In this report, we study "bulk registration misuse" by criminal actors. Bulk registrations refers to the practice of rapidly acquiring domain names, using these in an attack, and abandoning them as if they were throw-away ("burner") phones. These domains are a critical resource for cyber criminals.
We use reputation block list (RBL) data to reveal how the use of bulk registrations, coupled with the crippling of registration data access by the ICANN Temp Spec for Whois, presents cybercrime investigators with the dual impediments of harder-to-pursue criminal activity and harder-to-obtain information about the criminals. From our analyses of sample RBL data for five Top-level Domains we:
- Confirm that cyber criminals take advantage of bulk registration services to "weaponize" large numbers of domains for their attacks,
- Identify four specific registrars at which abusive registration activity appears to be concentrated,
profile registrants that misuse bulk registrations to acquire and weaponize thousands of domains, - Confirm that ICANN's Temp Spec policy of redacting Whois point of contact information to comply with the GDPR significantly encumbers and delays cybercrime investigation.
Based on these findings, we recommend that the ICANN organization and community consider several Consensus Policies which, if adopted and incorporated into contracts, would contribute to reducing cybercrime and mitigating its effects on victims.
Read the full report: http://interisle.net/
Dave Piscitello (CAUCE Director at large) ad Dr. Colin Strutt
