Resource Library Categories
NetBeacon Best Practices
Anti-Fraud Tools and Registration Flows for Registrars
Preventing DNS abuse often starts before a malicious domain ever goes live. Because fraudulent domain registrations and payment fraud frequently overlap, registrars can use many of the anti-fraud tools they already have in place to identify higher-risk registrations earlier, reducing abuse, chargebacks, and the cost of responding after the fact.
This best-practice guide explores how registrars can strengthen fraud detection with domain-specific signals, optimize registration and manual review workflows, and better balance security with a smooth experience for legitimate customers.
Abuse Reporter Expectation Management
Effective abuse reporting depends on more than simply providing a way to submit a report—it also requires clear communication about what happens next. When reporters are left uncertain about whether a report was received, how it will be reviewed, or whether they should expect a response, frustration and unnecessary follow-up can quickly follow.
This best-practice guide explores how registrars can better manage reporter expectations through simple measures like automated acknowledgements, clear explanations of the review process, and transparent high-level abuse policies—helping reduce uncertainty without creating an additional burden for abuse teams.
Guidance
M3AAWG
This report provides recommended best practices for registries and registrars to prevent, detect, and mitigate DNS Abuse. It offers practical operational guidance that helps strengthen security and reduce malicious activity across the domain name ecosystem.
M3AAWG (Messaging, Malware and Mobile Anti-Abuse Working Group) is an international industry consortium focused on combating online abuse and improving internet security.
NCSC Good Security Practices for Domain Registrars
This guidance outlines security measures that domain registrars can implement to better protect their systems, customers, and domain portfolios. The recommendations help reduce opportunities for domain hijacking, abuse, and other cyber threats that can contribute to DNS Abuse.
The National Cyber Security Centre (NCSC) is the United Kingdom’s national technical authority for cybersecurity and part of GCHQ.
Internet & Jurisdiction Policy Network Domain Toolkit
This toolkit provides practical resources and educational materials on how online abuse intersects with the DNS and how stakeholders can respond effectively. It is designed to help operators, policymakers, law enforcement, and others navigate the complex policy and operational challenges associated with DNS Abuse.
The Internet & Jurisdiction Policy Network is a global multistakeholder organization that develops policy solutions for cross-border legal issues affecting the internet.
CISA Cybersecurity Services
This resource aggregates free cybersecurity tools, services, and assessments offered by public and private sector organizations. It helps organizations enhance their cyber defenses, making them more resilient against threats that may contribute to DNS Abuse.
The Cybersecurity and Infrastructure Security Agency (CISA) is the U.S. government agency responsible for strengthening the security and resilience of critical infrastructure and cyberspace.
Policy
ICANN DNS Abuse Mitigation Program
ICANN’s DNS Abuse Mitigation Program serves as a central hub for initiatives addressing DNS Abuse, including measurement efforts, research, community coordination, and contractual compliance activities. It provides valuable insights and resources that support evidence-based approaches to mitigating DNS Abuse.
ICANN (Internet Corporation for Assigned Names and Numbers) coordinates key aspects of the global Domain Name System and supports the stable and secure operation of the internet.
GNSO Final Issue Report on a PDP on DNS Abuse Mitigation
This report examines potential policy development pathways for addressing DNS Abuse within ICANN’s multistakeholder framework. It provides important background, analysis, and recommendations that inform community discussions on DNS Abuse mitigation policies.
The Generic Names Supporting Organization (GNSO) develops and recommends policies relating to generic top-level domains within ICANN.
Measurement
eco topDNS Reports
These monthly reports provide data and analysis on online abuse trends affecting internet service providers and other stakeholders. The findings help identify patterns of malicious activity and contribute to a better understanding of DNS Abuse across the internet ecosystem.
eco – Association of the Internet Industry is a leading European internet industry association that promotes a secure, reliable, and innovative internet.
ICANN Metrica
Domain Metrica brings together different datasets and measurements to generate useful metrics and metadata about domain names, particularly DNS Abuse.
These metrics can be filtered and viewed on Metrica’s web interface, underlying data can be downloaded via the web user interface or an application programming interface.
Data Sources against Malicious Domain Names: A Framework and a Systemic Evaluation
This framework presents key data sources used for the measurement, detection, and prevention of DNS Abuse and analyzes them along technical, impact, and legal/ethical dimensions.
The framework was developed in collaboration by DNS Belgium, Department of Computer Science KU Leuven, Leuven.ai, and the NetBeacon Institute.
READ MOREAcademic Research
COMAR
COMAR is a research methodology that helps distinguish between domains that were maliciously registered and domains that were later compromised by attackers. This distinction improves the accuracy of DNS Abuse analysis and supports more targeted mitigation efforts.
COMAR was developed by academic and security researchers seeking to improve the measurement and classification of DNS Abuse.
INFERMAL
INFERMAL is a research project that analyzes cybercriminal behavior and domain registration preferences associated with DNS Abuse. Its findings provide valuable insights into attacker decision-making, helping stakeholders develop more effective prevention and mitigation strategies.
KOR Labs is a cybersecurity research organization that conducts data-driven studies on internet abuse and online threats, including projects funded by ICANN.