91 lines
2.9 KiB
JSON
91 lines
2.9 KiB
JSON
{
|
|
"namespace": "domain-abuse",
|
|
"expanded": "Domain Name Abuse",
|
|
"description": "Domain Name Abuse - taxonomy to tag domain names used for cybercrime.",
|
|
"version": 2,
|
|
"predicates": [
|
|
{
|
|
"value": "domain-status",
|
|
"description": "Domain status - describes the registration status of the domain name",
|
|
"expanded": "Domain status"
|
|
},
|
|
{
|
|
"value": "domain-access-method",
|
|
"description": "Domain Access - describes how the adversary has gained access to the domain name",
|
|
"expanded": "Domain access method"
|
|
}
|
|
],
|
|
"values": [
|
|
{
|
|
"predicate": "domain-status",
|
|
"entry": [
|
|
{
|
|
"value": "active",
|
|
"expanded": "Registered & active",
|
|
"description": "Domain name is registered and DNS is delegated"
|
|
},
|
|
{
|
|
"value": "inactive",
|
|
"expanded": "Registered & inactive",
|
|
"description": "Domain name is registered and DNS is not delegated"
|
|
},
|
|
{
|
|
"value": "suspended",
|
|
"expanded": "Registered & suspended",
|
|
"description": "Domain name is registered & DNS delegation is temporarily removed by the registry"
|
|
},
|
|
{
|
|
"value": "not-registered",
|
|
"expanded": "Not registered",
|
|
"description": "Domain name is not registered and open for registration"
|
|
},
|
|
{
|
|
"value": "not-registrable",
|
|
"expanded": "Not registrable",
|
|
"description": "Domain is not registered and cannot be registered"
|
|
},
|
|
{
|
|
"value": "grace-period",
|
|
"expanded": "Grace period",
|
|
"description": "Domain is deleted and still reserved for previous owner"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"predicate": "domain-access-method",
|
|
"entry": [
|
|
{
|
|
"value": "criminal-registration",
|
|
"expanded": "Criminal registration",
|
|
"description": "Domain name is registered for criminal purposes"
|
|
},
|
|
{
|
|
"value": "compromised-webserver",
|
|
"expanded": "Compromised webserver",
|
|
"description": "Webserver is compromised for criminal purposes"
|
|
},
|
|
{
|
|
"value": "compromised-dns",
|
|
"expanded": "Compromised DNS",
|
|
"description": "Compromised authoritative DNS or compromised delegation"
|
|
},
|
|
{
|
|
"value": "sinkhole",
|
|
"expanded": "Sinkhole",
|
|
"description": "Domain Name is sinkholed for research, detection, LE"
|
|
},
|
|
{
|
|
"value": "compromised-domain-name-registrar",
|
|
"expanded": "Compromised domain name registrar",
|
|
"description": "Domain name is compromised due to an incident at the registrar"
|
|
},
|
|
{
|
|
"value": "compromised-domain-name-registry",
|
|
"expanded": "Compromised domain name registry",
|
|
"description": "Domain name is compromised due to an incident at the registry"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|