[anti-abuse-wg] Fwd: [dns-wg] EU: DNS abuse study

I probably should say this on the DNS mailing list but I find it quite
curious that the study surveyed such limited stakeholders, and
mainly the intellectual property crowd.

"We gathered the data and inputs from stakeholders with two questionnaires:
1) the first one surveyed registries, registrars, hosting providers, other
DNS operators, and 2) the second one surveyed intellectual property
rightholders, practitioners, associations, business intelligence, and brand
protection companies. The study also collected data from third parties and
publicly available reports (secondary research), as well as evaluated the
impact of DNS abuse." (Page 7)


Intellectual property is not the best way to combat abuse and it will lead
to protectionism and intellectual property overreach. Same applies to this
space.  They use "illegal" and "harmful"  in their definition of DNS abuse
which are ambiguous at best and expand the definition of DNS abuse so much
that of course can result in concluding that we are all drowning in harmful
activities online and it's all the DNS fault.




On Sun, Feb 6, 2022 at 10:50 AM Markus de Brün <markus at mxdomain.de> wrote:

>
> For those who are not following the DNS wg list:
>
> The European Commission has published a quite comprehensive study on DNS
> abuse. (One could also call it enormous.)
>
> It study itself be found here:
>
> https://op.europa.eu/en/publication-detail/-/publication/7d16c267-7f1f-11ec-8c40-01aa75ed71a1/language-en/
>
> There is an additional document containing the appendix:
>
> https://op.europa.eu/en/publication-detail/-/publication/d9804355-7f22-11ec-8c40-01aa75ed71a1/language-en
>
> --
> Markus de Brün
>
> -------- Forwarded Message --------
> Subject: Re: [dns-wg] EU: DNS abuse study
> Date: Fri, 4 Feb 2022 10:52:53 +0100
> From: Petr Špaček <pspacek at isc.org>
> To: dns-wg at ripe.net
>
> On 01. 02. 22 9:32, Hank Nussbacher wrote:
> > The EU has published is 173 page opus on DNS abuse:
> >
> >
> https://op.europa.eu/en/publication-detail/-/publication/7d16c267-7f1f-11ec-8c40-01aa75ed71a1/language-en/
>
> I have had a peak when waiting for other things to happen and it might
> be interesting read. Here is a gist from chapter Executive summary:
>
> The study adopts the following definition of DNS abuse:
> Domain Name System (DNS) abuse is any activity that makes use of domain
> names or the DNS protocol to carry out harmful or illegal activity.
>
> The main findings of the measurements are:
> a) In relative terms, new generic Top-Level Domains (new gTLDs), with an
> estimated market share of 6.6%, are the most abused group of TLDs
> (Appendix 1 – Technical Report, Section 5, p. 26).
> b) Not all new gTLDs suffer from DNS abuse to the same extent. The two
> most abused new gTLDs combined account for 41% of all abused new gTLD
> names (Appendix 1 – Technical Report, Section 9.2, p. 32).
> c) European Union country code TLDs (EU ccTLDs) are by far the least
> abused in absolute terms and relative to their overall market share
> (Appendix 1 – Technical Report, Section 5, p. 26).
> d) The vast majority of spam and botnet command-and-control domain names
> are maliciously registered (Appendix 1 – Technical Report, Section 10.3,
> p. 41).
> e) About 25% of phishing domain names and 41% of malware distribution
> domain names are presumably registered by legitimate users, but
> compromised at the hosting level (Appendix 1 – Technical Report, Section
> 10.3, p. 41).
> f) The top five most abused registrars account for 48% of all
> maliciously registered domain names (Appendix 1 – Technical Report,
> Section 11.2, pp. 43-44).
> g) Hosting providers with disproportionate concentrations of spam
> domains reach 3,000 abused domains per 10,000 registered domain names
> (Appendix 1 – Technical Report, Section 12.3, pp. 48-49).
> h) The overall level of DNS security extensions (DNSSEC) adoption
> remains low. (Appendix 1 – Technical Report, Section 15.3, pp. 62-63).
> i) There are 2.5 million open DNS resolvers worldwide that can be
> effectively used as amplifiers in distributed denial-of-service attacks
> (Appendix 1 – Technical Report, Section 16.4, p. 70).
>
> The numbers above sound interesting.
>
> --
> Petr Špaček
>
> --
>
> To unsubscribe from this mailing list, get a password reminder, or
> change your subscription options, please visit:
> https://lists.ripe.net/mailman/listinfo/dns-wg
>
> --
>
> To unsubscribe from this mailing list, get a password reminder, or change
> your subscription options, please visit:
> https://mailman.ripe.net/
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: </ripe/mail/archives/anti-abuse-wg/attachments/20220209/3fdae78c/attachment.html>