Malicious domain name use very low in .nl
New report by DNS Abuse Institute documents malpractice at the TLD level
Founded in 2021 by PIR, the organisation behind the .org domain, the DNS Abuse Institute publishes statistics on malicious use of the Domain Name System (DNS) and domain names. PIR introduced its monthly abuse report last year, and has now started breaking down the reported data according to domain name extension. With just 0.4 malicious registrations per 100,000 domain names, our national internet domain .nl stands out as having less abuse than any other large country-code domain. Compiled by Maciej Korczynski of Grenoble Alps University, who is also an SIDN Labs research partner, the report makes interesting reading on a variety of levels.
DNS Abuse Institute
The DNS Abuse Institute (DNSAI) was set up in 2021 by the Public Interest Registry (PIR), the organisation that runs various top-level domains, including .org. The DNSAI is a non-profit organisation dedicated to investigating abuse of the DNS, in support of efforts to prevent malpractice. It publishes a monthly report called the DNSAI Compass, tracking patterns of DNS abuse around the world. The Institute defines DNS abuse as use of the DNS or domain names for malware, botnets, phishing, pharming or spam.
Methodology
Within that broad sweep, the report focuses particularly on the deliberate registration of domain names for the malicious purposes of phishing and malware distribution. The researchers compile an inventory of the domain names involved, and the associated registrars and extensions, by combining multiple lists produced by anti-phishing organisations. The result is a global overview of phishing and malware distribution. It's worth noting that the researchers acknowledge that their source data may include some false positive detections.
Results for .nl
The .nl domain comes out of the survey extremely well. Amongst major country-code domains, .nl has the lowest rate of deliberately malicious registrations for malware and phishing. Looking at the period October to March, the researchers say that .nl had an average of less than 1 malicious registration per 250,000 domain names per month. That figure makes our country-code domain slightly better than the next two low-abuse ccTLDs, those for Canada and Belgium. By way of comparison: the country-code domains with the most abuse had 1 to 5 malicious registrations per 10,000 domain names.
Table 1: the best scoring country-code domains in the DNSAI Compass (fewest deliberate malicious registrations for phishing and malware distribution per month (source: DNSAI Compass, June 2023).
Position | TLD | Number of malicious registrations per 100,000 domain names | Total number of domain names under TLD |
|---|---|---|---|
1 | .nl | 0.40 | 6,019,363 |
2 | .ca | 0.46 | 3,247,883 |
3 | .be | 0.48 | 1,658,288 |
4 | .de | 0.52 | 16,489,946 |
5 | .es | 0.66 | 1,984,381 |
6 | .jp | 0.66 | 1,657,441 |
7 | .kr | 0.69 | 1,009,679 |
8 | .uk | 0.76 | 10,506,877 |
9 | .it | 0.79 | 3,158,357 |
10 | .ga | 0.79 | 8,944,624 |
Investment in DNS security is paying off
It's no surprise that .nl scored well in the survey. Previous studies by McAfee, Scamadviser, the Anti Phishing Working Group (APWG) and others drew similar conclusions about the Dutch domain. Down the years, we and the .nl registrars have invested heavily in optimising DNS security. We've also put process-based measures in place to facilitate the identification of malicious registrations. And SIDN Labs has become a leading centre for research into DNS abuse. As SIDN Labs Director Cristian Hesselman explains, "Preventing domain name-based abuse is, and always will be, a game of cat-and-mouse. Getting the upper hand depends not only on constantly rolling out new detection technologies, such as RegCheck, but also on close collaboration amongst players in the .nl ecosystem, including SIDN, the .nl registrars, the NCSC and universities. The DNSAI report confirms that the .nl community is succeeding with its anti-abuse efforts, and that we provide a secure infrastructure for the Netherlands and the wider internet."
Most insecure domains and registrars are elsewhere
At the TLD level, the least secure domains are mainly new generic extensions and the country-code domains of small states that court registrations globally. The registrars most closely associated with abuse tend to be based in Russia and various Asian countries. When it comes to the abusive domain names themselves, the researchers have opted against publication, since the scans underpinning the report exhibit considerable month-to-month variation, and the researchers wish to avoid causing problems for any legitimate domain or party. The possibility cannot therefore be excluded that some of the parties associated with domain name abuse may be based in the Netherlands.