Statistical Analysis of DNS Abuse in gTLDs Final Report

Commissioned by the Competition, Consumer Trust, and Consumer Choice Review Team with the support of ICANN, this study is focused on measuring rates of common forms of abusive activities in the domain name system. We conduct a comprehensive study examining malicious behavior in the global DNS and compare abuse rates in new and legacy gTLDs. We combine data sets from many sources, including zone files, domain WHOIS information, data obtained through our active measurements, and 11 reputable blacklists representing malware, phishing, and spam. We find that the new gTLDs have impacted spam counts of the legacy gTLDs: abused domains in the new gTLDs do not increase the number of total malicious registrations but instead, we observe a decrease in the number of malicious registrations in legacy gTLDs. While legacy gTLDs collectively had a spam-domains-per-10,000 rate of 56.9, in the last quarter of 2016, the new gTLDs experienced a rate of 526.6–which is almost one order of magnitude higher. In this study, we also analyze the relationship between the collected security indicators and the structural properties of new gTLDs, and abuse, at the level of gTLDs. The results indicate that abuse counts primarily correlate with stricter registration policies. Our findings suggest that some new gTLDs have become a growing target for malicious actors. While the analysis of spam blacklists reveals that approximately one third of the new gTLDs available for registration did not experience a single incident in the last quarter of 2016, Spamhaus blacklisted at least 10% of all registered domains in 15 new gTLDs.