February 2022 - anti-abuse-wg

UCEPROTECT DNSBL possibly abusive practice and RIPEStat Blacklist entries widget
by Kristijonas Lukas Bukauskas 19 May '22

19 May '22

Hello, I noticed that RIPE NCC uses uceprotect-level1, uceprotect-level2 and uceprotect-level3 in RIPEStat Anti Abuse Blacklist Entries widget. There have been controversial positions about this blacklist recently: 1) https://success.trendmicro.com/solution/000236583-Emails-being-rejected-by-… [1] 2) https://blog.sucuri.net/2021/02/uceprotect-when-rbls-go-bad.html [2] UCEPROTECT blacklists the whole range of IP addresses, including the full IP range of some autonomous systems: UCEPROTECT states, '_Who is responsible for this listing? YOU ARE NOT! Your IP was NOT directly involved in abuse but has a bad neighborhood. Other customers within this range did not care about their security and got hacked, started spamming, or were even attacking others, while your provider has possibly not even noticed that there is a serious problem. We are sorry for you, but you have chosen a provider not acting fast enough on abusers'_) [http://www.uceprotect.net/en/rblcheck.php [3]]. It asks for a fee if some individual IP address wants to be whitelisted (http://www.whitelisted.org/), It abuses people who decide to challenge their blacklist by publishing conversations in their so-called _Cart00ney_ (http://www.uceprotect.net/en/index.php?m=8&s=0 [4]; http://www.uceprotect.org/cart00neys/index.html [5]). And the other type of threatening: http://www.uceprotect.org/ Does RIPE NCC have any position on this specific blacklist? Thank you! Links: ------ [1] https://success.trendmicro.com/solution/000236583-Emails-being-rejected-by-… [2] https://blog.sucuri.net/2021/02/uceprotect-when-rbls-go-bad.html [3] http://www.uceprotect.net/en/rblcheck.php [4] http://www.uceprotect.net/en/index.php?m=8&s=0 [5] http://www.uceprotect.org/cart00neys/index.html

16 42

RIPE NCC Abuse Handling Training Call Minutes
by Markus de Brün 24 Feb '22

24 Feb '22

Colleagues, thank you all for participating in the call yesterday. Your input is very much appreciated! Evelien and Gerardo compiled some minutes, which you will find here: https://docs.google.com/document/d/18EemfujSbxUlAOyws1DCe-EE9KXIRqQAYrjFJyY… If you think any of your comments/points are missing, please let us know until March 4. Thanks again, Markus

1 0

RIPE NCC Anti-Abuse Training: Next Steps & WG Input!
by Brian Nisbet 24 Feb '22

24 Feb '22

Colleagues, Since we last spoke about the proposed training the NCC have been working with various community members to put a draft syllabus in place for further discussion. This is a link to the feedback document for this draft: https://docs.google.com/document/d/1M9Wrqu-VKGGwMfJQGK0NlTs5UzH6xJ2_HR2MkTB… What the NCC and the Co-Chairs would love is if everybody could just comment what they think they understand from the learning goals as they’re written and suggest any changes or additions and obviously ask any questions. We’d also like the feedback on the webinar flow design. It’s important for everybody to understand that the learning objectives are the basis for the training. These are the skills that the learner must acquire. With these skills we also expect a change of attitude towards abuse handling (which is we think the purpose of this training). While discussion on the list is welcomed and encouraged, we've also planned a Zoom session for any interested parties to discuss this further. This will take place on Wednesday 23rd February at 14:00 CET: https://ripe.zoom.us/j/8221791822?pwd=ZFY0MnNQeWJsTkhQSFlyeEZlUkNJQT09 Meeting ID: 822 179 1822 Passcode: 1277 Hopefully with discussion on list and at the session on the 23rd we can move this into a final draft and progress from there. Thanks, Brian Co-Chair, RIPE AA-WG Brian Nisbet (he/him) Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

8 8

RIPE NCC Abuse Handling Training Call Reminder!
by Brian Nisbet 21 Feb '22

21 Feb '22

Colleagues, It's great to see the discussion on list on this topic, but I just wanted to remind people about the planned Zoom session for any interested parties to discuss this further. This will take place on Wednesday 23rd February at 14:00 CET: https://ripe.zoom.us/j/8221791822?pwd=ZFY0MnNQeWJsTkhQSFlyeEZlUkNJQT09 Meeting ID: 822 179 1822 Passcode: 1277 Looking forward to seeing people then! Brian Co-Chair, RIPE AA-WG Brian Nisbet (he/him) Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0

Re: [anti-abuse-wg] RIPE NCC Anti-Abuse Training: Next Steps & WG Input!
by JORDI PALET MARTINEZ 18 Feb '22

18 Feb '22

I don’t think we can, neither should, define what is abuse. Examples are ok, but should be clear that are only examples of common considered abuse activities and not necessarily inclusive/restrictive of all the possible situations. It all depends on the origin of the claim. Simple examples: In country “a”, unsolicited email maybe legally considered abuse, but not in the country “b” of the origin of that spam. You can even take out of the question the “legal” part, if you want. In country “c” attempt to ssh to hosts from other folks is a criminal action, but in country “d” (origin of the problem) is not. The problem here is to ensure that if you get a claim for a presumed abuse, you’re able to process it, even up to the point to say “sorry” in our jurisdiction or best current practices, or internal policy or AUP ... whatever, this is not an abuse so we can’t accept your claim, or otherwise, “we are handling it … we have resolved that this way”. Regards, Jordi @jordipalet El 10/2/22 10:25, "anti-abuse-wg en nombre de Brian Nisbet" <anti-abuse-wg-bounces(a)ripe.net en nombre de brian.nisbet(a)heanet.ie> escribió: Colleagues, Since we last spoke about the proposed training the NCC have been working with various community members to put a draft syllabus in place for further discussion. This is a link to the feedback document for this draft: https://docs.google.com/document/d/1M9Wrqu-VKGGwMfJQGK0NlTs5UzH6xJ2_HR2MkTB… What the NCC and the Co-Chairs would love is if everybody could just comment what they think they understand from the learning goals as they’re written and suggest any changes or additions and obviously ask any questions. We’d also like the feedback on the webinar flow design. It’s important for everybody to understand that the learning objectives are the basis for the training. These are the skills that the learner must acquire. With these skills we also expect a change of attitude towards abuse handling (which is we think the purpose of this training). While discussion on the list is welcomed and encouraged, we've also planned a Zoom session for any interested parties to discuss this further. This will take place on Wednesday 23rd February at 14:00 CET: https://ripe.zoom.us/j/8221791822?pwd=ZFY0MnNQeWJsTkhQSFlyeEZlUkNJQT09 Meeting ID: 822 179 1822 Passcode: 1277 Hopefully with discussion on list and at the session on the 23rd we can move this into a final draft and progress from there. Thanks, Brian Co-Chair, RIPE AA-WG Brian Nisbet (he/him) Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270 -- To unsubscribe from this mailing list, get a password reminder, or change your subscription options, please visit: https://lists.ripe.net/mailman/listinfo/anti-abuse-wg ********************************************** IPv4 is over Are you ready for the new Internet ? http://www.theipv6company.com The IPv6 Company This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.

2 3

Re: [anti-abuse-wg] RIPE NCC Anti-Abuse Training: Next Steps & WG Input!
by Ángel González Berdasco 17 Feb '22

17 Feb '22

> And now that you mention it, are you sure that CSAM is illegal in 100% of the countries? Of course it's not. Or, CSAM itself might be illegal but the definition of 'CSAM', 'child' or 'abuse' varies, so the end result is still that X is illegal in country A but not in country B. See the variations of the age of consent around the world, which is sometimed further conditioned by things such as if the parties are married, their age difference (with again different values), if their relationship started when both were underage and other Romeo and Juliet exceptions. Almost every complication surrounding the definition of statutory rape will blur as well getting a common definition of CSAM. Luckily, the standard for taking it down is not whether they would really be prosecuted under who-knows-which jurisdiction but a more general interpretation included in the Terms of Use of the service. Best regards -- INCIBE-CERT - Spanish National CSIRT https://www.incibe-cert.es/ PGP keys: https://www.incibe-cert.es/en/what-is-incibe-cert/pgp-public-keys ==================================================================== INCIBE-CERT is the Spanish National CSIRT designated for citizens, private law entities, other entities not included in the subjective scope of application of the "Ley 40/2015, de 1 de octubre, de Régimen Jurídico del Sector Público", as well as digital service providers, operators of essential services and critical operators under the terms of the "Real Decreto-ley 12/2018, de 7 de septiembre, de seguridad de las redes y sistemas de información" that transposes the Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union. ==================================================================== In compliance with the General Data Protection Regulation of the EU (Regulation EU 2016/679, of 27 April 2016) we inform you that your personal and corporate data (as well as those included in attached documents); and e-mail address, may be included in our records for the purpose derived from legal, contractual or pre-contractual obligations or in order to respond to your queries. You may exercise your rights of access, correction, cancellation, portability, limitationof processing and opposition under the terms established by current legislation and free of charge by sending an e-mail to dpd(a)incibe.es. The Data Controller is S.M.E. Instituto Nacional de Ciberseguridad de España, M.P., S.A. More information is available on our website: https://www.incibe.es/proteccion-datos-personales and https://www.incibe.es/registro-actividad. ====================================================================

1 0

Re: [anti-abuse-wg] Proposal: Publish effective users' abuse-c
by Ángel González Berdasco 14 Feb '22

14 Feb '22

> This bit is not possible. The "abuse-c:" attribute is 'single'. So the > resource object can only ever reference one abuse contact. Thanks Denis. abuse-c arity is a point I was dubious about. Thus, it is not currently possible to publish an abuse-c with the customer address and keep the ISP copied at the same time, as desired. In order to know what is being sent thete, the ISP needs to provide its own address and (if appropriate) forward complaints received there to the customer. Best regards -- INCIBE-CERT - Spanish National CSIRT https://www.incibe-cert.es/ PGP keys: https://www.incibe-cert.es/en/what-is-incibe-cert/pgp-public-keys ==================================================================== INCIBE-CERT is the Spanish National CSIRT designated for citizens, private law entities, other entities not included in the subjective scope of application of the "Ley 40/2015, de 1 de octubre, de Régimen Jurídico del Sector Público", as well as digital service providers, operators of essential services and critical operators under the terms of the "Real Decreto-ley 12/2018, de 7 de septiembre, de seguridad de las redes y sistemas de información" that transposes the Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union. ==================================================================== In compliance with the General Data Protection Regulation of the EU (Regulation EU 2016/679, of 27 April 2016) we inform you that your personal and corporate data (as well as those included in attached documents); and e-mail address, may be included in our records for the purpose derived from legal, contractual or pre-contractual obligations or in order to respond to your queries. You may exercise your rights of access, correction, cancellation, portability, limitationof processing and opposition under the terms established by current legislation and free of charge by sending an e-mail to dpd(a)incibe.es. The Data Controller is S.M.E. Instituto Nacional de Ciberseguridad de España, M.P., S.A. More information is available on our website: https://www.incibe.es/proteccion-datos-personales and https://www.incibe.es/registro-actividad. ====================================================================

4 4

Re: [anti-abuse-wg] [EXTERNAL] anti-abuse-wg Digest, Vol 122, Issue 8
by Graeme Bunton 11 Feb '22

11 Feb '22

The naming community has spent a lot of time and energy trying to categorize online harms and put them inside or outside the purview of Registrars and Registries. gTLD Rrs and Rys have a consensus position (malware, botnets, pharming, phishing) but for many reasons other interests are always trying to expand that in various directions. My recommendation to this group is to put aside the edge cases and worry about them after you’ve made progress on core issues. Otherwise you risk burning valuable energy on endless and intractable definitional debates. What are the most prevalent 2 or 3 problems that have consensus? Focus on those, make a difference. Wade into the murkier waters when you’ve built more capacity and experience. Regards, Graeme -------------------- Graeme Bunton Director, DNS Abuse Institute 647-702-3323 https://dnsabuseinstitute.org/ From: anti-abuse-wg <anti-abuse-wg-bounces(a)ripe.net> on behalf of anti-abuse-wg-request(a)ripe.net <anti-abuse-wg-request(a)ripe.net> Date: Friday, February 11, 2022 at 05:15 To: anti-abuse-wg(a)ripe.net <anti-abuse-wg(a)ripe.net> Subject: [EXTERNAL] anti-abuse-wg Digest, Vol 122, Issue 8 CAUTION: This email came from outside your organization. Don’t trust emails, links, or attachments from senders that seem suspicious or you are not expecting. Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://lists.ripe.net/mailman/listinfo/anti-abuse-wg<https://lists.ripe.net/mailman/listinfo/anti-abuse-wg> or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Re: RIPE NCC Anti-Abuse Training: Next Steps & WG Input! (Laura Atkins) ---------------------------------------------------------------------- Message: 1 Date: Fri, 11 Feb 2022 10:14:49 +0000 From: Laura Atkins <laura(a)wordtothewise.com> To: Brian Nisbet <brian.nisbet(a)heanet.ie> Cc: "anti-abuse-wg(a)ripe.net" <anti-abuse-wg(a)ripe.net> Subject: Re: [anti-abuse-wg] RIPE NCC Anti-Abuse Training: Next Steps & WG Input! Message-ID: <05B5A3CD-D424-41C8-877C-B7A6F3BE9A5F(a)wordtothewise.com> Content-Type: text/plain; charset="utf-8" I?m going to try and make the call, but one thing that strikes me as important for any abuse training process is to call out different kinds of abuse online. There are things that are abuse of the internet. Abuse that harms the ability of the internet to work or for people to use the internet. Things like dDoS and spam and even phishing, mailbombing, etc. They are problems that affect a lot of people. Often we can use raw numbers of reports or complaints or traffic mapping to identify these kinds of abuses. We can usually point to objective measures and justify taking actions based on those objective measurements. They harm us collectively as a community and an infrastructure. There are those things that are abuse on the internet. This is people using internet services to harm individuals. Harassment and stalking and doxxing are examples of this. These are problems that are targeted at individuals. We can?t use raw numbers of reports or complaints or traffic mapping to identify these kinds of abuses. They are targeted at usually vulnerable or marginal individuals (or sometimes communities). In this case we don?t get the raw numbers of complaints, there?s not an objective measurement of harm. Taking action requires much more judgement on the part of the network owner. Then there are things I?ve not figured out a category for. Is it abuse to spread disinformation and propaganda campaigns? Is it abuse to sell snake oil and fear based on lies and propaganda? Is it abuse to organize a insurrectionist attack on a platform? Does the network owner have an obligation to shut down traffic? How do we tell the difference between good uprisings (Arab Spring) and bad uprisings? What do we do about Nazi and white supremacist websites that allow for actual scholarly and critical discussion of them? I certainly don?t have the answers. I think one of the learning goals should be to understand the scope and breadth of online abuse. Also making it clear what kinds of things operators must take action against and what responsibilities they have to the infrastructure and to individuals. We?re not law enforcement, but law enforcement hasn?t kept up with a lot of the abuse taking place on the internet. I think that is worthy of discussion. laura > On 10 Feb 2022, at 09:25, Brian Nisbet <brian.nisbet(a)heanet.ie> wrote: > > Colleagues, > > Since we last spoke about the proposed training the NCC have been working with various community members to put a draft syllabus in place for further discussion. > > This is a link to the feedback document for this draft: > > https://docs.google.com/document/d/1M9Wrqu-VKGGwMfJQGK0NlTs5UzH6xJ2_HR2MkTB…<https://docs.google.com/document/d/1M9Wrqu-VKGGwMfJQGK0NlTs5UzH6xJ2_HR2MkTB…> <https://docs.google.com/document/d/1M9Wrqu-VKGGwMfJQGK0NlTs5UzH6xJ2_HR2MkTB…<https://docs.google.com/document/d/1M9Wrqu-VKGGwMfJQGK0NlTs5UzH6xJ2_HR2MkTB…>> > > What the NCC and the Co-Chairs would love is if everybody could just comment what they think they understand from the learning goals as they?re written and suggest any changes or additions and obviously ask any questions. We?d also like the feedback on the webinar flow design. > > It?s important for everybody to understand that the learning objectives are the basis for the training. These are the skills that the learner must acquire. With these skills we also expect a change of attitude towards abuse handling (which is we think the purpose of this training). > > While discussion on the list is welcomed and encouraged, we've also planned a Zoom session for any interested parties to discuss this further. This will take place on Wednesday 23rd February at 14:00 CET: > > https://ripe.zoom.us/j/8221791822?pwd=ZFY0MnNQeWJsTkhQSFlyeEZlUkNJQT09<https://ripe.zoom.us/j/8221791822?pwd=ZFY0MnNQeWJsTkhQSFlyeEZlUkNJQT09> <https://ripe.zoom.us/j/8221791822?pwd=ZFY0MnNQeWJsTkhQSFlyeEZlUkNJQT09<https://ripe.zoom.us/j/8221791822?pwd=ZFY0MnNQeWJsTkhQSFlyeEZlUkNJQT09>> > > Meeting ID: 822 179 1822 > Passcode: 1277 > > Hopefully with discussion on list and at the session on the 23rd we can move this into a final draft and progress from there. > > Thanks, > > Brian > Co-Chair, RIPE AA-WG > > Brian Nisbet (he/him) > Service Operations Manager > HEAnet CLG, Ireland's National Education and Research Network > 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland > +35316609040 brian.nisbet(a)heanet.ie <mailto:brian.nisbet@heanet.ie> www.heanet.ie <http://www.heanet.ie/<http://www.heanet.ie>> > Registered in Ireland, No. 275301. CRA No. 20036270 > -- > > To unsubscribe from this mailing list, get a password reminder, or change your subscription options, please visit: https://lists.ripe.net/mailman/listinfo/anti-abuse-wg<https://lists.ripe.net/mailman/listinfo/anti-abuse-wg> <https://lists.ripe.net/mailman/listinfo/anti-abuse-wg<https://lists.ripe.net/mailman/listinfo/anti-abuse-wg>> -- The Delivery Experts Laura Atkins Word to the Wise laura(a)wordtothewise.com Email Delivery Blog: http://wordtothewise.com/blog<http://wordtothewise.com/blog>

1 0

Fwd: RIPE NCC Anti-Abuse Training: Next Steps & WG Input!
by Alex de Joode 10 Feb '22

10 Feb '22

There are many things to consider (some semi random topics to consider). * what do you consider abuse? * only technical abuse (portscanes, spam, brute force attacks etc) * or also 'content abuses' (doxxing, hate speech, csam etc) * what about harmful content, will that be considered abuse * what about unwanted content? * how does this all relate to freedom of expression? * what rights do your customers have * to what extent are you willing to act as the sheriff ? * there should be a dedicated working address for receiving abuse notices/complaints. (we have that covered for the most part) * do you issue a ticket number as a reference? * how can a complainer escalate? * making a abuse complaint should be made as easy as possible * however, (for streamlinening puposes) a webform, or registration in a support system should be acceptable (some complainers are really stupid) * if a complaint does not include the minimal information to assess the validity, a request for more information could be sent, while the original complaint is closed * every company is different, has different policies, procedures and customers, educating frequent complainers is needed to ensure to most efficient way of dealing with abuse. * you have to make a decision about the information you forward to your client so they are able to resolve the issue * full message, always? only to reseller? also to enduser? * does a complainer have a reasonable expectation of privacy? * is this different for the automated copyright abuse sending mills? * what if the 'proof' of an abuse, would reviel the means? (ie spamtrap address) * how much proof do you need to forward this as an issue to your client? * you should have a process to contact the customer * directly by the abuse desk, * via sales (so they know their client generates 'issues') * you should have a process to restrict or limit usage of resources * directly by the abuse desk, * via networking > > * > * Abuse handling is not the same as support handling. Abuse reporters don't want help, they expect that it is in your own interest as a network operator to curb abuse originating from your network, and their reports are intended to help you reach that goal. This results in some Don'ts (I'm seeing all of these in reponse to abuse reports): * don't reject their messages because they are not your customers, > * don't require them to register with some support system, > * don't send meaningless auto-replies, > * don't try to teach them (unless they are really doing something wrong). * Although there may be conflicts with protecting your user's privacy, reporters really appreciate to know whether their reports have a meaningful effect as they sometimes spend considerable amounts of time. Positive feedback ("we've terminated that customer", or "we've worked with the customer to fix their exploitable software/account") is a huge encouragement to continue reporting abuse. If there is no detectable reaction (either in form of an answer or an observable stop of abuse) then an abuse reporter might determine that blocking your network is a more effective use of their time. * Many types of abuse originating from your network are signs of substandard security and warnings of possibly more damaging future exploits. Work proactively with your customers when you find systemic problems. For example, on one of the services that I look after, we had one or two mail account password compromises which led to spam bursts. We established a strict password policy, checking the password database for easily breakable passwords, and contacting all users with weak passwords so they changed them to secure passwords. Similarly, we proactively check customer's websites for exploitable plugins. What kinds of proactive abuse prevention works in your case might be vastly different, but not doing anything is gross negligence. * Abuse desk workers need authority to contact customers and to restrict their use of your resources. One basic prerequisite for contacting customers is that you know them. If your operation does not establish appropriate KYC rules you're bound to be an attractive provider for abusers. Of course, the amount of info you need for an e-mail account and for renting out a server are different, and you may be limited by privacy laws, but if you simply refuse to take responsibility while not disclosing information on who *is* actually responsible you're in for blocking. Cheers, > Hans-Martin >

1 0

Fwd: [dns-wg] EU: DNS abuse study
by Markus de Brün 10 Feb '22

10 Feb '22

For those who are not following the DNS wg list: The European Commission has published a quite comprehensive study on DNS abuse. (One could also call it enormous.) It study itself be found here: https://op.europa.eu/en/publication-detail/-/publication/7d16c267-7f1f-11ec… There is an additional document containing the appendix: https://op.europa.eu/en/publication-detail/-/publication/d9804355-7f22-11ec… -- Markus de Brün -------- Forwarded Message -------- Subject: Re: [dns-wg] EU: DNS abuse study Date: Fri, 4 Feb 2022 10:52:53 +0100 From: Petr Špaček <pspacek(a)isc.org> To: dns-wg(a)ripe.net On 01. 02. 22 9:32, Hank Nussbacher wrote: > The EU has published is 173 page opus on DNS abuse: > > https://op.europa.eu/en/publication-detail/-/publication/7d16c267-7f1f-11ec… I have had a peak when waiting for other things to happen and it might be interesting read. Here is a gist from chapter Executive summary: The study adopts the following definition of DNS abuse: Domain Name System (DNS) abuse is any activity that makes use of domain names or the DNS protocol to carry out harmful or illegal activity. The main findings of the measurements are: a) In relative terms, new generic Top-Level Domains (new gTLDs), with an estimated market share of 6.6%, are the most abused group of TLDs (Appendix 1 – Technical Report, Section 5, p. 26). b) Not all new gTLDs suffer from DNS abuse to the same extent. The two most abused new gTLDs combined account for 41% of all abused new gTLD names (Appendix 1 – Technical Report, Section 9.2, p. 32). c) European Union country code TLDs (EU ccTLDs) are by far the least abused in absolute terms and relative to their overall market share (Appendix 1 – Technical Report, Section 5, p. 26). d) The vast majority of spam and botnet command-and-control domain names are maliciously registered (Appendix 1 – Technical Report, Section 10.3, p. 41). e) About 25% of phishing domain names and 41% of malware distribution domain names are presumably registered by legitimate users, but compromised at the hosting level (Appendix 1 – Technical Report, Section 10.3, p. 41). f) The top five most abused registrars account for 48% of all maliciously registered domain names (Appendix 1 – Technical Report, Section 11.2, pp. 43-44). g) Hosting providers with disproportionate concentrations of spam domains reach 3,000 abused domains per 10,000 registered domain names (Appendix 1 – Technical Report, Section 12.3, pp. 48-49). h) The overall level of DNS security extensions (DNSSEC) adoption remains low. (Appendix 1 – Technical Report, Section 15.3, pp. 62-63). i) There are 2.5 million open DNS resolvers worldwide that can be effectively used as amplifiers in distributed denial-of-service attacks (Appendix 1 – Technical Report, Section 16.4, p. 70). The numbers above sound interesting. -- Petr Špaček -- To unsubscribe from this mailing list, get a password reminder, or change your subscription options, please visit: https://lists.ripe.net/mailman/listinfo/dns-wg

6 5