Anti-abuse activities do work

Malware distribution down in 2023

One of the most notable things to come out of the report is a huge drop in malware distribution and malicious websites between the end of 2022 and the end of 2023. The Institute offers no explanation for its observation, but the decline coincided with Tokelau's .tk domain ending its free registration policy. Free .tk domains were very attractive to malicious actors, leading Facebook's parent company Meta to announce that it was starting legal proceedings against the registry in early 2023. Later that year, ICANN also withdrew accreditation from the associated registrar. The story of the .tk domain therefore suggests that anti-abuse initiatives do work. However, the case isn't entirely proven, because the DNS Abuse Institute's published data for 2023 isn't broken down by domain.

Fewer malicious registrations, more hacking

Unfortunately, the observed decline doesn't imply the end of malware distribution or phishing around the world. Denied an easy way to register domain names for themselves, internet crooks are increasingly turning to the use of hacked or 'compromised' domains. At the end of 2022, 50 per cent of all phishing and malware sites were hacked, while today the figure is 80 per cent. So it's never been more important for domain name registrants to be on their guard and take website security seriously.

Most registrars respond to abuse reports within 24 hours

The registrar that manages a domain name's registration has an important role to play in that context. The Anti-Abuse Institute's latest report shows that 40 per cent of registrars take down phishing material and malware inside 24 hours. Regrettably, however, a substantial minority –25 per cent – take more than 7 days to respond. Plenty long enough for a cybercriminal to cause considerable harm. Most of those who drag their heels are based in Asia. However, sharp contrasts can often be observed between registrars that belong to the same group. For example, Ali Baba's Chinese operation Cloudcomputing is one of the most secure providers, while Ali Baba Singapore appears to be one of the least secure: 3 per cent of its gTLD registrations are regarded as malicious.

.nl is one of the world's most secure country-code domains

Turning to the statistics for country-code domains, the report confirms .nl as one of the most secure domains anywhere. Only 0.5 domain names per 100,000 registrations are considered malicious. That figure puts .nl amongst the global leaders, along with Belgium's .be, Canada's .ca and Switzerland's .ch. In the ccTLD rankings, it's again the Asian domains that stand out as the least secure. Pakistan's .pk and Indonesia's .id have 30 to 50 malicious domain names per 100,000 registrations. Within Europe, Poland's .pl has the worst record, with 20 malicious domain names per 100,000 registrations.

Table 11: Larger ccTLDs in ascending order of lowest observed maliciously registered domains per 100,00 DUM for 2023-11

Inclusion criteria:

• Observed Maliciously Registered Domains: More than 5 per month

• Observed DUM: Equal to or more than 1 million

Want to know more?

The DNS Abuse Institute's reports are available to the public at https://dnsabuseinstitute.org/dnsai-compass/.

Looking for advice on securing your website? Visit https://internet.nl.