DNS Abuse: Difference between revisions

Line 132:

===Progress===

''Is it getting better or worse''?

''Is it getting better or worse?''

''Getting worse''

In March 2021, the FBI’s [[Internet Crime Complaint Center]] (IC3) released its 2020 Internet Crime Report. There were 791,790 complaints of suspected internet crime, which indicated an increase of more than 300,000 from 2019, involving losses in excess of US$4.2 billion. Phishing, non-payment/non-delivery scams, and extortion were the top three types of crime reported.<ref>[https://www.fbi.gov/news/pressrel/press-releases/fbi-releases-the-internet-crime-complaint-center-2020-internet-crime-report-including-covid-19-scam-statistics FBI releases 2020 Internet Crime Report]</ref>

''Getting better''

In March 2022, [[ICANN]] released a report of DNS Abuse from the last 4 years and indicated the practice was trending down.<ref>[https://www.icann.org/en/blogs/details/icann-publishes-dns-abuse-trends-22-03-2022-en ICANN DNS Abuse Trends, March 2022, ICANN Blogs]</ref><ref>[https://domainnamewire.com/2022/03/22/icann-dns-abuse-is-going-down/ DNS Abuse is going down? Domain Name Wire]</ref>

''Getting worse'': In March 2021, the FBI’s [[Internet Crime Complaint Center]] (IC3) released its 2020 Internet Crime Report. There were 791,790 complaints of suspected internet crime, which indicated an increase of more than 300,000 from 2019, involving losses in excess of US$4.2 billion. Phishing, non-payment/non-delivery scams, and extortion were the top three types of crime reported.<ref>[https://www.fbi.gov/news/pressrel/press-releases/fbi-releases-the-internet-crime-complaint-center-2020-internet-crime-report-including-covid-19-scam-statistics FBI releases 2020 Internet Crime Report]</ref>

''Getting better'': In March 2022, ICANN release a report of DNS Abuse from the last 4 years and indicated the practice was trending down.<ref>[https://www.icann.org/en/blogs/details/icann-publishes-dns-abuse-trends-22-03-2022-en ICANN DNS Abuse Trends, March 2022, ICANN Blogs]</ref><ref>[https://domainnamewire.com/2022/03/22/icann-dns-abuse-is-going-down/ DNS Abuse is going down? Domain Name Wire]</ref>

''Are new or Legacy gTLDs experiencing more problems?''

*On January 31, 2022, the [[European Commission]] published a [https://op.europa.eu/en/publication-detail/-/publication/d9804355-7f22-11ec-8c40-01aa75ed71a1/language-en/format-PDF/source-search Study on DNS Abuse], conducted by Fasano Paulovics Società tra Avvocati and Institut Polytechnique de Grenoble. Its key findings included:<ref>[https://op.europa.eu/en/publication-detail/-/publication/d9804355-7f22-11ec-8c40-01aa75ed71a1/language-en/format-PDF/source-search Study on DNS Abuse Technical Report Appendix 1, Directorate-General for Communications Networks, Content and Technology (European Commission), Fasano Paulovics Società tra Avvocati, Grenoble INP-UGA Institute of Engineering 2022-01-31]</ref>

''Legacy''

* The February 2021 [[DAAR]] report indicates the majority (64.8%) of security issues are occurring in legacy [[TLDs]], which comprise 88.8% of resolving gTLD domains in zone files.<ref>[https://www.icann.org/en/system/files/files/daar-monthly-report-28feb21-en.pdf DAAR monthly report Feb 2021]</ref>

*~~On January 31~~, ~~2022~~, ~~the~~ [[~~European Commission~~]] ~~published a~~ [~~https://op~~.~~europa.eu/en/publication-detail/-/publication/d9804355-7f22-11ec-8c40-01aa75ed71a1/language-en/format-PDF/source-search Study on DNS Abuse~~]~~, conducted by Fasano Paulovics Società tra Avvocati and Institut Polytechnique de Grenoble~~. ~~Its key findings included:~~<~~ref~~>[https://op.europa.eu/en/publication-detail/-/publication/d9804355-7f22-11ec-8c40-01aa75ed71a1/language-en/format-PDF/source-search Study on DNS Abuse Technical Report Appendix 1, Directorate-General for Communications Networks, Content and Technology (European Commission), Fasano Paulovics Società tra Avvocati, Grenoble INP-UGA Institute of Engineering 2022-01-31]</~~ref~~>

#* Legacy TLD domains, 53% of the market, comprise almost 49% of DNS abuse. Domains in [[.com]] and [[.net]] TLDs are the most abused.

~~# The overall health of [[TLD]]s:~~

''nTLDs''

#* nTLDs, 6.6% of the market, are the most abused group of TLDs in relative terms. In 2021, 20.5% of all abused domain names were registered in new gTLDs. Specifically, the two most abused nTLDs together account for 41% of all nTLD abuse.

#* nTLDs, 6.6% of the market, are the most abused group of TLDs in relative terms. In 2021, 20.5% of all abused domain names were registered in new gTLDs. Specifically, the two most abused nTLDs together account for 41% of all nTLD abuse.

~~#* Legacy TLD domains, 53% of the market, comprise almost 49% of DNS abuse. Domains in [[.com]] and [[.net]] TLDs are the most abused.~~

''among ccTLDs?''

#* EU ccTLDs are the least abused; only 0.8% of all abuse ([[Compromised Domain]]s and [[Malicious Domain]]s) were registered under EU ccTLDs. [[.eu]], [[.de]], [[.nl]], [[.fr]], [[.pl]], [[.it]], [[.es]], and [[.be]] account for 76% of all abuse among EU ccTLDs. Abused [[.ru]] and [[.su]] second-level domain names account for 75% of all abused domains among non-EU ccTLDs.

# [[Malicious Domain]]s ~~and [[Compromised Domain]]s:~~

''Which is more prevalent? Malicious or Compromised Domains?''

''[[Malicious Domain]]s''

#* Most [[spam]] and [[Botnet Attacks|botnet]] control and command [[domain name]]s are maliciously registered.

#* Almost 25% of [[phishing]] domain names and 41% of [[malware]] are registered by legitimate users. They are compromised at the hosting level and thus cannot be addressed at the [[DNS]] level without collateral damage.

#* 42% of hacked websites occur among more frequently used TLDs. In less-used new gTLDs, hackers directly register domains for malicious activities.

#* [[Registries]] and [[registrars]] can act at the DNS level but not on the hosting infrastructure unless they also offer hosting services.

#* The top five most abused registrars account for 48% of all maliciously registered domain names.

'''[[Compromised Domain]]s'''

#* Almost 25% of [[phishing]] domain names and 41% of [[malware]] are registered by legitimate users. They are compromised at the hosting level and thus cannot be addressed at the [[DNS]] level without collateral damage.

#* Phishers use free subdomain and hosting providers, which do not work well for spammers and botnet C&C activity. For phishing abuse, half of the 10 most abused TLDs ([[.ml]], [[.tk]], [[.ga]], [[.cf]], and [[.gq]]) are operated by [[Freenom]].

''Adoption of preventative measures?''

# Adoption of [[DNSSEC]] and mail protection protocols:

#* DNSSEC adoption remains low. Of 227 million domain names, only 9.4 million meet all required resource records; however, 98% of them are correctly signed and validated.

@@ Line 132: / Line 132: @@
 ===Progress===
-''Is it getting better or worse''?
+''Is it getting better or worse?''
+''Getting worse''<br/>
+In March 2021, the FBI’s [[Internet Crime Complaint Center]] (IC3) released its 2020 Internet Crime Report. There were 791,790 complaints of suspected internet crime, which indicated an increase of more than 300,000 from 2019, involving losses in excess of US$4.2 billion. Phishing, non-payment/non-delivery scams, and extortion were the top three types of crime reported.<ref>[https://www.fbi.gov/news/pressrel/press-releases/fbi-releases-the-internet-crime-complaint-center-2020-internet-crime-report-including-covid-19-scam-statistics FBI releases 2020 Internet Crime Report]</ref> <br/>
+''Getting better''<br/>
+In March 2022, [[ICANN]] released a report of DNS Abuse from the last 4 years and indicated the practice was trending down.<ref>[https://www.icann.org/en/blogs/details/icann-publishes-dns-abuse-trends-22-03-2022-en ICANN DNS Abuse Trends, March 2022, ICANN Blogs]</ref><ref>[https://domainnamewire.com/2022/03/22/icann-dns-abuse-is-going-down/ DNS Abuse is going down? Domain Name Wire]</ref><br/>
-''Getting worse'': In March 2021, the FBI’s [[Internet Crime Complaint Center]] (IC3) released its 2020 Internet Crime Report. There were 791,790 complaints of suspected internet crime, which indicated an increase of more than 300,000 from 2019, involving losses in excess of US$4.2 billion. Phishing, non-payment/non-delivery scams, and extortion were the top three types of crime reported.<ref>[https://www.fbi.gov/news/pressrel/press-releases/fbi-releases-the-internet-crime-complaint-center-2020-internet-crime-report-including-covid-19-scam-statistics FBI releases 2020 Internet Crime Report]</ref> <br/>
-''Getting better'': In March 2022, ICANN release a report of DNS Abuse from the last 4 years and indicated the practice was trending down.<ref>[https://www.icann.org/en/blogs/details/icann-publishes-dns-abuse-trends-22-03-2022-en ICANN DNS Abuse Trends, March 2022, ICANN Blogs]</ref><ref>[https://domainnamewire.com/2022/03/22/icann-dns-abuse-is-going-down/ DNS Abuse is going down? Domain Name Wire]</ref>
 ''Are new or Legacy gTLDs experiencing more problems?''
+*On January 31, 2022, the [[European Commission]] published a [https://op.europa.eu/en/publication-detail/-/publication/d9804355-7f22-11ec-8c40-01aa75ed71a1/language-en/format-PDF/source-search Study on DNS Abuse], conducted by Fasano Paulovics Società tra Avvocati and Institut Polytechnique de Grenoble. Its key findings included:<ref>[https://op.europa.eu/en/publication-detail/-/publication/d9804355-7f22-11ec-8c40-01aa75ed71a1/language-en/format-PDF/source-search Study on DNS Abuse Technical Report Appendix 1, Directorate-General for Communications Networks, Content and Technology (European Commission), Fasano Paulovics Società tra Avvocati, Grenoble INP-UGA Institute of Engineering 2022-01-31]</ref><br/>
+''Legacy''<br/>
 * The February 2021 [[DAAR]] report indicates the majority (64.8%) of security issues are occurring in legacy [[TLDs]], which comprise 88.8% of resolving gTLD domains in zone files.<ref>[https://www.icann.org/en/system/files/files/daar-monthly-report-28feb21-en.pdf DAAR monthly report Feb 2021]</ref>
-*On January 31, 2022, the [[European Commission]] published a [https://op.europa.eu/en/publication-detail/-/publication/d9804355-7f22-11ec-8c40-01aa75ed71a1/language-en/format-PDF/source-search Study on DNS Abuse], conducted by Fasano Paulovics Società tra Avvocati and Institut Polytechnique de Grenoble. Its key findings included:<ref>[https://op.europa.eu/en/publication-detail/-/publication/d9804355-7f22-11ec-8c40-01aa75ed71a1/language-en/format-PDF/source-search Study on DNS Abuse Technical Report Appendix 1, Directorate-General for Communications Networks, Content and Technology (European Commission), Fasano Paulovics Società tra Avvocati, Grenoble INP-UGA Institute of Engineering 2022-01-31]</ref>
+#* Legacy TLD domains, 53% of the market, comprise almost 49% of DNS abuse. Domains in [[.com]] and [[.net]] TLDs are the most abused. <br/>
-# The overall health of [[TLD]]s:
+''nTLDs'' <br/>
-#* nTLDs, 6.6% of the market, are the most abused group of TLDs in relative terms. In 2021, 20.5% of all abused domain names were registered in new gTLDs. Specifically, the two most abused nTLDs together account for 41% of all nTLD abuse.
+#* nTLDs, 6.6% of the market, are the most abused group of TLDs in relative terms. In 2021, 20.5% of all abused domain names were registered in new gTLDs. Specifically, the two most abused nTLDs together account for 41% of all nTLD abuse.<br/>
-#* Legacy TLD domains, 53% of the market, comprise almost 49% of DNS abuse. Domains in [[.com]] and [[.net]] TLDs are the most abused.
+''among ccTLDs?''<br/>
 #* EU ccTLDs are the least abused; only 0.8% of all abuse ([[Compromised Domain]]s and [[Malicious Domain]]s) were registered under EU ccTLDs. [[.eu]], [[.de]], [[.nl]], [[.fr]], [[.pl]], [[.it]], [[.es]], and [[.be]] account for 76% of all abuse among EU ccTLDs. Abused [[.ru]] and [[.su]] second-level domain names account for 75% of all abused domains among non-EU ccTLDs.
-# [[Malicious Domain]]s and [[Compromised Domain]]s:
+''Which is more prevalent? Malicious or Compromised Domains?''<br/>
+''[[Malicious Domain]]s''<br/>
 #* Most [[spam]] and [[Botnet Attacks|botnet]] control and command [[domain name]]s are maliciously registered.
-#* Almost 25% of [[phishing]] domain names and 41% of [[malware]] are registered by legitimate users. They are compromised at the hosting level and thus cannot be addressed at the [[DNS]] level without collateral damage.
 #* 42% of hacked websites occur among more frequently used TLDs. In less-used new gTLDs, hackers directly register domains for malicious activities.
 #* [[Registries]] and [[registrars]] can act at the DNS level but not on the hosting infrastructure unless they also offer hosting services.
 #* The top five most abused registrars account for 48% of all maliciously registered domain names.
+'''[[Compromised Domain]]s'''<br/>
+#* Almost 25% of [[phishing]] domain names and 41% of [[malware]] are registered by legitimate users. They are compromised at the hosting level and thus cannot be addressed at the [[DNS]] level without collateral damage.
 #* Phishers use free subdomain and hosting providers, which do not work well for spammers and botnet C&C activity. For phishing abuse, half of the 10 most abused TLDs ([[.ml]], [[.tk]], [[.ga]], [[.cf]], and [[.gq]]) are operated by [[Freenom]].
+''Adoption of preventative measures?''<br/>
 # Adoption of [[DNSSEC]] and mail protection protocols:
 #* DNSSEC adoption remains low. Of 227 million domain names, only 9.4 million meet all required resource records; however, 98% of them are correctly signed and validated.