[gnso-rpm-wg] The Modality of Mortality in Domain Names - research by Farsight Security

George Kirikos icann at leap.com
Fri Oct 12 12:28:30 UTC 2018


Hi folks,

Paul Vixie and Pawel Foremski of Farsight Security published a study recently:

https://www.farsightsecurity.com/assets/media/download/VB2018-study.pdf

looking at domain lifetimes for abusive domains, and how abusive
domains are **already** being taken down within minutes, hours or just
a few days (much faster than the URS). Their conclusions:

"We presented a systematic study of the lifetime of newly observed domain
names. We found that, on average, 9.3% of new domains effectively died in
their first seven days, with a median time of just four hours and 16 minutes."

This research reinforces URS proposal #32 (elimination of the URS)
being presented later today, as the marginal benefits over and above
the existing procedures (like section 3.18 of the 2013 RAA, complaints
to ISPs, blocking mechanisms such as Google's safebrowsing and
anti-spam blacklists) are small.

And, consistent with my own thoughts, they point to better policy
alternatives to focus upon, such as delaying the resolution of
newly-registered domains for some time (rather than allowing them to
go live immediately):

"Thus, a sensible DNS policy should block access to new domains for a
few hours after detection, a few days, or even a week for maximum
protection."

Sincerely,

George Kirikos
416-588-0269
http://www.leap.com/


More information about the GNSO-RPM-WG mailing list