<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:494686910;
mso-list-template-ids:50506016;}
@list l0:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:36.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level2
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:72.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:108.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:144.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level5
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:180.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:216.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:252.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level8
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:288.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:324.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l1
{mso-list-id:525993781;
mso-list-template-ids:2122582526;}
@list l1:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:36.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l1:level2
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:72.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l1:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:108.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l1:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:144.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l1:level5
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:180.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l1:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:216.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l1:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:252.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l1:level8
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:288.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l1:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:324.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l2
{mso-list-id:564800178;
mso-list-template-ids:2013027754;}
@list l2:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:36.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l2:level2
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:72.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l2:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:108.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l2:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:144.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l2:level5
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:180.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l2:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:216.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l2:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:252.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l2:level8
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:288.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l2:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:324.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l3
{mso-list-id:642538586;
mso-list-template-ids:-2065535156;}
@list l3:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:36.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l3:level2
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:72.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l3:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:108.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l3:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:144.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l3:level5
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:180.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l3:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:216.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l3:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:252.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l3:level8
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:288.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l3:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:324.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l4
{mso-list-id:1207379017;
mso-list-template-ids:-1980215008;}
@list l4:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:36.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l4:level2
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:72.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l4:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:108.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l4:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:144.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l4:level5
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:180.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l4:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:216.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l4:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:252.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l4:level8
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:288.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l4:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:324.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l5
{mso-list-id:1376543405;
mso-list-template-ids:-1747394490;}
@list l5:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:36.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l5:level2
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:72.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l5:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:108.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l5:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:144.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l5:level5
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:180.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l5:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:216.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l5:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:252.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l5:level8
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:288.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l5:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:324.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
ol
{margin-bottom:0cm;}
ul
{margin-bottom:0cm;}
--></style>
</head>
<body lang="en-JO" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal" style="text-align:justify"><span lang="EN-US" style="font-size:11.0pt">Friends and Colleagues,<o:p></o:p></span></p>
<p class="MsoNormal" style="text-align:justify"><span lang="EN-US" style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal" style="text-align:justify"><span lang="EN-US" style="font-size:11.0pt">ICANN’s Security, Stability, and Resiliency Team (SSR) are doing a commendable job on domain names registered around the COVID-19 pandemic for abusive/misused purposes.<o:p></o:p></span></p>
<p class="MsoNormal" style="text-align:justify"><span lang="EN-US" style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal" style="text-align:justify"><span lang="EN-US" style="font-size:11.0pt">You can learn about these efforts in the following piece >>
<a href="https://go.icann.org/2A2RDiY">https://go.icann.org/2A2RDiY</a>.<o:p></o:p></span></p>
<p class="MsoNormal" style="text-align:justify"><span lang="EN-US" style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal" style="text-align:justify"><span lang="EN-US" style="font-size:11.0pt">Thank you,<o:p></o:p></span></p>
<p class="MsoNormal" style="text-align:justify"><span lang="EN-US" style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal" style="text-align:justify"><b><span lang="EN-US" style="font-size:11.0pt">Fahd Batayneh<o:p></o:p></span></b></p>
<p class="MsoNormal" style="text-align:justify"><span lang="EN-US" style="font-size:11.0pt">ICANN<o:p></o:p></span></p>
<div style="border:none;border-bottom:solid windowtext 1.5pt;padding:0cm 0cm 1.0pt 0cm">
<p class="MsoNormal" style="text-align:justify"><span lang="EN-US" style="font-size:11.0pt"><o:p> </o:p></span></p>
</div>
<p class="MsoNormal" style="text-align:justify"><span lang="EN-US" style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal" style="text-align:justify"><b>Introduction<o:p></o:p></b></p>
<p class="MsoNormal" style="text-align:justify"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal" style="text-align:justify"><span style="font-size:11.0pt">Any significant event attracts a number of interested parties. Both offline and online, some parties will have good intentions and, unfortunately, others will not. During newsworthy
events in particular, domain registrations containing terms related to those events inevitably increase.<o:p></o:p></span></p>
<p class="MsoNormal" style="text-align:justify"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal" style="text-align:justify"><span style="font-size:11.0pt">The global COVID-19 pandemic is no different. We see people registering sites to raise money or provide help to those affected either directly or indirectly. We also see people creating
domains that use the pandemic as a hook to gain traffic and draw victims in, subjecting end users to phishing, malware, and scams.<o:p></o:p></span></p>
<p class="MsoNormal" style="text-align:justify"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal" style="text-align:justify"><span style="font-size:11.0pt">In response to the latter, a number of groups are creating and making available "threat intelligence," that is, information and data on reported or observed security threats related
to these domains. Some groups, like the <a href="https://cti-league.com/">COVID-19 Cyber Threat Intelligence League</a> and the <a href="https://www.cyberthreatcoalition.org/">COVID-19 Cyber Threat Coalition</a>, are taking action to counter these malicious
actors.<o:p></o:p></span></p>
<p class="MsoNormal" style="text-align:justify"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal" style="text-align:justify"><span style="font-size:11.0pt">ICANN organization (org) is contributing to this COVID-19 anti-abuse effort, using our knowledge and expertise to put actionable intelligence into the hands of those able to disrupt
malicious campaigns. We are filtering lists created from zone files and enriching them with data from external sources to identify domain names that may be malicious from the majority that are not. However, we must be careful not to add more noise to those
already swamped with information. In other words, while we aim to provide data that allows a rapid assessment of a domain's status, we also need a high level of confidence in that assessment. Without both of these, we may end up doing more harm than good.<o:p></o:p></span></p>
<p class="MsoNormal" style="text-align:justify"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal" style="text-align:justify"><span style="font-size:11.0pt">We are now producing reports on recent domain registrations that we believe to be using the COVID-19 pandemic for phishing or malware campaigns. These reports, which are shared with
the responsible parties (primarily registrars or registries), contain the evidence that leads ICANN org to believe the domains are being used maliciously, along with other background information to help the responsible parties determine the correct course
of action.<o:p></o:p></span></p>
<p class="MsoNormal" style="text-align:justify"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal" style="text-align:justify"><b>Process Detail<o:p></o:p></b></p>
<p class="MsoNormal" style="text-align:justify"><b><span style="font-size:11.0pt"><o:p> </o:p></span></b></p>
<p class="MsoNormal" style="text-align:justify"><span style="font-size:11.0pt">To generate the reports, we examine available generic top-level domain (gTLD) zone files. These files allow us to see newly delegated registrations (although our report generation
process can actually receive input from any source of domains or hostnames). Specifically, we look for new zone file entries that contain words like "COVID," "corona," "pandemic," and other related terms. The resulting list of domain names is not yet actionable,
as it will include both benign and malicious domains. We need to further refine the list before we would have high confidence in the contents.<o:p></o:p></span></p>
<p class="MsoNormal" style="text-align:justify"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal" style="text-align:justify"><span style="font-size:11.0pt">The next step is to look across a number of threat intelligence sources for indications of the domain being used for phishing or malware distribution. We start by using Virus Total,
AlienVault OTX, Phishtank, and Google Safe Browsing; however, our report generation process is designed to be extensible so threat intelligence sources can be added or removed. The data provided by these sources can suggest a domain is malicious, although
in most cases we find little to no evidence. Lack of evidence can be ascribed to:<o:p></o:p></span></p>
<p class="MsoNormal" style="text-align:justify"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<ul style="margin-top:0cm" type="disc">
<li class="MsoNormal" style="text-align:justify;mso-list:l3 level1 lfo3"><span style="font-size:11.0pt">Many of the domains we see are "parked," e.g., registered with the intent to sell at a profit or generate revenue via advertising.<o:p></o:p></span></li><li class="MsoNormal" style="text-align:justify;mso-list:l3 level1 lfo3"><span style="font-size:11.0pt">Others are young domains that have not yet been used maliciously or the behavior has not yet been observed.<o:p></o:p></span></li></ul>
<p class="MsoNormal" style="text-align:justify"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal" style="text-align:justify"><span style="font-size:11.0pt">Therefore, it is possible that over time the reputation of a domain will change. In order to allow for this, we periodically retest domains.<o:p></o:p></span></p>
<p class="MsoNormal" style="text-align:justify"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal" style="text-align:justify"><span style="font-size:11.0pt">It is worth noting that the sources we use focus on malware and phishing, so the malicious activity that we see is largely within these two categories. We do also pick up domains
involved in spam or other undesirable behaviors. In order for us to consider those domains, they must also be listed in the malware or phishing sources. It is not uncommon for domains to exist in multiple categories, because different collection methods employed
by threat intelligence providers detect different aspects of a malicious campaign. Also, categorization is not an exact science and can be open to interpretation. Therefore, when we use the term "malicious" here we are referring to phishing or malware; however,
that does not preclude a domain from appearing on a spam or other undesirable behavior list.<o:p></o:p></span></p>
<p class="MsoNormal" style="text-align:justify"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal" style="text-align:justify"><span style="font-size:11.0pt">When credible evidence of malicious activity is found, we proceed to gather more information about the domains in line with the reporting requirements specified by registrars in
the <a href="https://rrsg.org/wp-content/uploads/2020/03/Guide-to-Registrar-Abuse-Reporting-v1.8.pdf">Guide to Registrar Abuse Reporting</a>. This reporting information includes the registrar (and abuse contact in particular), hosting information, etc. This
information is gathered to help those receiving our reports make the decision on whether or not to take action (such as suspension) against the domain. The report generation process as described can be summarized in the following flowchart:<o:p></o:p></span></p>
<p class="MsoNormal" style="text-align:justify"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal" align="center" style="text-align:center"><span style="font-size:11.0pt"><img border="0" width="974" height="731" style="width:10.1458in;height:7.6145in" id="Picture_x0020_1" src="cid:image001.png@01D6232C.96E48460" alt="Reporting Potential Pandemic-Related Domains Flowchart"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-align:justify"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal" style="text-align:justify"><span style="font-size:11.0pt">The output of this process is gathered into two different formats:<o:p></o:p></span></p>
<p class="MsoNormal" style="text-align:justify"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<ul style="margin-top:0cm" type="disc">
<li class="MsoNormal" style="text-align:justify;mso-list:l1 level1 lfo6"><span style="font-size:11.0pt">Comma Separated Values (CSV) summary which contains the name, resolved IP, and name server records plus the basic score from each threat intelligence source
and a total.<o:p></o:p></span></li><li class="MsoNormal" style="text-align:justify;mso-list:l1 level1 lfo6"><span style="font-size:11.0pt">Markdown file per domain that contains more detail about that domain, including links to external evidence when available and appropriate.<o:p></o:p></span></li></ul>
<p class="MsoNormal" style="text-align:justify"><b><span style="font-size:11.0pt"><o:p> </o:p></span></b></p>
<p class="MsoNormal" style="text-align:justify"><b>Statistics<o:p></o:p></b></p>
<p class="MsoNormal" style="text-align:justify"><b><span style="font-size:11.0pt"><o:p> </o:p></span></b></p>
<p class="MsoNormal" style="text-align:justify"><span style="font-size:11.0pt">Since we began this effort at the end of March, we have seen an average of approximately 3,250 new domain names per day that match our search terms. This has resulted, at the time
of writing, in more than 82,000 names. Of these, we have found evidence to link approximately 7,000 names to malicious behavior and have been able to resolve the domains (<i>e.g.,</i> the domain names had not already been suspended). For any given day, the
number of domains that have threat intelligence associated with them increases simply because there has been more opportunity for the behavior associated with the domains to be observed. As such, the proportion of older domain names with reports will be higher
than younger domains. On the flip side, the malicious domains are starting to be noticed and suspended.<o:p></o:p></span></p>
<p class="MsoNormal" style="text-align:justify"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal" style="text-align:justify"><span style="font-size:11.0pt">You may notice that the numbers shared about are lower than other public reports. There are two primary reasons for this:<o:p></o:p></span></p>
<p class="MsoNormal" style="text-align:justify"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<ul style="margin-top:0cm" type="disc">
<li class="MsoNormal" style="text-align:justify;mso-list:l4 level1 lfo9"><span style="font-size:11.0pt">We start with sources that contain domain names found in zone files only. We are not feeding in lists of full hosts seen in passive DNS sources or some other
equivalent starting point.<o:p></o:p></span></li><li class="MsoNormal" style="text-align:justify;mso-list:l4 level1 lfo9"><span style="font-size:11.0pt">We only list domains that have sufficient evidence of malicious activity and still resolve.<o:p></o:p></span></li></ul>
<p class="MsoNormal" style="text-align:justify"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal" style="text-align:justify"><span style="font-size:11.0pt">Our approach rules out domains that have been bought by speculators and parked. While blocking access to these domains may not be disruptive to an end user, we could not confidently
claim that these domains are malicious.<o:p></o:p></span></p>
<p class="MsoNormal" style="text-align:justify"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal" style="text-align:justify"><b>Summary<o:p></o:p></b></p>
<p class="MsoNormal" style="text-align:justify"><b><span style="font-size:11.0pt"><o:p> </o:p></span></b></p>
<p class="MsoNormal" style="text-align:justify"><span style="font-size:11.0pt">It is a sad fact of life that there will always be malicious actors willing to turn any situation, even a pandemic, to their advantage. Our response to the misuse of domain names
has been to put the evidence of which domains we believe to be malicious into the hands of those best placed to take appropriate action. We also believe that the bar to providing this evidence must be high enough so we do not contribute more noise than signal.
The report generation process we've implemented goes to significant effort to avoid false positives. We look forward to working with our community and others to improve our processes.<o:p></o:p></span></p>
<p class="MsoNormal" style="text-align:justify"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
</div>
</body>
</html>