<!DOCTYPE html><html><head><title></title><style type="text/css">p.MsoNormal,p.MsoNoSpacing{margin:0}</style></head><body><div>Good write up John, <br></div><div><br></div><div>Do you have any stats on DGA botnet domains? I have not seen much of those in the last few years, but since Avalanche (2016) and Conficker (2008) they are not the size they used to be?<br></div><div>I do see them at other places, blockchain, IOT, dropbox API abuse. <br></div><div><br></div><div>Thanks in advance. <br></div><div>Theo<br></div><div><br></div><div>On Sun, Apr 3, 2022, at 6:21 PM, John McCormac via CPWG wrote:<br></div><blockquote type="cite" id="qt" style=""><div>This is a kind of introduction to bulk registrations based on tracking <br></div><div>domain name statistics and running Web Usage surveys that measures the <br></div><div>rates of usage in gTLDs and ccTLDs. I've left out the brand <br></div><div>protection/IP aspect as that's really covered by UDRP and URS.<br></div><div><br></div><div>The bulk registrations problem is complex but DA is only part of it. <br></div><div>While spam, botnet C&C and some other registrations are problems in <br></div><div>terms of DA, many bulk registrations are often borderline "content <br></div><div>abuse" problems.<br></div><div><br></div><div>Some search engines still have problems with handling links from <br></div><div>websites and it is not uncommon to see large numbers of webspam websites <br></div><div>generated from scraped web content from legitimate websites, Social <br></div><div>Media and even search engine results. The more inbound links a website <br></div><div>has, the more authoritative it appears. Some search engines have been <br></div><div>fighting this problem for years.<br></div><div><br></div><div>The software that produces these webspam sites is quite sophisticated <br></div><div>and it can churn out thousands of these sites in a few hours. The <br></div><div>essential element is low priced or free domain names. These websites are <br></div><div>typically one year registrations. They do not renew. This is because the <br></div><div>economics do not justify paying the full-priced renewal fee. It is <br></div><div>cheaper to register another heavily discounted domain name either in the <br></div><div>same gTLD or another gTLD where there is a heavily discounted <br></div><div>registrations offer running.<br></div><div><br></div><div>There is also a speculative element to some bulk registrations in that <br></div><div>there are often mini-bubbles which target short domain names (four <br></div><div>letter (4Ls), five letter (5Ls) and some numerical domain names). Many <br></div><div>of the registries or brand owners have already registered the three <br></div><div>letter domain names. Again, some of these trends are linked to <br></div><div>discounting offers. They are not abusive registrations and often end up <br></div><div>on domain name sales sites. These trends may start in one gTLD and then, <br></div><div>once the 4Ls are all registered in that gTLD, move into other gTLDs. The <br></div><div>Chinese bubble in .COM and other legacy gTLDs is a good example of this <br></div><div>kind of trend. Most of the bubble registrations did not renew.<br></div><div><br></div><div>Affiliate landers (adult and gambling) are also a feature of bulk <br></div><div>registrations. There has been somewhat of a shift away from parking <br></div><div>undeveloped domain names on pay per click (PPC) landing pages. Again, <br></div><div>these types of bulk registrations have a high attrition rate. These <br></div><div>affiliate landers have similarities to the automatically generated <br></div><div>websites mentioned above.<br></div><div><br></div><div>That leaves the real problem categories in bulk registrations. <br></div><div>Disposable registrations used for spam are part of the bulk <br></div><div>registrations spectrum but detecting them is made more difficult by the <br></div><div>damage that GDPR and the reaction to GDPR has caused on WHOIS. The <br></div><div>problem of deciding what is and is not a spam domain name is compounded <br></div><div>by the fact that the majority of domain names in most gTLDS do not have <br></div><div>developed websites. The blacklists generaly operate on the principle of <br></div><div>detected use rather than identifying intent.<br></div><div><br></div><div>Registration for botnet C&C, phishing, pharming and other forms of abuse <br></div><div>can be obvious and non-obvious. Domain generation algorithms used for <br></div><div>C&C and other malware generate pseudorandom domain names but sometimes <br></div><div>these registrations already exist. The problem with a simple approach is <br></div><div>that some languages, like those in China, may use numbers as part of a <br></div><div>domain name because they sound like other words. To someone with only <br></div><div>experience of English, they may appear to be a random string of characters.<br></div><div><br></div><div>Separating these abusive registrations is quite difficult. In the <br></div><div>absence of WHOIS data and other data it is extremely difficult to guess <br></div><div>the intent of the registrant. With some of the affiliate lander <br></div><div>registrations, there is often a clustering pattern in both gTLD and <br></div><div>webservers. But that only happens with domain names that a have <br></div><div>websites. Spam registrations may only be detected once used for spam and <br></div><div>even then they have a finite lifespan. (Heavily discounted registrations <br></div><div>are disposable.)<br></div><div><br></div><div>These are the Quick Delta numbers and percentages of some new gTLDs. The <br></div><div>Quick Delta compares a gTLD's zonefile with the zonefile from a year ago.<br></div><div><br></div><div>March 2021 - - Retained - Deleted - Retained % - Deleted %<br></div><div>1,317,370 80,358 1,237,012 6.10 93.90<br></div><div>246,344 22,025 224,319 8.94 91.06<br></div><div>32,838 2,972 29,866 9.05 90.95<br></div><div><br></div><div>Other new gTLDs are quite normal and some even have Quick Delta rates <br></div><div>approaching those of ccTLDs (very stable). Discounting is part of the <br></div><div>business model of registries. They use it to grow the number of domain <br></div><div>name under management.<br></div><div><br></div><div>The theory is much like throwing mud at a wall to see how much sticks. A <br></div><div>small percentage of domain names will renew at full fee. A registry will <br></div><div>gradually build up a core set of domain names that may keep renewing but <br></div><div>the vast majority delete without being renewed. Somewhere in those bulk <br></div><div>registrations are the abusive registrations. It is made more difficult <br></div><div>by the fact that most bulk registrations are one year registrations and <br></div><div>the bulk registration problem is a moving target.<br></div><div><br></div><div>Regards...jmcc<br></div><div>-- <br></div><div>**********************************************************<br></div><div>John McCormac * e-mail: <a href="mailto:jmcc@hosterstats.com">jmcc@hosterstats.com</a><br></div><div>MC2 * web: <a href="http://www.hosterstats.com/">http://www.hosterstats.com/</a><br></div><div>22 Viewmount * Domain Registrations Statistics<br></div><div>Waterford * Domnomics - the business of domain names<br></div><div>Ireland * <a href="https://amzn.to/2OPtEIO">https://amzn.to/2OPtEIO</a><br></div><div>IE * Skype: hosterstats.com<br></div><div>**********************************************************<br></div><div><br></div><div>-- <br></div><div>This email has been checked for viruses by AVG.<br></div><div><a href="https://www.avg.com">https://www.avg.com</a><br></div><div><br></div><div>_______________________________________________<br></div><div>CPWG mailing list<br></div><div><a href="mailto:CPWG@icann.org">CPWG@icann.org</a><br></div><div><a href="https://mm.icann.org/mailman/listinfo/cpwg">https://mm.icann.org/mailman/listinfo/cpwg</a><br></div><div><br></div><div>_______________________________________________<br></div><div>By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (<a href="https://www.icann.org/privacy/policy">https://www.icann.org/privacy/policy</a>) and the website Terms of Service (<a href="https://www.icann.org/privacy/tos">https://www.icann.org/privacy/tos</a>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.<br></div><div><br></div></blockquote><div><br></div></body></html>