Comments (8)

1. Sean says:

   November 25, 2013 at 7:06 pm

   Is Architelos the only company providing this kind of tool? I need something like this for my TLD, but it would be nice to see some other options.

   Reply
   • Kevin Murphy says:

     November 25, 2013 at 7:58 pm

     I’m not aware of anyone else doing the workflow stuff, but DI PRO has TLD Health Check if it’s metrics you’re looking for.

     Reply
   • Rubens Kuhl says:

     November 25, 2013 at 9:19 pm

     Artemis / NCC Group Safe TLD service seems to be targeted to the new RA specs as well, but I couldn’t find something online about it.

     Netcraft and Team Cymru also have commercial offerings that combined can fulfill the requirements, but combining can also be done on cheaper or free alternatives to build a DIY solution.

     Reply
2. Alexa Raad says:

   November 26, 2013 at 1:24 am

   Rubens et al.
   Netcraft is a great service and you can find more info on their anti-phishing service here http://www.netcraft.com/anti-phishing/

   To be clear, NameSentry is different as it encompasses a wider range of abuse types (not just phishing, but also malware, botnets and even spam).
   The NameSentry portal option includes automated mitigation workflows which can be customized to the abuse policies and procedures of any given gTLD or ccTLD. Lastly, our prices are posted on our website, as are the terms. A TLD can even choose a month to month option (so no long term contract or financial commitment).
   So to compare – a DIY option would involve not only buying various datafeeds, (or standalone monitoring and analysis services for say phishing) for different abuse types, but also aggregating and normalizing the info, and then either doing notification and mitigation steps manually (so personnel in ops/customer service, or abuse analysts) or building and maintaining the system to automate mitigation steps and then document and archive an audit record. In terms of core competencies (and putting the issue of upfront and continued commitment of capital and HR resources aside) not every registry or registrar has the core competency to do this, and do it well enough to stake their contractual compliance on it.

   So it is a question of what do you want to focus on and what should be outsourced.
   Hope that helps

   Reply
   • Rubens Kuhl says:

     November 26, 2013 at 9:49 am

     RA specs on this do not require specific accuracy levels, so contractual compliance is not that much of a risk in this regard. I can see reasons for either DIY or outsourcing considering the whole picture, including end-user perception and corporate social responsibility, but they are all carrots. No actual sticks here.

     Reply
3. Sean says:

   November 26, 2013 at 3:07 pm

   Thanks for this info. I’m running a single registrant, closed TLD and not expecting too many domains, so I just need whatever is considered compliant.

   Reply
   • Rubens Kuhl says:

     November 26, 2013 at 5:21 pm

     http://www.selectrealsecurity.com/public-block-lists and http://www.surbl.org/lists have lists of lists and getting thru those would already qualify as going thru reported threats. It needs to go somewhat beyond what is reported directly to the registry, but there is no actual service level or accuracy target on the agreement, so you don’t need to know all threats or try knowing an specified % of those.

     The text in the agreement is very non-specific as can be seen below.

     Reply
4. Alexa Raad says:

   November 26, 2013 at 3:27 pm

   FYI

   I have copied the specific Spec in the Registry Agreement below.

   Specification 11 3.b:. “Registry Operator will periodically conduct a technical analysis to assess whether domains in the TLD are being used to perpetrate security threats, such as pharming, phishing, malware, and botnets. Registry Operator will maintain statistical reports on the number of security threats identified and the actions taken as a result of the periodic security checks. Registry Operator will maintain these reports for the term of the Agreement unless a shorter period is required by law or approved by ICANN, and will provide them to ICANN upon request.”

   Reply