Statistical Analysis of DNS Abuse in gTLDs Final Report

{{#cargo_store:_table=Resources|Organization=|Type=Report|Issue=DNS|Release_Date=2017/08/25|Link=https://www.icann.org/en/system/files/files/sadag-final-09aug17-en.pdf }}{|style="width: 25em; font-size: 100%; border: 1px solid #aaaaaa; background-color: #f9f9f9; color: black; margin-bottom: 0.5em; margin-left: 1em; padding: 0.2em; float: right; clear: right; text-align:left;" |Organization: |ICANN |- |Type: |Report |- ||Issue: |DNS |- |Release Date: |2017/08/25

|- ! Link | Link |} This report focuses on measuring rates of common forms of abusive activities in the Domain Name System (DNS). The study examines malicious behavior in the global DNS and compare abuse rates in new and legacy gTLDs.

It was commissioned by the Competition, Consumer Trust, and Consumer Choice Review Team with the support of ICANN. The authors of the study are Maciej Korczy, Maarten Wullink, Samaneh Tajalizadehkhoob, Giovane C.M. Moura, and Cristian Hesselman.

Results

Overview

The study combines data sets from many sources, including zone files, domain WHOIS information, data obtained through our active measurements, and 11 reputable blacklists representing malware, phishing, and spam.

The results of the study indicate that abuse counts primarily correlate with stricter registration policies, and that the introduction of gTLDs have lowered span counts in legacy gTLDs.

The main contributions can be summarized as follows:

A comprehensive descriptive statistical comparison of rates of DNS abuse in new and legacy gTLDs as they pertain to spam, phishing, and malware distribution.
Using regression modelling, the performance of inferential statistical analysis testing the correlation between passively and actively measured properties of new gTLDs as predictors of rates of abuse.
Analyzing proportions of abusive domains across other relevant to abusive practices players, i.e. registrars and privacy/proxy service providers.