Resources
The Institute strives to serve as a resource for all interested stakeholders fighting DNS Abuse, whether they are registries, registrars, security researchers, or any other interested party.
The Institute is pleased to provide and maintain a Resource Library on publications related to DNS Abuse. These documents advance the conversation regarding DNS Abuse and help educate registries and registrars as to how to address it. These resources also may prove useful to someone that wants to learn more about DNS Abuse and how to tackle it.
> Filter Resources
Filter By Tags
Filter By Category
Criminals are exploiting the UK’s Winter Fuel Payment – this is how global industry collaboration is tackling it
A joint blog: Mayuresh Walke, Nominet, and Rowena Schoo, NetBeacon Institute Nominet sits on the NetBeacon Institute Advisory Council – working together to reduce DNS
How Did the Closure of Freenom Impact DNS Abuse Across the TLD Ecosystem?
Introduction Freenom, the domain name registrar and registry operator, received a great deal of attention in March 2023 when published reported noted that it had
Phishing Attack Trends
Since collecting and publishing data on the number of unique domains used for phishing attacks and malware distribution as part of our NetBeacon MAP reporting, we’ve been
Introducing the NetBeacon Institute: Empowering a Safer Web
DNS Abuse Institute announces renaming to coincide with an expansion of its offerings in an effort to eliminate DNS Abuse online Reston, VA – The
Measuring DNS Abuse is Difficult
The DNS Abuse Institute launches a new level of reporting that reveals the spectrum of how malicious phishing and malware is distributed across the DNS registration ecosystem.
Measuring the Impact of the ICANN DNS Abuse Amendments
The DNS Abuse Institute launches a new level of reporting that reveals the spectrum of how malicious phishing and malware is distributed across the DNS registration ecosystem.
GAC Communiqués and Community Activity on DNS Abuse
The DNS Abuse Institute launches a new level of reporting that reveals the spectrum of how malicious phishing and malware is distributed across the DNS registration ecosystem.
A Holistic Approach to Tackling DNS Abuse for Registries and Registrars
In September 2023, ICANN hosted the DNS Symposium in Da Nang, Vietnam. This included a ‘Day of DNS Abuse Discussions’ with a comprehensive agenda. This
Challenges in Measuring DNS Abuse
From the creation of NetBeacon Measurement and Analytics Platform (MAP), we knew that measuring DNS Abuse* would be difficult and that it would be beneficial
Bulletin: DNS Abuse Campaign Exploiting “Subdomain Cloaking”
Summary In August 2025, NetBeacon MAP identified 2,227 unique domain names that appear to be part of a coordinated phishing campaign. The registrations are primarily
Recent spike in malicious phishing concentrated in two registrars
Summary Record Highs in NetBeacon MAP Data In March 2025 we observed two record highs in NetBeacon Measurement and Analytics Platform (MAP) data: the highest
Criminals are exploiting the UK’s Winter Fuel Payment – this is how global industry collaboration is tackling it
A joint blog: Mayuresh Walke, Nominet, and Rowena Schoo, NetBeacon Institute Nominet sits on the NetBeacon Institute Advisory Council – working together to reduce DNS Abuse globally. The partnership highlights how important it is for trusted organisations to collaborate in keeping the internet safe and secure. We remain dedicated to working together
Bulletin: DNS Abuse Campaign Exploiting “Subdomain Cloaking”
Summary In August 2025, NetBeacon MAP identified 2,227 unique domain names that appear to be part of a coordinated phishing campaign. The registrations are primarily concentrated in two registrar credentials: 90% (1994) in Aceville Pte. Ltd. (IANA ID 3858) and 10% (230) Dominet (HK) Limited (IANA ID 3775). This campaign uses a
Recent spike in malicious phishing concentrated in two registrars
Summary Record Highs in NetBeacon MAP Data In March 2025 we observed two record highs in NetBeacon Measurement and Analytics Platform (MAP) data: the highest number of unique domain names associated with phishing (47,613), and the largest month-on-month increase in unique domain names associated with phishing (63%). See Figure 1: Aggregate Trends
White Paper: Proposal for PDPs on DNS Abuse
The NetBeacon Institute is pleased to publish our White Paper: Proposal for PDPs on DNS Abuse. We created this paper to support and advance ICANN Community discussions on potential policy development related to DNS Abuse. From our unique perspective, we believe there are a number of issues that are constrained enough to
How have the gTLD contractual amendments impacted DNS Abuse?
Overview In this context, DNS Abuse is defined as malware, botnets, phishing, pharming, and spam (when spam serves as a delivery mechanism for the other forms of DNS Abuse). This was a tremendous achievement. ICANN, the participating registries and registrars, and the ICANN community all deserve recognition for this work. These
NetBeacon Reporter introduces new features as it reaches 50,000 DNS Abuse Reports
NetBeacon Reporter introduces new features as it reaches 50,000 DNS Abuse Reports Since launching NetBeacon Reporter in 2022, we’ve engaged with registrars and DNS Abuse reporters to onboard users, increase reports, and collect ideas for improvements. Today we’re pleased to share that we’ve sent over 50,000 reports of DNS Abuse. This achievement
Update on GAC Communiqués and Community Activity on DNS Abuse
This blog and the associated report aim to provide an overview of DNS Abuse-related issues raised by the Governmental Advisory Committee (GAC), a key part of ICANN’s multistakeholder model. We summarize relevant community activity that addresses these areas and highlight remaining gaps where further work is needed. This report is an updated
Reflections on a Year of Publishing Registrar and TLD Abuse Rates
In June 2023, after ten months of publishing general DNS Abuse trends at the aggregate level, we published our first report listing high and low abuse rates per Domains Under Management (DUM) and new registrations for registrars and TLDs, which we refer to as Specific Reporting. Our DNS Abuse reporting methodology focuses
Sign up to receive updates
Stay up-to-date with the Institute and happenings across the industry in an effort to combat DNS Abuse.