<html><body>A good report - thanks to Olivier. I will certainly be attending the webinar<br /><br />Holly <br /><br /><blockquote><br />----- Original Message -----<br /><div style="width:100%;background:rgb(228,228,228);"><div style="font-weight:bold;">From:</div> "Alan Greenberg" <alan.greenberg@mcgill.ca></div><br /><div style="font-weight:bold;">To:</div>"ALAC" <alac@atlarge-lists.icann.org><br /><div style="font-weight:bold;">Cc:</div><br /><div style="font-weight:bold;">Sent:</div>Wed, 6 Sep 2017 00:27:59 -0400<br /><div style="font-weight:bold;">Subject:</div>[ALAC] Fwd: Re: SADAG Public Comment<br /><br /><br />
I asked Olivier to look at whether we needed to comment on a recent study
on DNS abuse (commissioned by the CCT-RT). His report followed and is an
excellent example of what we should be doing to evaluate whether ALAC
action is required. See
<a href="https://community.icann.org/x/bRUhB">
https://community.icann.org/x/bRUhB</a>.<br /><br />
In this case, Olivier is recommending no comment, a recommendation I
support.<br /><br />
Alan<br /><br /><br /><blockquote class="cite" cite="">Subject: Re: SADAG Public
Comment<br />
To: Ariel Liang <ariel.liang@icann.org>, Alan Greenberg
<alan.greenberg@mcgill.ca><br />
CC: 'At Large Staff' <Staff@atlarge.icann.org><br />
From: Olivier MJ Crépin-Leblond <ocl@gih.com><br />
Date: Wed, 6 Sep 2017 03:07:33 +0200<br /><br /><br />
Dear Ariel,<br />
Dear Alan,<br /><br />
thanks for your follow-up. I have read the SADAG report and have found it
very interesting.<br /><br />
First thing, I was surprised to see that .pharmacy was seen as community
TLD. (p.2) but then that's not the topic of the report. There are a few
other grammatical errors, but that's no big deal either. What matters is
the substance of the paper. <br /><br />
It basically confirms our suspicions when we spoke of misuse of TLDs and
made our case regarding sensitive strings. Alan will remember this
episode in Singapore when Alan, Evan and I had a meeting with the NGPC
and several members of the GNSO - including contracted parties. What we
are seeing now is the proof of the pudding - that:<br /><br />
"While legacy gTLDs collectively<br />
had a spam-domains-per-10,000 rate of 56.9, in the last quarter of<br />
2016, the new gTLDs experienced a rate of 526.6–which is almostt<br />
one order of magnitude higher. "<br /><br />
The methodology and technical details of the analysis are of good
quality. The model which they used to perform the crawl of the domain
name space appears to be thorough, thus I have no reason to believe that
the analysis would be flawed.<br /><br />
Some of the report's findings show that some new gTLDs are very affected
by misuse/malware domains.<br />
Gibraltar (surprise!) figures on the top of Registrars with most malware
domains.<br />
Community gTLDs are less likely to be used for malware that standard
gTLDs.<br />
Cheaper domains appear to be more used for malware - although the authors
do writein their conclusions: "It is not clear, however, if
pricing is the only factor driving high concentra-<br />
tions of maliciously registered domains."<br /><br />
But they do also say:<br /><br />
"Our findings suggest that some new gTLDs have become<br />
a growing target for malicious actors." (page 25)<br /><br />
Well, nothing really new in this, but it corroborates the work that ICANN
has done, as well as many other groups like the APWG.<br /><br />
But at present, short of congratulating the authors of the report and
asking the CCT-RT to take strong note of the report's finding, including
expressing the concern that we have about the use of new gTLD for
malware, I don't see any other reason to write a Statement/Comment.<br />
I asked Tatiana Tropina to also go through the report. She did note that
one thing was missing: whether abuse correlates with semantic properties
of the gTLD names, e.g. some names are more attractive to abuse because
of the words themselves. As the authors are explaining that they are
seeing some potential for further work, it might be interesting to
suggest this to them.<br /><br />
Last, I note that there is a Webinar about the topic:
<a href="https://www.icann.org/news/announcement-2017-08-31-en">
https://www.icann.org/news/announcement-2017-08-31-en</a><br />
I would encourage At-Large participants to participate in the Webinar
Perhaps during that Webinar should many At-Large participants express
their concerns.<br /><br />
Kindest regards,<br /><br />
Olivier<br /><br /><br />
On 01/09/2017 22:10, Ariel Liang wrote:<br /><blockquote class="cite" cite="">Hello Olivier, <br />
<br />
Any update on this public comment?
<a href="https://community.icann.org/x/bRUhB">
https://community.icann.org/x/bRUhB</a> <br />
<br />
Saw this action item has been checked but just want to reconfirm whether
a statement will be needed or not. <br />
<br />
Thank you,<br />
Ariel </blockquote>
</blockquote>
</blockquote></body></html>