PIR to offer industry FREE domain abuse clearinghouse

The DNS Abuse Institute will soon launch a free service designed to make it easier to report abuse and for registries and registrars to act upon it.

The Institute, which is funded by .org manager Public Interest Registry, is working on a system provisionally called CART, for Centralized Abuse Reporting Tool, an ambitious project that would act as a clearinghouse for abuse reports across the industry.

The plan is to offer the service for free to reporters and registrars alike, with a beta being offered to registrars late next month and a public launch hopefully before ICANN 74 in June.

DNSAI director Graeme Bunton said that CART is meant to solve the “mess” of current abuse reporting systems.

For abuse reporters, the idea is to give them a one-stop shop for their reports, across all gTLDs and registrars. CART would take their complaints, normalize them, furnish them with additional information from sources such as Whois records and domain block-lists, and shunt them off to the registrar of record.

“Registrars get boatloads of abuse reports every day,” Bunton said. “Hundreds to thousands. They’re often duplicative, often unevidenced — almost always. There’s no standardization. So they’re having to spend a lot of time reading and parsing these abuse reports.”

“They’re spending a huge amount of time triaging tickets that don’t make the internet any better,” he said. “It felt like trying to solve this problem across every individual registry and registrar was not going to work, and that a centralizing function that sits in the middle and absorbs a lot of the complexity would make a real difference, and we’ve been working towards that.”

CART reporters would be authenticated, and their reports would be filed through forms that normalized the data to make them easier for registrars to understand. There will be “evidence requirements” to submit a report.

“It’s a common lament that the abuse@ email that registrars have to publish are filled with garbage,” Bunton said. “This is intended to clean that up, as well as make it easier for reporters.”

Registrars will be able to white-label these forms on their own sites, replacing or adding to existing reporting mechanisms, which will hopefully drive adoption of the tool, Bunton said.

Registrars will be able to use an API to pull the abuse feed into their existing ticketing workflows, or simply receive the reports via email.

The plan is to send these enhanced reports to registrars’ publicly listed abuse@ addresses, whether they opt into the CART system or not, Bunton said.

One feature idea — possibly in a version 2 release — is to have a reputation-scoring function in which registrars can flag reporters as reliable, facilitating on-the-fly “trusted notifier” relationships.

While the DNSAI is focusing to the industry definition of “DNS abuse” — phishing, pharming, malware, botnets and a subset of spam — the plan is to not limit reporters to just those categories.

Copyright infringement claims, for example, would be acceptable forms of abuse report, if the registrar enables that option when they embed the CART forms on their own sites.

CART will most likely be renamed to something with “better mass-market appeal” before it launches, Bunton said, but there will be no charge to reporters or registrars.

“This is all free, with no plans to do cost-recovery or anything like that,” he said.

While Bunton didn’t want to comment, I think it’s unlikely that these projects would be going ahead, at least not for free, had PIR been turned into a for-profit company under its proposed acquisition by Ethos Capital, which was blocked by ICANN a couple of years ago.

A second project DNSAI is working on is called Intelligence.

This will be somewhat similar to ICANN’s own Domain Abuse Activity Reporting (DAAR) system, but with greater granularity, such as giving the ability to see abuse trends by registry or registrar.

The current plan is to have a preview of Intelligence available in June, with a launch in July.

Turkish registrar on the naughty step over abuse

ICANN has issued a public contract breach notice to a Turkish registrar over claims it’s not adequately responding to abuse reports.

Atak Teknoloji showed a “failure to take reasonable and prompt steps to investigate and respond appropriately to reports of abuse” and did not provide ICANN with evidence it responds to abuse reports, ICANN said.

These are violations of the Registrar Accreditation Agreement, the breach notice says.

The registrar is also not offering a port 43 Whois service as required by the RAA, ICANN claims.

Atak isn’t small. It has about 175,000 domains under management in gTLDs, according to registry reports.

It has until February 18 to come into compliance or risk suspension, and has already supplied ICANN with documentation that is now under review.

Most registrars did NOT “fail” abuse audit, ICANN says

Most registrars did not “fail” a recent abuse audit, despite what I wrote in my original coverage, according to ICANN.

“Referring to a certain blog, none of the registrars failed the audit,” ICANN senior audit manager Yan Agranonik said during a session of ICANN 72’s Prep Week last night.

He’s talking about ME! He’s talking about ME!

“Failure would mean that there’s an irreparable finding of deficiency that can not be corrected timely or it just goes against the registrar’s business model,” Agranonik said.

An accompanying presentation reads:

None of the registrars “failed” the audit. “Failure” means that the auditee did not acknowledge/remediate identified violations of the RAA or their business practices are not compatible with RAA.

At the risk of prolonging a tedious semantic debate, what I reported in August, when the results of the audit were announced, was: “The large majority of accredited registrars failed an abuse-related audit at the first pass, according to ICANN.”

A bunch of registrar employees, and now apparently ICANN’s own head auditor, disagreed with my characterization.

ICANN had issued a press release stating that of 126 audited registrars, it had identified 111 “that were not fully compliant with the RAA’s requirements related to the receiving and handling of DNS abuse reports.”

To me, if ICANN checks whether you’re doing a thing you should be doing and you’re not doing the thing, that’s a fail.

But to ICANN, if ICANN checks whether you’re doing a thing you should be doing and you’re not doing the thing, and it tells you you’re not doing the thing you should be doing, so you start doing the thing, that’s not a fail.

I think reasonable people could disagree on the definitions here.

But I did write that the registrars “failed… according to ICANN”, and that appears to be inaccurate, so I’m happy to correct the record today.

10 Years Ago… new gTLDs, ICANN pay, DNS abuse and ethics

The more things change, the more they stay the same.

I’ve been in a reflective mood recently, and it’s a slow news day, so I thought now might be a good time to launch a new, irregular feature — a trawl back through the DI archives to see what we were all talking about a decade ago this month.

In many respects, the conversations haven’t changed all that much in the last 10 years. Some are being repeated almost verbatim today. Others seem almost laughably naive with hindsight.

New TLDs

We were just a few months away from the opening of the first big new gTLD application window, but in October 2011 many of the rules of the program were, remarkably, still up in the air.

ICANN still hadn’t decided how much an application would cost. It had yet to decide how it would subsidize poorer applicants.

No Trademark Clearinghouse supplier had yet been found, and there was still some confusion about how the application process would work, and how it would be communicated to potential applicants.

The industry was awash with speculation, as it had been for the whole year, about who might apply for a gTLD. In October, there were stories about potential applications from New South Wales, Orange, Corsica, and BITS.

Afilias was offering $5,000 for new gTLD ideas.

But perhaps the strangest idea was a pitch from CentralNic to the super-rich. For $500,000, it would apply for your family name as a new gTLD. This came to nothing in the 2012 round, but CentralNic’s site is still live.

While new gTLDs were still in the future, October 2011 saw the ongoing sunrise period for the previous round’s .xxx, auctions following the recent launch of .co, and the creation of two new ccTLDs.

Abuse

October 2011 was marked by the registrar community reluctantly agreeing to enter talks with ICANN to renegotiate their standard Registrar Accreditation Agreement, which would ultimately lead to the current 2013 RAA.

The move came as the Governmental Advisory Committee was on the warpath on behalf of its law enforcement allies, demanding more action from the industry on DNS abuse and threatening legislation if it didn’t happen.

Imagine that.

Meanwhile, Verisign asked ICANN for more powers to take down abusive domains, which faced immediate pushback from registrars and others, before the request was retracted mere days later.

The Revolving Door

There was a lot of talk during and around ICANN 42 about conflicts of interest, particular with regards the emergence of a so-called “revolving door” between ICANN’s top brass and the domain industry.

It had been just a few months since chair Peter Dengate Thrush had, on the eve of his retirement from the board, pushed through final approval of the new gTLD program and promptly took a top job at portfolio applicant Minds + Machines.

It looked rotten, and ICANN CEO Rod Beckstrom, who had himself announced he was quitting just months earlier, had made its his personal mission to reduce at least the perception of conflicts of interest at the Org.

He ruled out being replaced by a fellow director, threw money at consultants, and said the next CEO should be an industry outsider.

It was probably all pointless.

As it turned out, the guy who replaced Beckstrom, Fadi Chehade, put in a few years in the corner office before prematurely quitting for private equity, where he now runs the company that owns Donuts, itself run by Chehade’s ICANN number two, Akram Atallah.

The amount of revolving door action at less-senior levels has been so frequent since 2011 that I don’t even keep track of it any more.

ICANN Pay

ICANN gave its top execs big pay raises. Along with death and taxes, this is a universal constant.

Most registrars fail ICANN abuse audit

The large majority of accredited registrars failed an abuse-related audit at the first pass, according to ICANN.

(UPDATE October 14, 2021: ICANN disagrees with this characterization.)

The audit of 126 registrars, representing over 90% of all registered gTLD domains, founds that 111 were “not fully compliant with the [Registrar Accreditation Agreement’s] requirements related to the receiving and handling of DNS abuse reports”.

Only 15 companies passed with flying colors, ICANN said.

A further 92 have already put in place changes to address the identified concerns, with 19 more still struggling to come into compliance.

The particular parts of the RAA being audited require registrars to publish an abuse email address that it monitored 24/7 and to take action on well-founded cases of abuse within 24 hours of notification.

The results of the audit, carried out by ICANN Compliance and KPMG, can be found here (pdf).

Registrars to get more domain takedown powers

ICANN will soon grant its accredited registrars the ability to unilaterally take down domains involved in ongoing security incidents, according to chair Maarten Botterman.

Responding to the news that registries have come up with a voluntary framework for tackling botnets that auto-generate domain registrations for use in command and control activities, Botterman said ICANN will extend a process currently restricted to registries into the registrar community.

That policy is the Expedited Registry Security Request Process, which allows registries to quickly obtain a retroactive waiver of its contractual obligations — such as the obligation to pay ICANN fees — if it has to urgently respond to a major incident.

The process was invoked four times last year, covering six gTLDs and roughly 1,600 domains. ICANN granted all four requests, though it seems to have on average missed its target of responding within three business days.

“As part of ICANN’s efforts to support the mitigation of DNS security threats, ICANN org will soon enable registrars to also request such waivers,” Botterman recently told the Registries Stakeholder Group.

He was responding to the news that several registries have signed up to a voluntary “Framework on Domain Generating Algorithms (DGAs) Associated with Malware and Botnets”.

That framework would allow registries to preemptively register or block domains likely to be auto-generated by botnet code, thereby cutting the head off the snake before it can wreak more havoc.

.com and NameSilo fingered as “most-abused” after numbers rocket

SpamHaus has revealed the most-abused TLDs and registrars in its second-quarter report on botnets.

The data shows huge growth in abuse at Verisign’s .com and the fast-growing NameSilo, which overtook Namecheap to top the registrar list for the first time.

Botnet command-and-control domains using .com grew by 166%, from 1,549 to 4,113, during the quarter, SpamHaus said.

At number two, .xyz saw 739 C&C domains, up 114%.

In the registrar league table, NameSilo topped the list for the first time, unseating Namecheap for the first time in years.

NameSilo had 1,797 C&C domains on its books, an “enormous” 594% increase. Namecheap’s number was 955 domains, up 52%.

Botnets are one type of “DNS abuse” that even registrars agree should be acted on at the registrar level.

The most-abused lists and lots of other botnet-related data can be found here.

Will you use SSAD for Whois queries?

ICANN is pinging the community for feedback on proposed Whois reforms that would change how people request access to private registrant data.

The fundamental question is: given everything you know about the proposed System for Standardized Access and Disclosure (SSAD), how likely are you to actually use it?

The SSAD idea was dreamed up by a community working group as the key component of ICANN’s response to privacy laws such as GDPR, and was then approved by the Generic Names Supporting Organization.

But it’s been criticized for not going far enough to grant Whois access to the likes of trademark lawyers, law enforcement and security researchers. Some have called it a glorified ticketing system that will cost far more than the value it provides.

Before the policy is approved by ICANN’s board, it’s going through a new procedure called the ODP, for Operational Design Phase, in which ICANN staff, in coordination with the community, attempt to figure out whether SSAD would be cost-effective, or even implementable.

The questionnaire released today will be an input to the ODP. ICANN says it “will play a critical role in assessing the feasibility and associated risks, costs, and resources required in the potential deployment of SSAD.”

There’s only eight questions, and they mostly relate to the volume of private data requests submitted currently, how often SSAD is expected to be used, and what the barriers to use would be.

ICANN said it’s asking similar questions of registries and registrars directly.

There’s a clear incentive here for the IP and security factions within ICANN to low-ball the amount of usage they reckon SSAD will get, whether that’s their true belief or not, if they want ICANN to strangle the system in its crib.

It’s perhaps noteworthy that the potential user groups the questionnaire identifies do not include domain investors nor the media, both of which have perfectly non-nefarious reasons for wanting greater access to Whois data. This is likely because these communities were not represented on the SSAD working group.

You can find the questionnaire over here. You have until July 22.

153 registrars fingered for ICANN security probe

Registrars will be asked to account for abusive domain names found on their services, under a new ICANN security audit.

ICANN says it will soon send requests for information to 153 registrars, asking them to provide documentation showing how they dealt with domains used for distribution of malware or spam.

Registrars will get audited if more than five domains under their sponsorship showed up on a number of block-lists ICANN uses (SpamHaus and the like) during November 2020.

ICANN is spinning the number of affected registrars as a very small percentage of the accredited base, but it really isn’t.

It said that “only” 153 out of 2,380 accredited registrars are affected, apparently willfully ignoring the fact that well over 1,700 of these registrars are shell accreditations used for drop-catching and belonging to just two companies: Web.com and NameBright.

Domains never stick around at drop-catch shells for long, and abusive registrants typically aren’t buying expensive names on the aftermarket, they’re prowling the budget registrars for sub-dollar bargains and bulk-reg tools.

Up to a couple hundred or other accredited registrars have no or negligible domains under management. Several more are corporate registrars with no retail front-end.

So we’re really looking at “only” 153 out of 500 to 600 active retail registrars that saw the required level of abuse, a much higher percentage than would be ideal.

The audit is part of ICANN’s regular Contractual Compliance Audit Program, which seeks to determine whether any registrars or registries are in breach of their contractual obligations.

Under the 2013 Registrar Accreditation Agreement, registrars are obliged to document their responses to abuse reports, keep the data for two years, and hand it over to ICANN on demand.

ICANN hopes to finish the audit by the third quarter this year.

Israeli registrar denies “arms dealer” claims

Israeli registrar GalComm has denied being involved in a widespread malware distribution scheme after being fingered by a security outfit.

Last month Awake Security accused the registrar, officially Communigal Communication Ltd, of being “at best complicit in malicious activity”.

The firm published a report entitled “The Internet’s New Arms Dealers: Malicious Domain Registrars” which linked GalComm to a network of malicious Chrome browser extensions the firm said can steal sensitive data from users who have them installed.

It identified 111 such plug-ins, which it said have been downloaded 33 million times, using over 15,000 domains registered via GalComm.

GalComm has around 48,000 domains registered in gTLDs at the last count, so that’s a sizable percentage of the registrar’s business.

Awake came to the conclusion that GalComm was well-aware of what its customers were up to.

Now, the registrar has sent a cease-and-desist notice to Awake, CC’d to ICANN (pdf), in which it denies all knowledge and responsibility for the malware.

GalComm’s line, to summarize, is that it’s just a registrar, and that it has no obligation to monitor how its customers use their domains.

It adds that the domains in question amount to 10% of its DUM. Still a pretty big chunk.

The company wants Awake to retract its report by today, which it has not yet done, or it will call in the lawyers.