You appear to have selected quotes from something written by Karl Auerbach, but did not state where we can find Karl’s comments. Can you give us the source and where we can find these comments and also clarify if you agree with these comments?
Best regards,
*Marc H. Trachtenberg * Shareholder
Chair, Internet, Domain Name, e-Commerce and Social Media Practice Greenberg Traurig, LLP
*Aspen Chicago*
411 E. Main Street 360 North Green Street
Suite 207 | Aspen, CO 81611 Suite 1300 | Chicago, IL 60607
T +1.970.300.5313 T +1.312.456.1020
M +1.773.677.3305 M +1.773.677.3305 trac@gtlaw.com <trachtenbergm@gtlaw.com> | www.gtlaw.com | View GT Biography <https://www.gtlaw.com/en/professionals/t/trachtenberg-marc-h>
[image: Greenberg Traurig Logo]
[image: Greenberg Traurig Logo]
*From:* farzaneh badii via Gnso-dnsabuse-pdp <gnso-dnsabuse-pdp@icann.org>
*Sent:* Friday, June 5, 2026 3:20 PM *To:* Nitin Walia <nitin@data.in> *Cc:* david hughes via gnso-dnsabuse-pdp <gnso-dnsabuse-pdp@icann.org> *Subject:* [Gnso-dnsabuse-pdp] Re: New Interisle Study
**EXTERNAL TO GT**
We should be doing policy to address the risk and that’s legitimate and appropriate, just like we do for human rights impact assessment. We consider the risk to human rights. But the urgency of this issue and the effectiveness of whatever policy we produce should not be inflated based on data whose methodology we cannot fully audit, and sometimes not produced by neutral parties and without validation of definitions etc. We need to be proportionate and rigorous, so that we don’t come up with a policy that causes overreach, could impact people’s access to domains and increase political and legal risk.
Auerbach is making some interesting comments about the report which I have pasted here:
From where I sit claims of "malicious" and "abuse" are often mere whining about acts that are neither actually malicious nor actually abusive.
What I am suggesting is that when writing about domain names (or in this case, about the mere registration of a name) as being malicious or abusive that those terms not only ought to be clearly defined, but that those definitions be front and center on any report about such domains.
The Interisle report says this (on page 35):
*How does Interisle determine if a domain has been “maliciously registered?”*
*We consider domains blocklisted within 90 days of registration to be malicious.*
I note that Interisle seems to distinguish between malicious *registration* and malicious *use*. There us a vast gap there - the same as the difference between a) buying a glass cutter and b) using that glass cutter in a crime (such as cutting through a window pane in order to commit a burglary.)
In other words in the minds of Interisle, a domain that somebody puts onto some block lists within three months is adjudged, usually without further inquiry, as "malicious".
Or to put it another way around, what is "malicious" depends on the opinions of some unknown block listing agencies.
That is not not a definition. Rather it is an invitation to vigilante and inconsistent behaviour.
A true definition would dig into real actions that have been actually performed through the use of an accused domain name.
Perhaps the Interisle definition could be useful as a sieve to identify registrations that deserve deeper inquiry.
But saying that a domain name is malicious simply on the basis of block list entries is a process based on third party rumor (in law we would call that "hearsay", a thing that is usually excluded by our rules of evidence) rather than on a presentation of relevant, directly obtained, supporting facts.
Farzaneh
On Wed, Jun 3, 2026 at 1:52 AM Nitin Walia via Gnso-dnsabuse-pdp < gnso-dnsabuse-pdp@icann.org> wrote:
ICANN Published Two Years of Enforcing DNS Abuse Mitigation Requirements: Progress & Next Steps
https://www.icann.org/en/blogs/details/two-years-of-enforcing-dns-abuse-miti... <https://urldefense.com/v3/__https:/www.icann.org/en/blogs/details/two-years-...>
Warm Regards
* Nitin Walia*
Director Data Ingenious Global nitin@data.in | नितिन@डाटा.भारत www.data.in
<https://urldefense.com/v3/__http:/www.data.in__;!!DUT_TFPxUQ!CHFepM5qOjRdd6U...> -------------------------------------------------------------- The content of this email is confidential and intended only for the recipient specified. If you received this message in error, please delete it and inform the sender. ------------------------------
*From:* David Hughes via Gnso-dnsabuse-pdp <gnso-dnsabuse-pdp@icann.org> MailId : [154969301] *To:* trachtenbergm@gtlaw.com,gnso-dnsabuse-pdp@icann.org *Subject: *[Gnso-dnsabuse-pdp] Re: New Interisle Study *Date:* 03 Jun 2026 06:24:57 AM
thank you Marc,
You beat me to the punch.
Very useful study, none of it surprising.
but Shockingly high levels of abuse levels at some registrars.
(if I read it correctly, one has 80% plus abuse?, please correct me if i am reading it wrong).
*From: *trachtenbergm--- via Gnso-dnsabuse-pdp < gnso-dnsabuse-pdp@icann.org> *Date: *Tuesday, June 2, 2026 at 9:58 AM *To: *gnso-dnsabuse-pdp@icann.org <gnso-dnsabuse-pdp@icann.org> *Subject: *[Gnso-dnsabuse-pdp] New Interisle Study
FYI fellow members of the DNS Abuse PDP Part 1,
The new Interisle study is out and underscores the importance of this PDP getting it right and resulting in something that is meaningful, including in particular, having measurable and enforceable obligations (see https://interisle.net/insights/cybercriminaldomaindemand <https://urldefense.com/v3/__https:/interisle.net/insights/cybercriminaldomai...> ).
The report indicates that * 10% to 20% of domains are registered for bad purposes, but it might be even higher. *The report further indicated that 10% of gTLD domains registered in 2025 have been added to blocklists,* and almost all of these were registered for malicious purposes rather than being compromised. *As an aside, WhoisXML API analyzes 8-10 million new registrations every month and generally estimates that about a quarter of them are registered for malicious purposes <https://urldefense.com/v3/__https:/main.whoisxmlapi.com/blog/april-2026-doma...> ).
Notably for this PDP, the report also addresses Associated Domains - see in particular pg 17:
A recent study about associated domains was performed by the research team in ICANN’s Office of the CTO (OCTO). This study found that “at least 16% of newly registered gTLD domains, [created] in the first quarter of 2025, exhibited batch registration patterns.” Starting with an initial set of “seed” RBL- listed domains, the researchers found an additional 80% more domains that were associated with the blocklisted ones. This “indicates that for every three newly registered malicious domains reported through RBL feeds, batch expansion (using conservative filtering) identifies an additional two neighboring domains.” The researchers stated that “the true rate is likely to be higher” since they excluded ”many valid batches” such as those containing more than 1,000 domains. The results “indicate that batch registrations are prevalent, significantly predict overall abuse rates, and are useful for pivoting and expanding from known malicious ‘seed’ domain sets, particularly in certain TLDs and registrar environments.”
Best regards,
*Marc H. Trachtenberg* Shareholder
Chair, Internet, Domain Name, e-Commerce and Social Media Practice Greenberg Traurig, LLP
*Aspen Chicago*
411 E. Main Street <https://urldefense.com/v3/__https:/www.google.com/maps/search/411*E.*Main*St...> 360 North Green Street
Suite 207 | Aspen, CO 81611 Suite 1300 | Chicago, IL 60607
T +1.970.300.5313 T +1.312.456.1020
M +1.773.677.3305 M +1.773.677.3305 trac@gtlaw.com <trachtenbergm@gtlaw.com> | www.gtlaw.com | View GT Biography <https://www.gtlaw.com/en/professionals/t/trachtenberg-marc-h>
------------------------------
If you are not an intended recipient of confidential and privileged information in this email, please delete it, notify us immediately at postmaster@gtlaw.com, and do not use or disseminate the information.
_______________________________________________ Gnso-dnsabuse-pdp mailing list -- gnso-dnsabuse-pdp@icann.org To unsubscribe send an email to gnso-dnsabuse-pdp-leave@icann.org
Do not Remove: [HID]20260603062457190[-HID]
[XGENFOOTER]
[-XGENFOOTER]
_______________________________________________ Gnso-dnsabuse-pdp mailing list -- gnso-dnsabuse-pdp@icann.org To unsubscribe send an email to gnso-dnsabuse-pdp-leave@icann.org
_______________________________________________ Gnso-dnsabuse-pdp mailing list -- gnso-dnsabuse-pdp@icann.org To unsubscribe send an email to gnso-dnsabuse-pdp-leave@icann.org
-- John Gbadamosi Programme Officer, Digital Rights Media Rights Agenda Internet of Rights (IoR) Fellow Article 19, UK +2348099817296 john@mediarightsagenda.org @Samjohn70
participants (8)
-
Ching Chiao -
Chris Disspain -
David Hughes -
Eberhard W Lisse -
farzaneh badii -
John Gbadamosi -
Nitin Walia -
trachtenbergm＠gtlaw.com