<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
I think it depends on the type of abuse.<br>
<br>
We've seen cases where domain names registered years ago, zero
activity for years and suddenly being used in some CnC, scattered
over dozens of different resellers who were not affiliated. <br>
<br>
From time to time we run scripts to detect such registrations and
compare them with the results of
<a class="moz-txt-link-freetext" href="https://www.sidn.nl/a/internet-security/identifying-abusive-domain-registrations-in-real-time?language_id=2&langcheck=true">https://www.sidn.nl/a/internet-security/identifying-abusive-domain-registrations-in-real-time?language_id=2&langcheck=true</a>
<br>
<br>
Best, <br>
<br>
Theo Geurts <br>
<br>
<div class="moz-cite-prefix">On 11-10-2017 18:59, Sam Lanfranco
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:379d616c-9911-4f15-9e2a-e1571e5e9311@lanfranco.net">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
Someone correct me if I am wrong here. It is my experience that
much of the abuse from domain names comes from relatively new
registrations. Public access to only the initial date of the
current registration is pretty adequate as part of investigative
due diligence in those cases. <br>
<br>
There are, of course, the flocks of service offers (search engine
offers, web design, etc.) that are prompted by new registrations,
but those are pesky at worse, and privacy/proxy services can ward
those off. <br>
<br>
Retaining a history of the registration of a domain name, when
there is an issue of abuse, fraud, etc., seems to me both a bit
more complicated and messy, and of limited added value for due
diligence. <br>
When it is useful, it likely exists with lots of collateral domain
name data that makes it of marginal additional value for whatever
purpose one might have.<br>
<br>
I lean toward creation date for current registration. Full stop!<br>
<br>
Sam Lanfranco <br>
<br>
<br>
<div class="moz-cite-prefix"><font color="#990000">On 10/11/2017
9:40 AM, Michele Neylon - Blacknight wrote:<br>
</font></div>
<blockquote type="cite"
cite="mid:3A28207B-85DE-4CC5-9B29-8CF5B8FE4644@blacknight.com"><font
color="#990000"> </font>
<meta http-equiv="Content-Type" content="text/html;
charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered
medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
@font-face
{font-family:-webkit-standard;
panose-1:2 11 6 4 2 2 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;}
span.EmailStyle21
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle22
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style>
<div class="WordSection1"><font color="#990000"> </font>
<p class="MsoNormal"><font color="#990000"><span
style="mso-fareast-language:EN-US" lang="EN-GB">From
conversations I’ve had with some of the registries it’s
clear that they do keep *<b>some</b>* data<o:p></o:p></span></font></p>
<font color="#990000"> </font>
<p class="MsoNormal"><font color="#990000"><span
style="mso-fareast-language:EN-US" lang="EN-GB">So
$registry can say “X domains were registered last month
and those strings had never been used previously”<o:p></o:p></span></font></p>
<font color="#990000"> </font>
<p class="MsoNormal"><font color="#990000"><span
style="mso-fareast-language:EN-US" lang="EN-GB">But
that’s minimal data <o:p></o:p></span></font></p>
<font color="#990000"> </font>
<p class="MsoNormal"><font color="#990000"><span
style="mso-fareast-language:EN-US" lang="EN-GB"><o:p> </o:p></span></font></p>
<font color="#990000"> </font>
<div>
<p class="MsoNormal"><font color="#990000">--<o:p></o:p></font></p>
<p class="MsoNormal"><font color="#990000">Mr Michele Neylon<o:p></o:p></font></p>
<p class="MsoNormal"><font color="#990000">Blacknight
Solutions<o:p></o:p></font></p>
<p class="MsoNormal"><font color="#990000">Hosting,
Colocation & Domains<o:p></o:p></font></p>
<p class="MsoNormal"><font color="#990000"><a
class="moz-txt-link-freetext"
href="https://www.blacknight.com/"
moz-do-not-send="true">https://www.blacknight.com/</a><o:p></o:p></font></p>
<p class="MsoNormal"><font color="#990000"><a
class="moz-txt-link-freetext"
href="http://blacknight.blog/" moz-do-not-send="true">http://blacknight.blog/</a><o:p></o:p></font></p>
<p class="MsoNormal"><font color="#990000">Intl. +353 (0)
59 9183072<o:p></o:p></font></p>
<p class="MsoNormal"><font color="#990000">Direct Dial: +353
(0)59 9183090<o:p></o:p></font></p>
<p class="MsoNormal"><font color="#990000">Personal blog: <a
class="moz-txt-link-freetext"
href="https://michele.blog/" moz-do-not-send="true">https://michele.blog/</a><o:p></o:p></font></p>
<p class="MsoNormal"><font color="#990000">Some thoughts: <a
class="moz-txt-link-freetext"
href="https://ceo.hosting/" moz-do-not-send="true">https://ceo.hosting/</a>
<o:p></o:p></font></p>
<p class="MsoNormal"><font color="#990000">-------------------------------<o:p></o:p></font></p>
<p class="MsoNormal"><font color="#990000">Blacknight
Internet Solutions Ltd, Unit 12A,Barrowside Business
Park,Sleaty<o:p></o:p></font></p>
</div>
<font color="#990000"> </font>
<p class="MsoNormal"><font color="#990000">Road,Graiguecullen,Carlow,R93
X265,Ireland Company No.: 370845</font><span
style="mso-fareast-language:EN-US" lang="EN-GB"><o:p></o:p></span></p>
<br>
</div>
</blockquote>
<br>
<pre class="moz-signature" cols="72"><font size="-1">--
------------------------------------------------
"It is a disgrace to be rich and honoured
in an unjust state" -Confucius
邦有道，贫且贱焉，耻也。邦无道，富且贵焉，耻也
------------------------------------------------
Dr Sam Lanfranco (Prof Emeritus & Senior Scholar)
Econ, York U., Toronto, Ontario, CANADA - M3J 1P3
email: <a class="moz-txt-link-abbreviated" href="mailto:Lanfran@Yorku.ca" moz-do-not-send="true">Lanfran@Yorku.ca</a> Skype: slanfranco
blog: <a class="moz-txt-link-freetext" href="https://samlanfranco.blogspot.com" moz-do-not-send="true">https://samlanfranco.blogspot.com</a>
Phone: +1 613-476-0429 cell: +1 416-816-2852</font></pre>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
gnso-rds-pdp-wg mailing list
<a class="moz-txt-link-abbreviated" href="mailto:gnso-rds-pdp-wg@icann.org">gnso-rds-pdp-wg@icann.org</a>
<a class="moz-txt-link-freetext" href="https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg">https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg</a></pre>
</blockquote>
<br>
</body>
</html>