Subject: [weirds] Domain Reputation in RDAP

From: "Hollenbeck, Scott" <[email-masked]>
Date: Wed, 2 Dec 2015 16:07:35 +0000

Someone recently asked me to read this article and consider if or how RDAP might be helpful in identifying bogus academic journal web sites:

http://news.sciencemag.org/scientific-community/2015/11/feature-how-hijack-journal

The author uses the word "hijack" to describe what's happening with domains (based on the title I thought it would be about bogus transfers), but I read it as more of a problem with two scenarios:

1. A domain expires and is re-registered by someone who does bad things with it.

2. A domain is registered and used to impersonate or appear to function as a "legitimate" journal.

Does anyone see value in adding something to RDAP that could be used as a measure of domain stability or reputation? The article describes how WHOIS data can be used to detect suspicious activity ("If the registration date is recent but the journal has been around for years, that's the first clue."). Might we do something more explicit?

Scott

---

From: Andrew Newton <[email-masked]>
Date: Wed, 2 Dec 2015 11:46:59 -0500

Hmm... that depends. Is the idea to provide meta-data so a reputation
can be determined, or is the idea to actually provide a reputation?

The latter idea is subjective and could be dangerous. But providing
meta-data can be fact based and put reputation in the eye of the
beholder.

It seems like a simple thing to do with existing RDAP would be to
provide a history of registrations and expirations using events. That
way a long held domain changing hands is something an observer can
draw their own conclusions about. Just an idea.

-andy

On Wed, Dec 2, 2015 at 11:07 AM, Hollenbeck, Scott
<[email-masked]> wrote:
> _______________________________________________
> weirds mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/weirds

---

From: "Hollenbeck, Scott" <[email-masked]>
Date: Wed, 2 Dec 2015 17:02:24 +0000

> -----Original Message-----
> From: Andrew Newton [mailto:[email-masked]]
> Sent: Wednesday, December 02, 2015 11:47 AM
> To: Hollenbeck, Scott
> Cc: [email-masked]
> Subject: Re: [weirds] Domain Reputation in RDAP
> 

Indeed, the former sounds more viable than the latter.

> draw their own conclusions about. Just an idea.

It's worth thinking about. It might also be helpful in the context of WHOWAS-ish services.

Scott

---

From: "John Levine" <[email-masked]>
Date: 2 Dec 2015 17:08:51 -0000

>can be determined, or is the idea to actually provide a reputation?

The former, I hope.  The latter would, among other things, make some
heads at ICANN explode.

I agree that historical data such as registration date, or last time
contact info or DNS changed would be useful.

R's,
John

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Tue, 8 Dec 2015 00:34:48 -0800

On Wed, Dec 2, 2015 at 9:08 AM, John Levine <[email-masked]> wrote:

> In article <
> [email-masked]> you
> write:

+1.

-MSK

---

From: Dave Piscitello <[email-masked]>
Date: Tue, 8 Dec 2015 15:12:04 +0000

Could this also be some 'car fax' indicator that discloses whether a domain has been block listed, when, by whom, for reason? While some ICANN heads might explode others might be curious to understand what framework or policy obligation this would imply.

Sent from my iPhone

On Dec 8, 2015, at 03:35, Murray S. Kucherawy <[email-masked]<mailto:[email-masked]>> wrote:

On Wed, Dec 2, 2015 at 9:08 AM, John Levine <[email-masked]<mailto:[email-masked]>> wrote:

+1.

-MSK
_______________________________________________
weirds mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/weirds

---

From: "John R Levine" <[email-masked]>
Date: 8 Dec 2015 11:10:43 -0500

> Could this also be some 'car fax' indicator that discloses whether a 
> domain has been block listed, when, by whom, for reason? While some 
> ICANN heads might explode others might be curious to understand what 
> framework or policy obligation this would imply.

That'd be OK with me but merely deciding which domain blocklists to look 
at is highly political.  Also, I wouldn't assume that the BLs would be 
willing to provide a suitable feed to all the registries.  Some registries 
like .org have a good reputation while some like .xyz do not.

Regards,
John Levine, [email-masked], Taughannock Networks, Trumansburg NY
Please consider the environment before reading this e-mail.

---

From: Dave Piscitello <[email-masked]>
Date: Tue, 8 Dec 2015 16:21:26 +0000

Policy activity exists to look at how registries will monitor or report abuse so this might be an opportune time to include RDAP considerations.  

Sent from my iPhone

On Dec 8, 2015, at 11:11, John R Levine <[email-masked]> wrote:

> That'd be OK with me but merely deciding which domain blocklists to look at is highly political.  Also, I wouldn't assume that the BLs would be willing to provide a suitable feed to all the registries.  Some registries like .org have a good reputation while some like .xyz do not.
> 
> Regards,

---

From: "Marco Davids (SIDN)" <[email-masked]>
Date: Mon, 28 Dec 2015 11:57:07 +0100

On 02/12/15 17:07, Hollenbeck, Scott wrote:

> Does anyone see value in adding something to RDAP that could be used as a measure of domain stability or reputation?

Yes.

I believe it would fulfill a need and solve a problem. We've been 
overthinking this matter for quite some time now. One of the solutions 
we're currently investigating is 'validated WHOIS', meaning our WHOIS 
will show weather or not we have actually validated the information it 
is presenting. Any other additional idea to measure reputation is, in my 
view, welcome. It's not a very easy nut to crack though, if you ask me.

-- 
Marco