From Detection to Enforcement

The question is narrower than “who failed?”: which observable delays between validated evidence and proportionate action are preventable, and which intervention reduces victim harm without creating unacceptable false positives or collateral damage?

The scope is the contracted gTLD ecosystem: registrants, resellers, registrars, registries and ICANN's contractual compliance function. Hosting providers, CDNs, browsers, payment services, advertising platforms, national CERTs and law enforcement are included only where they affect the evidence or response chain. Country-code TLDs have different governance and are not assumed to be subject to ICANN's gTLD contracts.

Status of the central theses

• The paper analyzes ICANN as a private governance and contractual-compliance institution within the gTLD ecosystem. ICANN is not a government regulator or law-enforcement body, but it accredits registrars, contracts with registry operators and enforces those agreements; that limited remit does not remove institutional accountability.
• The 60–85% range is a central quantitative estimate in the paper’s harm model. It is presented as a testable estimate derived from explicit assumptions and case observations—not as an already established statistic for all global fraud. Publishing an incident-level dataset that aligns detection, notification, mitigation and harm timestamps is the next evidentiary step.
• The $100–150 figure is a testable engineering budget estimate for continuous collection and initial triage over a defined set of accessible zone, Certificate Transparency and public-feed data on commodity infrastructure. It is not the cost of complete global visibility, legal review, appeals, high availability or enforcement. The paper therefore treats it as a benchmark to reproduce with a published workload, source inventory and cost log—not as an already proven universal price. That distinction narrows the claim without erasing the cost asymmetry being tested.
• The paper’s three-week comparison concerns compliance latency, not a universal domain-takedown SLA. ICANN’s Contractual Compliance FAQ says that most complaint types can pass through three successive five-business-day response periods before formal escalation, while many malicious campaigns operate for hours or days. Contracts separately require prompt and appropriate mitigation after actionable evidence. [2][4]
• For a verified, single-purpose malicious registration, serverHold is among the most disruptive DNS-level remedies because it removes delegation from the zone. It is not universal: it can also disrupt mail, subdomains and legitimate services; cached answers may remain until TTL expiry; and compromised or shared services can require narrower mitigation. [4][7]

ICANN's first six-month enforcement report under the 2024 amendments recorded 192 investigations, more than 2,700 suspended domains, more than 350 disabled phishing pages and two Notices of Breach. Those figures do not prove that present controls are sufficient, but they rule out the absolute claim that the system takes no action. [5]

Some phishing campaigns operate on a timescale of hours or days. Bijmans et al. reported an average observed lifetime of 45 hours and a median of 24 hours for 1,288 phishing domains in one 2021 study. [11] A 2026 study of newly registered phishing domains reported a highly skewed distribution: for 14,112 domains with measurable lifetimes, the mean was 8.6 days and the median one day. [12] Neither sample can be generalized to every threat class, but both show why a process measured only in business days may miss short-lived campaigns.

The economically relevant asset is often not the registration fee but the traffic, creative, infrastructure and trust accumulated around a domain. That intuition is plausible; its magnitude varies by campaign. The calculator below therefore exposes every input instead of presenting a hypothetical result as an observed average.

visits(T)   = daily_traffic × T / 24
victims(T)  = visits(T) × conversion_rate
proceeds(T) = victims(T) × average_loss × (1 − cashout_attrition)
profit(T)   = proceeds(T) − campaign_budget

“Loss after detection” can become a useful outcome only if detection, delivery and harm are defined consistently. A blacklist timestamp is not proof that the registrar received actionable evidence. A wallet transaction is not automatically attributable to one domain. A domain becoming unreachable does not identify which actor caused the change.

Minimum event schema

Post-notice harm share =
  attributable harm with t_harm > t_notice
  ─────────────────────────────────────────
  all attributable harm in the observation window

The numerator and denominator must use the same attribution rule. Results should report the cohort, confidence interval, right-censoring, missing sources, duplicate-victim handling and sensitivity to the observation window. The label “preventable” should be reserved for a causal design or, at minimum, a matched comparison — not every event after notice.

No single actor sees or controls the full incident. The registrar knows the registrant relationship; the registry controls registry-set domain status; the host and CDN control content delivery; browsers and security vendors control warnings; payment and wallet providers can interrupt transfers; authorities can compel preservation or seizure. ICANN writes and enforces contracts in the gTLD ecosystem but does not operate a universal EPP control plane.

Distributed capability does not mean dissolved responsibility. A sponsoring registrar does not shed its contractual duties by delegating abuse handling to a reseller; the registry controls server-set EPP status; ICANN enforces contractual compliance. The audit trail must record not only who acted, but who received actionable evidence, redirected the case, failed to respond or failed to perform an assigned duty. Legal authority remains with the actor empowered to apply a measure; accountability also covers documented non-performance.

The April 2024 global amendments to the Registrar Accreditation Agreement and Base Registry Agreement created express obligations to mitigate DNS Abuse. Registrars must act promptly when they have actionable evidence that a sponsored name is being used for DNS Abuse. Registry operators must act promptly where they reasonably determine, based on actionable evidence, that a registered name is being used for DNS Abuse. In both cases the appropriate measure depends on context, severity and collateral harm. [2][3]

Three timelines that are often conflated

This flexibility has benefits: a compromised university domain should not be handled like a newly registered single-purpose phishing domain. The accountability problem is that “prompt” and “appropriate” are difficult to compare without published timestamps, case categories and outcome codes. The proposal below adds measurement and review without pretending that one deadline fits every case.

Phishing is explicitly within the contractual definition of DNS Abuse. The harder boundary concerns sites that deceive users under an original name rather than impersonating an identifiable third party: some fake investment platforms, fraudulent stores, recovery scams and wallet-signature schemes. Depending on facts, these may be treated as website-content abuse, consumer fraud or another legal category rather than contractual DNS Abuse.

A policy consultation could ask whether a narrowly evidenced category like VFHA belongs in future contracts, a cross-sector referral framework, or national law. Expansion should require a precise harm test, reliable evidence, proportional remedies, jurisdictional review and appeal. Vague “scam” labels are insufficient.

A commodity server can download accessible snapshots of participating gTLD zone files and compute changes locally, ingest selected Certificate Transparency events and open feeds, normalize strings, compute hashes and prioritize candidates. That is a useful, testable engineering benchmark—not “complete monitoring of the Internet.” In Q2 2026, Verisign reported 401.6 million registrations across all TLDs; CZDS covers participating gTLD zone files rather than all TLDs, and CT records publicly logged certificates or precertificates rather than every active or harmful domain. [8][9][17]

The proposed framework is a reference architecture, not an automatic global kill switch. It standardizes the case envelope, decision record and timestamps while allowing the authorized operator to choose the least disruptive effective action.

Evidence tiers

The API should create a verifiable case and start an auditable response timer; a reporter must not be able to issue a hold command directly. If an E3/E4 case concerns a single-purpose malicious registration and expires without a reasoned decision or effective mitigation, the system automatically escalates it to the registry operator or another actor with contractual or legal authority. A serverHold command can originate only from an authorized actor. Automatic escalation and registry authority to act on expiry are proposed policy changes, not claims about existing authority. Every state transition is signed and appended to the audit log.

{
  "indicator": {"type": "domain", "value": "example.invalid"},
  "alleged_category": "credential_phishing",
  "observed_at": "2026-08-02T06:14:22Z",
  "evidence": [
    {
      "type": "http_capture",
      "sha256": "a3f1c9…",
      "collection_method": "isolated_browser_v2",
      "source_id": "reporter:ed25519:7c2a…"
    }
  ],
  "provenance_graph": "ipfs-or-object-store:sha256:91bd…",
  "collateral_context": {
    "registered_domain_scope": true,
    "shared_service": false,
    "mail_observed": true,
    "suspected_compromise": false
  },
  "requested_action": "review",
  "reporter_signature": "ed25519:…"
}

A successful response returns a case ID, the receiving actor, evidence tier, completeness errors, target review time and a public transparency URL. It must not promise a specific remedy before a competent actor evaluates authority and collateral impact.

Service-level objectives should separate acknowledgement, triage, decision and effective mitigation. This makes performance measurable without assuming that suspension is always the right outcome.

These are pilot targets. The correct values should be derived from observed threat lifetimes, staffing, error cost and legal constraints, then published with attainment distributions rather than a single average.

Fast response without safeguards can amplify bad data into censorship, commercial sabotage or infrastructure outages. A legitimate architecture therefore treats false positives and collateral harm as first-class security failures.

Minimum due-process guarantees

1. Reason code, evidence tier and responsible decision-maker are recorded for every restrictive action.
2. A registrant can obtain a privacy-safe statement of reasons and submit counter-evidence.
3. Urgent appeals are reviewed by a person who did not make the original decision.
4. Reversal propagates through the same signed channel as the original action.
5. Aggregate error and restoration statistics are public; sensitive evidence remains access-controlled.

A public registrar score can improve accountability, but naïve rankings are distorted by portfolio size, feed coverage, customer mix and whether domains were maliciously registered or later compromised. A score must never justify collective blocking of all customers of a registrar.

RQI = report as a vector, not a single opaque rank:

  coverage-adjusted validated-abuse rate
  median / p90 acknowledge, triage and decision times
  mitigation effectiveness and recurrence
  false-positive and reversal rates
  median / p95 appeal-resolution time
  evidence completeness and transparency rate

Always publish N, observation window, confidence intervals,
feed coverage and malicious-registration / compromise split.

If a composite is required for governance, weights should be set before evaluation, sensitivity-tested and backtested against held-out cases. Results should be stratified by TLD, registrar size, threat class and evidence source. The output is an accountability signal — not an automated domain verdict.

A transparency registry can eliminate disputes over whether a notice existed, when it was delivered and what action followed. Publishing every artifact, however, could expose victims, personal data, investigative methods and live exploit paths. The solution is tiered access.

Each update is append-only, timestamped and signed. Corrections do not erase history; they add a superseding record. Public search should obey retention rules, prevent bulk victim discovery and offer redress for inaccurate personal data.

A useful pilot should be small enough to govern and large enough to test the causal chain. Suggested scope: three volunteer registrars, two registry operators, one hosting/CDN partner, two independent research feeds and a qualified appeal panel. The study protocol and outcome definitions should be registered before cases are assigned.

Primary pilot outcomes

• Median and 90th-percentile time from validated evidence to effective mitigation.
• Difference in attributable post-notice harm or a pre-specified victim-exposure proxy.
• False-positive rate, wrongful-action severity and median restoration time.
• Recurrence at the same registrant, infrastructure cluster and campaign level.
• Direct operational cost per validated case and per effective mitigation.

DNS abuse response is neither a purely technical filter nor a problem one institution can solve by itself. Existing 2024 contracts established meaningful mitigation duties, but they leave substantial discretion over evidence, timing and remedy. That discretion is necessary for proportionality; without comparable records, it also makes performance difficult to evaluate.

1. Standardize the evidence envelope. Adopt common provenance, timestamp and outcome fields across reporters, registrars, registries and infrastructure providers.
2. Measure stages separately. Publish acknowledgement, triage, decision, mitigation and appeal times by threat class and evidence tier.
3. Distinguish malicious registration from compromise. Prefer path/account remediation for compromised legitimate services and reserve domain-wide measures for cases where they are proportionate.
4. Pilot response targets. Test hour-scale objectives for high-confidence, single-purpose malicious registrations rather than declaring a universal deadline.
5. Publish privacy-safe accountability data. Use a tiered transparency registry with signed histories and restricted evidence.
6. Evaluate causal impact. Do not equate faster suspension with saved money until a pre-registered study measures victim-impact outcomes and displacement.

The constructive conclusion is not that the original problem disappears once its claims are qualified. It is that the central claims can now be tested: the 60–85% post-detection harm range is an explicit quantitative hypothesis; $100–150 is a testable engineering budget assumption for a defined sensor-and-triage layer; and hour-scale response targets can be piloted for high-confidence, single-purpose malicious registrations. Publish the workload, costs, timestamps and outcomes, compare them with a baseline, and measure displacement and error. Confirmation would justify contractual and policy change; rejection would identify which assumption failed.