April 2023 - gnso-dnsabuse-smallteam

Our efforts keep bearing fruir: INFERMAL
by Mark W. Datysgeld April 26, 2023

April 26, 2023

Team, ICANN has just announced a project called Inferential Analysis of Maliciously Registered Domains (INFERMAL), which reads like a direct answer to our request for better stewardship over maliciously registered domains. https://www.icann.org/en/blogs/details/new-icann-project-explores-the-drive… I would like to again congratulate you all on the hard work, and I hope that we can keep changing the Internet for the better. Best, --- Mark W. Datysgeld Director at Governance Primer ICANN GNSO Councilor

3 2

Action items DNS Abuse Small Team meeting
by Marika Konings April 25, 2023

April 25, 2023

Dear All, Hereby the action items from yesterday’s DNS Abuse Small team meeting: 1. Small team to review bulk registration findings write up by Friday 5 May at the latest (see https://docs.google.com/document/d/1tqnLwSa8sTb0Hqt_MmMY-FYPaNKad_b1/edit) Please provide any input or suggestions you may have in the form of comments. 2. Sebastien and Theo to develop rationale for why not to further pursue the topic of bulk registrations and add to the write up by Friday 5 May. For those interested in reviewing the recording and/or sharing it with others who may be interested, it can be found here: https://icann.zoom.us/rec/play/GX01sI6taaMp81VFsxAHCjlOubc8LOkyBr0VYvK6B_7P…. The next meeting has been scheduled for Monday 8 May at 19.00 UTC. Best regards, Steve & Marika

1 0

Meeting Invite | Council Small Team - Next steps regarding DNS Abuse | Monday, 08 May 2023 at 19:00 UTC
by Devan Reed April 24, 2023

April 24, 2023

Dear all, The GNSO Council’s Small Team meeting on Next steps regarding DNS Abuse is scheduled on Monday, 08 May 2023 at 19:00 UTC for 60 minutes. Check your time zone: https://tinyurl.com/uu84f5vf Join Zoom Meeting: https://icann.zoom.us/j/96611661142?pwd=K2VpaHlzNkNuY1J6YzRYcW1sd0VjUT09<https://urldefense.com/v3/__https:/icann.zoom.us/j/96611661142?pwd=K2VpaHlz…> To join via Zoom app: Meeting ID: 966 1166 1142 Passcode: Z4B3SUR!U& For Audio Only: One tap mobile +13126266799,,96611661142#,,,,*0505103780# US (Chicago) +13017158592,,96611661142#,,,,*0505103780# US (Washington DC) Meeting ID: 966 1166 1142 Passcode: 0505103780 Find your local number: https://icann.zoom.us/u/actl7q9Q9B <https://urldefense.com/v3/__https:/icann.zoom.us/u/actl7q9Q9B__;!!PtGJab4!v…> Thank you. Kind regards, Devan

1 0

GNSO Council’s Small Team meeting on Next steps regarding DNS Abuse
by ICANN Policy Calendar April 24, 2023

April 24, 2023

Meeting: GNSO Council’s Small Team meeting on Next steps regarding DNS Abuse Date/time: Monday, 08 May 2023 at 19:00 UTC for 60 minutes Check your time zone: https://tinyurl.com/uu84f5vf Join Zoom Meeting: https://icann.zoom.us/j/96611661142?pwd=K2VpaHlzNkNuY1J6YzRYcW1sd0VjUT09<https://urldefense.com/v3/__https:/icann.zoom.us/j/96611661142?pwd=K2VpaHlz…> To join via Zoom app: Meeting ID: 966 1166 1142 Passcode: Z4B3SUR!U& For Audio Only: One tap mobile +13126266799,,96611661142#,,,,*0505103780# US (Chicago) +13017158592,,96611661142#,,,,*0505103780# US (Washington DC) Meeting ID: 966 1166 1142 Passcode: 0505103780 Find your local number: https://icann.zoom.us/u/actl7q9Q9B <https://urldefense.com/v3/__https:/icann.zoom.us/u/actl7q9Q9B__;!!PtGJab4!v…>

1 0

Post Call | Next Steps regarding DNS Abuse Small Team | Monday, 24 April 2023
by Devan Reed April 24, 2023

April 24, 2023

Dear all, Please find the zoom recording at the small team wiki page, linked below, for the Next Steps regarding DNS Abuse call held on Monday, 24 April 2023 at 19:00 UTC. Small Team Wiki: https://community.icann.org/x/aQKjDQ Thank you! Kind Regards, Devan

1 0

15 MINUTE REMINDER | Meeting Invite | Council Small Team - Next steps regarding DNS Abuse | Monday, 24 April 2023 at 19:00 UTC
by Devan Reed April 24, 2023

April 24, 2023

Dear all, The GNSO Council’s Small Team meeting on Next steps regarding DNS Abuse is scheduled on Monday, 24 April 2023 at 19:00 UTC for 60 minutes. Check your time zone: https://tinyurl.com/4efjktf4 <https://urldefense.com/v3/__https:/tinyurl.com/4efjktf4__;!!PtGJab4!97daLbu…> Join Zoom Meeting: https://icann.zoom.us/j/96611661142?pwd=K2VpaHlzNkNuY1J6YzRYcW1sd0VjUT09<https://urldefense.com/v3/__https:/icann.zoom.us/j/96611661142?pwd=K2VpaHlz…> To join via Zoom app: Meeting ID: 966 1166 1142 Passcode: Z4B3SUR!U& For Audio Only: One tap mobile +13126266799,,96611661142#,,,,*0505103780# US (Chicago) +13017158592,,96611661142#,,,,*0505103780# US (Washington DC) Meeting ID: 966 1166 1142 Passcode: 0505103780 Find your local number: https://icann.zoom.us/u/actl7q9Q9B <https://urldefense.com/v3/__https:/icann.zoom.us/u/actl7q9Q9B__;!!PtGJab4!v…> Thank you. Kind regards, Devan

2 1

ON NOW | Meeting Invite | Council Small Team - Next steps regarding DNS Abuse | Monday, 24 April 2023 at 19:00 UTC
by Devan Reed April 24, 2023

April 24, 2023

Dear all, The GNSO Council’s Small Team meeting on Next steps regarding DNS Abuse is scheduled on Monday, 24 April 2023 at 19:00 UTC for 60 minutes. Check your time zone: https://tinyurl.com/4efjktf4 <https://urldefense.com/v3/__https:/tinyurl.com/4efjktf4__;!!PtGJab4!97daLbu…> Join Zoom Meeting: https://icann.zoom.us/j/96611661142?pwd=K2VpaHlzNkNuY1J6YzRYcW1sd0VjUT09<https://urldefense.com/v3/__https:/icann.zoom.us/j/96611661142?pwd=K2VpaHlz…> To join via Zoom app: Meeting ID: 966 1166 1142 Passcode: Z4B3SUR!U& For Audio Only: One tap mobile +13126266799,,96611661142#,,,,*0505103780# US (Chicago) +13017158592,,96611661142#,,,,*0505103780# US (Washington DC) Meeting ID: 966 1166 1142 Passcode: 0505103780 Find your local number: https://icann.zoom.us/u/actl7q9Q9B <https://urldefense.com/v3/__https:/icann.zoom.us/u/actl7q9Q9B__;!!PtGJab4!v…> Thank you. Kind regards, Devan

1 0

Proposed Agenda - DNS Abuse Small Team meeting on Monday 24 April at 19.00 UTC
by Marika Konings April 23, 2023

April 23, 2023

Dear All, Hereby the proposed agenda for Monday’s DNS Abuse Small Team meeting. As a reminder, please review the bulk registration write up and provide any comments and/or proposed edits you may have in the form of comments in advance of the meeting: https://docs.google.com/document/d/1tqnLwSa8sTb0Hqt_MmMY-FYPaNKad_b1/edit. Have a good weekend, Steve & Marika Proposed Agenda – DNS Abuse Small Team Meeting Monday 24 April at 19.00 UTC 1. Welcome 2. Small team review of bulk registration findings write up - https://docs.google.com/document/d/1tqnLwSa8sTb0Hqt_MmMY-FYPaNKad_b1/edit 3. DNS Abuse mitigation demo by Theo Geurts 4. Confirm next steps & next meeting

4 3

**REMINDER** Meeting Invite | Council Small Team - Next steps regarding DNS Abuse | Monday, 24 April 2023 at 19:00 UTC
by Julie Bisland April 21, 2023

April 21, 2023

Dear all, The GNSO Council’s Small Team meeting on Next steps regarding DNS Abuse is scheduled on Monday, 24 April 2023 at 19:00 UTC for 60 minutes. Check your time zone: https://tinyurl.com/4efjktf4 [tinyurl.com]<https://urldefense.com/v3/__https:/tinyurl.com/4efjktf4__;!!PtGJab4!97daLbu…> Join Zoom Meeting: https://icann.zoom.us/j/96611661142?pwd=K2VpaHlzNkNuY1J6YzRYcW1sd0VjUT09<https://urldefense.com/v3/__https:/icann.zoom.us/j/96611661142?pwd=K2VpaHlz…> To join via Zoom app: Meeting ID: 966 1166 1142 Passcode: Z4B3SUR!U& For Audio Only: One tap mobile +13126266799,,96611661142#,,,,*0505103780# US (Chicago) +13017158592,,96611661142#,,,,*0505103780# US (Washington DC) Meeting ID: 966 1166 1142 Passcode: 0505103780 Find your local number: https://icann.zoom.us/u/actl7q9Q9B <https://urldefense.com/v3/__https:/icann.zoom.us/u/actl7q9Q9B__;!!PtGJab4!v…> Thank you. Kind regards, Devan

1 0

Bulk registrations and the struggle.
by Theo Geurts April 18, 2023

April 18, 2023

Hi all, As mentioned on the call, an outline of a registrar who tried to fix the issue of malicious bulk registrations at somewhat the back of the process rather than in the front. Again, most bulk registrations are legit; a small percentage turns malicious/criminal and is usually expensive for registrars and resellers. Good KYC controls, and more are vital in combatting such criminals. The registrar got hit earlier this year with 1000 domain name registrations from a registrant whose country code was from Thailand. So the registrar blocked the country code and registrants who used the country code from Thailand could no longer register domain names. So the criminals started to switch to other countries. Long story short, the registrar started to block almost all country codes. So the criminals now only use country codes from the EU. Then the registrar started to use limits. New registrants could only register up to 100 domain names each day. Later that limit got set to 10, and a few weeks later, the limit became 1. The criminals started to create new accounts in bulk. They registered one domain name per account and used unique data for each account. Detection became much more complicated. At some point, the criminals became aware that established accounts of existing customers had no limits. So they started to hack into those accounts, and the registrar was back to square one. Hacking into those accounts is relatively easy. The dark web contains many combo lists with millions of records of people, including passwords, which usually still works. Most of the combo lists are free to download. In summary, the registrar lost around 300.000$ in registrations. The dissatisfaction of new and current customers was significant, and the registrar lost a good chunk of business. The lesson here is that you need to invest in anti-fraud controls if you want legit registrations in bulk or not. Utilize the info from a payment provider; https://docs.adyen.com/risk-management Block unwanted traffic https://www.blocked.com/; it's inexpensive and can be easily integrated into an account sign-up form. Do we want to codify this into policy? Cybercrime is a moving target, and you must constantly deploy new solutions. https://www.theguardian.com/technology/2023/apr/05/international-sting-take… Stolen identities gained more traction over the last 12 months and are pretty hard to detect. Best, Theo

2 2