Subject: Re: [Asrg] Assume perfect knowledge by domain registry provisioners, so what?

From: Yakov Shafranovich <[email-masked]>
Date: Fri, 09 May 2003 18:07:52 -0400

>From: Vernon Schryver <[email-masked]>
>
> > From: David Walker <[email-masked]>
>
> > ...
> > I can't imagine a scenario where a registry provider would be concerned 
> about
> > spam as a part of providing registry services.  A registry doesn't gain or
> > lose because a registered domain is used for spam and they don't have any
> > dutues in overseeing how a domain is used.
>
>Some registrars have asserted that they will cancel registrations of
>domains for spamming.  Some have even followed through.  For example,
>Domains by Proxy has been zapping spammers using its anonymizing
>registration service.  The operators of .BZ have recently shocked the
>world by terminating a spammer on the pretex of a bad contact address.
>There are others who get less attention because they are not popular
>among spammers.

I remember reading on ICANN's website that registrars can cancel a domain 
name registration if it has false WHOIS info. This doesn't apply to ccTLDs, 
onlg to gTLDs since gTLDs operators have signed contractors with ICANN that 
have thise provisions.

---------------------------------------------------------------------------------------------------
Yakov Shafranovich / <[email-masked]>
SolidMatrix Research, a division of SolidMatrix Technologies, Inc.
---------------------------------------------------------------------------------------------------
"One who watches the wind will never sow, and one who keeps his eyes on
the clouds will never reap" (Ecclesiastes 11:4)
---------------------------------------------------------------------------------------------------  

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Yakov Shafranovich <[email-masked]>
Date: Fri, 09 May 2003 19:18:44 -0500

Eric Brunner-Williams in Portland Maine wrote:

> To: Yakov Shafranovich <[email-masked]>
> Subject: Re: Fwd: Re: [Asrg] Assume perfect knowledge by domain 
> registry provisioners, so what?
> Date: Fri, 09 May 2003 18:52:40 -0400
> From: Eric Brunner-Williams in Portland Maine <[email-masked]>
> 
>> Some mentioned earlier that it would be impossible to require registrars to
>> verify international contact information. The least they can do is send a
>> physical letter with some random token, a fax with the same, a email with a
>> token and a real life phone call. These four steps can verify physical
>> address, physical phone #, physical fax # and email address. Unless the
>> registrant lives in some place where the mail or phone systems don't work,
>> this will do fine (its unlikely, if they have Internet, they have those
>> other things too). However, like I mentioned in an earlier reply, the
>> overall problem is that of network users using network resources.
> 
> You have $3. Use it wisely. Your shareholders want positive, not negative,
> pennies on each transaction.
> 
> There is a reason why we (registrar hat on) just rejected this proposal
> in some other venue. No one could afford the staff to lick the stamps,
> assuming that one could afford the stamps.
Point taken, that is valid reason.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Yakov Shafranovich <[email-masked]>
Date: Sat, 10 May 2003 23:23:28 -0400

>From: Kee Hinckley <[email-masked]>
>
>At 11:09 PM -0400 5/8/03, Yakov Shafranovich wrote:
>>Would registering more junk domains mean that the spammer will be 
>>spending more money on sending spam? Wouldn't eventually that create a 
>>big enough expense for the spammer which would be comparable with the 
>>cost of postage for sending a regular letter? That would lead to higher 
>>cost of sending spam thus
>
>Given that some spammers already work this way, I would say not. Assuming 
>that you post several million (at least) messages per domain, and domains 
>cost about $10, I don't think it qualifies as a significant expense.

What I am wondering if it is possible to work out a formula and figure out 
at what point does the spammer become unprofitable (messages sent per 
domain vs. the domain price). This piece of information will not help by 
itself, but can contribute to the overall solution

>>Also, if the ICANN rule about having correct WHOIS information would 
>>actually be enforced with some kind of fines or penalties, wouldn't that 
>>force the registrars to have better ID procedures on who actually 
>>registers domain names thus reducing the overall number of junk domains? 
>>This is part of the overall
>
>The question is (as with any identification system), what would you do 
>with the information?  Would you block based on physical address? And is 
>it really possible for a registrar to validate an address when it comes 
>from another part of the world?
>
>There are also some practical considerations.  Unfortunately you can't do 
>a whois query on every incoming domain.  The registrars have some limit on 
>the number and type of automated queries you can do from a single IP 
>address (in part to keep out spammers, but there are also general 
>scalability issues).  You could try round-robinning your requests, but it 
>turns out the different registrars return different formats.  The only 
>real solution is to purchase the entire database and do periodic downloads 
>(Network Solutions supposedly sells it--although they never responded to 
>our queries--but other registrars do).  So while it's a good solution for 
>a spam filtering service, it's not really useful as a generic tool.

As someone has mentioned before, the WHOIS data is more useful for tracking 
spammers than spam. Thus, there is still a reason to have this data valid 
or at the least to allow registrars to be able to cancel a registration for 
having false contact information.

---

From: Yakov Shafranovich <[email-masked]>
Date: Sat, 10 May 2003 23:29:19 -0400

>To: "Alan DeKok"  <[email-masked]>
>
> > Yakov Shafranovich <[email-masked]> wrote:
> > > I would suggest in general that the working group should recommend to
> > > ICANN a stricter enforcement of the WHOIS rules
> >
> >
> >   I support this proposal.
> >
> >   Does anyone have time to write a proposal for BCP, to fight spam
> > by better applying existing network policy?
> >
> >   Alan DeKok.
>
>I'm sure this has been done a few times... in "local" forms
>there's
>http://www.ripe.net/ripe/docs/ripe-206.html
>for instance.
>
>Of course this is aimed at ISPs.

What I meant is more of a recommendation to ICANN directly. However the 
problem with overall "recommendations", "policies", and such and making 
sure that they are actually enforced, and I am not sure who much impact 
would a direct recommendation to ICANN, a BCP or a RFC would make. As 
someone pointed out, if the RFC821 recommendations are not enforced, how 
can we make sure that anything else is. Plus as I mentioned in a different 
message, we need to draw a balance as to how much is actually required from 
the registrars. At the minimum the registrars should be revoke or seize 
domains that have false contact information which does not put as much 
strain on them, as verifying manually every single registration would. 
Additionally, perhaps a registrar should be able to do the same for any 
domain used for spam (this can be accomplished via terms of agreement or 
change in the overall ICANN policy). However, this would mean giving 
stronger power to the registrars and as the famous quote goes "power corrupts".

I think its a bit premature to actually go ahead and make such 
recommendation, but we can definitely think of a proposal.

Yakob