[gnso-ff-pdp-may08] 2008 H2 fast flux data

[jose nazario <jose@xxxxxxxxx>]

Blogged it up here:

http://asert.arbornetworks.com/2009/01/2008-h2-fast-flux-data-analysis/

Comparison and Trends
We¹re seeing two trends of note with respect to 2008 with fast flux domain
registrations and use. The first is the growing proportion of .CN as a fast
flux TLD. Most of the .CN domains we see registered and fluxing come through
a registrar like BIZCN, whom we now treat with some suspicion. This could be
due to them being negligent or completely subverted, but either way we¹re
not surprised to see a BizCN registration of a fluxy .CN domain name. We
also think that this rapid growth in .CN as a fluxing TLD may be due to a
fire sale of .CN domain registrations that occurred late in 2008.

The second big trend over 2008 is the migration away from .COM and .CN to a
lot more TLDs. As we noted in our paper earlier this year, by the middle of
2008 more TLDs were being used that had been seen in Thorsten¹s previous
paper. By the end of 2008 even more TLDs were in use. The long tail is
getting longer, meaning more registrars have to be educated and empowered to
response to abuse notices with takedowns.


-- jose

-------------------------------------------------------------
jose nazario, ph.d.  <jose@xxxxxxxxx>
Arbor Networks      www.arbornetworks.com
v: (734) 821 1427
PGP: 0x40A7BF94
-------------------------------------------------------------