[gnso-ff-pdp-may08] Rasmussen/Piscitello action 4.g

[Dave Piscitello <dave.piscitello@xxxxxxxxx>]

(4.g) Registrar's responses and defensive mechanisms to fast
flux activities appear to vary widely in substance and
timeliness which may result in certain registrars being
increasingly targeted for fast flux activities


Proposed response: 

There is evidence to support this assertion, which was one of the driving
forces behind creation of this working group.  The APWG released a report
that looked at differences between phishing abuse in different TLDs around
the world and correlated policies and procedures used at various registries
with prevalence and longevity of phishing attacks using certain TLDs
(http://apwg.org/reports/APWG_GlobalPhishingSurvey1H2008.pdf).  One of the
outcomes of this working group is to help better understand the issues
driving these kinds of results and what may be done by the community to
address them.  Note that differences in registrar policies, procedures,
staffing, and other practices make a difference for a wide variety of abuse
issues, not just malicious fast flux registrations.