<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hi Danny and all,<div class=""><br class=""></div><div class=""><div><blockquote type="cite" class=""><div class="">On Feb 25, 2022, at 1:32 PM, Danny McPherson <<a href="mailto:danny@tcb.net" class="">danny@tcb.net</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">I'm saying that unless we can prove CI is effective (which I have seen no data to support)<br class=""></div></div></blockquote><div><br class=""></div>I have been half-watching this conversation until now, but this caught my eye and is something I can speak to, as the data surrounding CI is something that I am currently studying.</div><div><br class="">I am analyzing various data sets and performing outreach to better understand the effectiveness of CI, as has been implemented since August 2014. At this point <span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);" class="">I don't have any solid conclusions, one way or the other, but</span><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);" class=""> I am making some progress and hope to have some better answers in the next month or so. </span><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);" class="">That being said, here is a (very) brief preview of some of the things I am seeing. </span></div><div><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);" class=""><br class=""></span></div><div><font color="#000000" class=""><span style="caret-color: rgb(0, 0, 0);" class="">Please note that this is all somewhat preliminary, and there is more detail that is lacking from in this brief description but will be forthcoming.</span></font></div><div><font color="#000000" class=""><span style="caret-color: rgb(0, 0, 0);" class=""><br class=""></span></font></div><div><font color="#000000" class=""><span style="caret-color: rgb(0, 0, 0);" class="">new gTLDs - the 885 gTLDs delegated between Aug 2014 and June 2021.</span></font></div><div><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);" class="">suffix - a DNS suffix applied to computer system (e.g., <a href="http://foo.com" class="">foo.com</a>), observed during the CI period (first 100 days of delegation). A total of 2300 were identified using Farsight's DNSDB, from approximately 166 of the new gTLDs (again, there are some implementation details missing here, but this is a pretty good estimate). Note that none of these 2300 suffixes *is* a new gTLD itself, but is rather a proper subdomain.</span></div><div><br class=""></div><div><font color="#000000" class=""><span style="caret-color: rgb(0, 0, 0);" class="">After analyzing the 2014, 2015, 2016, 2017, and 2021 DITL data (2018 through 2020 are in process), I have seen the following trends:</span></font></div><div><font color="#000000" class=""><br class="">Year<span class="Apple-tab-span" style="white-space:pre"> </span>Obs<span class="Apple-tab-span" style="white-space:pre"> </span>Del<span class="Apple-tab-span" style="white-space:pre"> </span>Pct1<span class="Apple-tab-span" style="white-space:pre"> </span>Del/Obs<span class="Apple-tab-span" style="white-space:pre"> </span>Pct<br class="">2014<span class="Apple-tab-span" style="white-space:pre"> </span>1858<span class="Apple-tab-span" style="white-space:pre"> </span><span class="Apple-tab-span" style="white-space:pre"> </span><span class="Apple-tab-span" style="white-space:pre"> </span><span class="Apple-tab-span" style="white-space:pre"> </span><br class="">2015<span class="Apple-tab-span" style="white-space:pre"> </span>1806<span class="Apple-tab-span" style="white-space:pre"> </span>1037<span class="Apple-tab-span" style="white-space:pre"> </span>79%<span class="Apple-tab-span" style="white-space:pre"> </span>743<span class="Apple-tab-span" style="white-space:pre"> </span>72%<br class="">2016<span class="Apple-tab-span" style="white-space:pre"> </span>1610<span class="Apple-tab-span" style="white-space:pre"> </span>1808<span class="Apple-tab-span" style="white-space:pre"> </span>70%<span class="Apple-tab-span" style="white-space:pre"> </span>1207<span class="Apple-tab-span" style="white-space:pre"> </span>67%<br class="">2017<span class="Apple-tab-span" style="white-space:pre"> </span>1508<span class="Apple-tab-span" style="white-space:pre"> </span>2018<span class="Apple-tab-span" style="white-space:pre"> </span>66%<span class="Apple-tab-span" style="white-space:pre"> </span>1248<span class="Apple-tab-span" style="white-space:pre"> </span>62%<br class="">2021<span class="Apple-tab-span" style="white-space:pre"> </span>1283<span class="Apple-tab-span" style="white-space:pre"> </span>2300<span class="Apple-tab-span" style="white-space:pre"> </span>56%<span class="Apple-tab-span" style="white-space:pre"> </span>1283<span class="Apple-tab-span" style="white-space:pre"> </span>56%</font></div><div><font color="#000000" class=""><br class=""></font></div><div><font color="#000000" class="">Obs - suffixes observed in DITL queries</font></div><div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"><font color="#000000" class="">Del - suffixes for which TLD is delegated</font></div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">Pct1 - Percent of overall suffixes observed</div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">Pct2 - Percent of suffixes observed for which TLD was delegated</div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"><br class=""></div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">Here is a view from the perspective of TLDs for which suffixes were observed:</div><div><font color="#000000" class=""><span style="caret-color: rgb(0, 0, 0);" class=""><br class="">Year<span class="Apple-tab-span" style="white-space:pre"> </span>Del<span class="Apple-tab-span" style="white-space: pre;"> </span>Obs<span class="Apple-tab-span" style="white-space:pre"> </span>Pct<span class="Apple-tab-span" style="white-space: pre;"> </span><br class="">2015<span class="Apple-tab-span" style="white-space: pre;"> </span>60<span class="Apple-tab-span" style="white-space: pre;"> </span>46<span class="Apple-tab-span" style="white-space: pre;"> </span>77%<br class="">2016<span class="Apple-tab-span" style="white-space: pre;"> </span>138<span class="Apple-tab-span" style="white-space: pre;"> </span>103<span class="Apple-tab-span" style="white-space: pre;"> </span>75%<br class="">2017<span class="Apple-tab-span" style="white-space: pre;"> </span>191<span class="Apple-tab-span" style="white-space: pre;"> </span>139<span class="Apple-tab-span" style="white-space: pre;"> </span>73%<br class="">2021<span class="Apple-tab-span" style="white-space: pre;"> </span>200<span class="Apple-tab-span" style="white-space: pre;"> </span>129<span class="Apple-tab-span" style="white-space: pre;"> </span>65%</span></font></div><div><font color="#000000" class=""><span style="caret-color: rgb(0, 0, 0);" class=""><br class=""></span></font></div><div><div><font color="#000000" class="">Obs - TLDs for which suffixes were observed in DITL queries</font></div><div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"><font color="#000000" class="">Del - TLDs delegated</font></div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">Pct - Percent of TLDs for which suffixes were observed</div></div></div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"><br class=""></div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">Note again that Pct is clearly decreasing over the years.</div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"><br class=""></div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">Finally:</div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"><br class=""></div></div><div><font color="#000000" class=""><span style="caret-color: rgb(0, 0, 0);" class=""><span class="Apple-tab-span" style="white-space:pre"> </span>qnames<span class="Apple-tab-span" style="white-space: pre;"> </span>IPs<span class="Apple-tab-span" style="white-space: pre;"> </span>ASNs<br class="">2015 <span class="Apple-tab-span" style="white-space:pre"> </span>16.0 <span class="Apple-tab-span" style="white-space:pre"> </span>16.0 <span class="Apple-tab-span" style="white-space:pre"> </span>7.0<br class="">2016 <span class="Apple-tab-span" style="white-space:pre"> </span>18.0 <span class="Apple-tab-span" style="white-space:pre"> </span>18.0 <span class="Apple-tab-span" style="white-space:pre"> </span>7.0<br class="">2017 <span class="Apple-tab-span" style="white-space:pre"> </span>12.0 <span class="Apple-tab-span" style="white-space:pre"> </span>13.0 <span class="Apple-tab-span" style="white-space:pre"> </span>6.0<br class="">2021 <span class="Apple-tab-span" style="white-space:pre"> </span>10.0 <span class="Apple-tab-span" style="white-space:pre"> </span>16.0 <span class="Apple-tab-span" style="white-space:pre"> </span>5.0</span></font></div><div><font color="#000000" class=""><span style="caret-color: rgb(0, 0, 0);" class=""><br class=""></span></font></div><div><font color="#000000" class="">These are the 75th percentile values associated with suffixes (with delegated TLDs) in each of the years:</font></div><div><font color="#000000" class="">qnames - number of qnames observed with that suffix (75th percentile)</font></div><div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"><font color="#000000" class="">IPs - number of IP addresses querying for that suffix</font> (75th percentile)</div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">ASNs - number of ASNs from queries for that suffix originated (75th percentile)</div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"><br class=""></div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">This one is a little trickier because new suffixes are introduced each year with the delegation of their corresponding TLDs. Nonetheless, there is an overall decrease here, even if it is not quite as dramatic.</div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"><br class=""></div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">Again, analysis is still underway, so take this for what it's worth.</div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"><br class=""></div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">Casey</div></div></div></body></html>