Hi folks, Paul Vixie and Pawel Foremski of Farsight Security published a study recently: https://www.farsightsecurity.com/assets/media/download/VB2018-study.pdf looking at domain lifetimes for abusive domains, and how abusive domains are **already** being taken down within minutes, hours or just a few days (much faster than the URS). Their conclusions: "We presented a systematic study of the lifetime of newly observed domain names. We found that, on average, 9.3% of new domains effectively died in their first seven days, with a median time of just four hours and 16 minutes." This research reinforces URS proposal #32 (elimination of the URS) being presented later today, as the marginal benefits over and above the existing procedures (like section 3.18 of the 2013 RAA, complaints to ISPs, blocking mechanisms such as Google's safebrowsing and anti-spam blacklists) are small. And, consistent with my own thoughts, they point to better policy alternatives to focus upon, such as delaying the resolution of newly-registered domains for some time (rather than allowing them to go live immediately): "Thus, a sensible DNS policy should block access to new domains for a few hours after detection, a few days, or even a week for maximum protection." Sincerely, George Kirikos 416-588-0269 http://www.leap.com/