View source for NetBeacon Reporter

'''NetBeacon Reporter''' or simply '''NetBeacon''' is a free tool that simplifies DNS Abuse reporting for individuals and organizations and provides domain registrars with the information and tools they need to act.<ref name="reporting">[https://netbeacon.org/reporting/ NetBeacon: NetBeacon Reporter]</ref> It is a free service operated by the [[NetBeacon Institute]] (previously DNS Abuse Institute) and developed in collaboration with [[CleanDNS]].<ref>[https://circleid.com/posts/20220608-dns-abuse-institute-launches-centralized-dns-abuse-reporting-service CircleID: DNS Abuse Institute Launches Centralized DNS Abuse Reporting Service]</ref> <ref>[https://netbeacon.org/the-institute/ NetBeacon: The Institute]</ref>The tool allows individuals and organizations to submit standardized reports of phishing, malware, botnets, and spam, and then enriches and routes those reports in normalized formats to participating registrars, registries, and other providers that can take action.<ref name="reporting"></ref>

==History==

NetBeacon grew out of a need in the domain community about how to approach the problems DNS abuse presents. For this reason, the Net Beacon Institute (at the time named DNS Abuse Institute) worked to understand the complexities of mitigating DNS Abuse and the came up with programs and goals to fulfill their mission.<ref name="netbeacon1">[https://netbeacon.org/introducing-netbeacon/ NetBeacon: Providing Registrars with Actionable, High-Quality Abuse Reports]</ref> 

In November 2021, [[Graeme Bunton]], Director of the Institute, published that they were developing a Centralized Abuse Reporting Tool (CART).  The intention of this tool was to provide a single platform to report DNS Abuse by outlining the evidence requirements for each abuse type, properly formatting and enriching the request details provided, and then forwarding it to the appropriate [[registry]] or [[registrar]].  The goal was to standardize reliable processes to improve both the act of reporting abuse and the abuse reports that registrars and registries receive. As part of it’s requirements gathering, the Institute researched the reporting processes of the largest registries and registrars in order to better understand how they accept reports of abuse.  Publicly available information from registry and registrar websites was collected to obtain data on their abuse reporting implementations and processes.<ref name="netbeacon2">[https://netbeacon.org/the-current-state-of-dns-abuse-reporting/ NetBeacon: The Current State of DNS Abuse Reporting]</ref> They concluded that there two main - and interrelated - problems:

* '''Complexity''': Reporting DNS Abuse to registrars and registries required technical knowledge and ability to navigate the entire ecosystem, which could be onerous, confusing, non-standardized, and extremely difficult to do at Internet-scale. 
* '''Quality''': The DNS Abuse reports that registrars and registries received were frequently duplicative, unevidenced, unactionable, and often contained domains that aren’t related to them. This consumed time and resources with little of that effort improving the Internet. <ref name="netbeacon1"></ref>

In April 2022, they provided updates and what the tool was going to be: an abuse reporting intermediary, which would improve the experience for people who want to report abuse by providing a single place to report DNS Abuse across the ecosystem in a simple, standardized fashion. A centralized solution had been called for in several important cross-community outputs, including in the recommendations of the [[SSR2|Second Security and Stability Review Team (SSR2)]] and in the [https://itp.cdn.icann.org/en/files/security-and-stability-advisory-committee-ssac-reports/sac-115-en.pdf SAC 115: Report on an Interoperable Approach to Addressing Abuse], a report from [[SSAC|ICANN’s Security and Stability Advisory Committee (SSAC)]]. They also announced that the name CART would be changed to NetBeacon.<ref name="update">[https://netbeacon.org/centralized_abuse_reporting_update/ NetBeacon: Centralized Abuse Reporting Update]</ref>

In June 2022, the Institute, supported by [[PIR|Public Interest Registry (PIR)]] and CleanDNS launched NetBeacon Reporter, mostly called only NetBeacon.

The service is free and was mainly directed at registrars. NetBeacon aimed to make it easier for registrars to receive actionable, high quality reports of phishing, malware, botnets, and spam. It also included customization to individual needs. 

They claimed that their reports are: 

* '''Evidenced''': The standardized abuse reporting forms prevent reporters from submitting a report that does not meet a basic evidentiary standard. The reports were enriched with additional external API sources (like Reputation Block Lists, Hybrid Analysis). 
* '''Relevant''': The service associates the domain name with the relevant registrar to ensure that only reports relevant to your domains under management are received. There was also the possibility of redirecting potential reporters to use NetBeacon instead of providing the abuse teams with reports one cannot action. Also, one could embed the NetBeacon tool in their own abuse reporting webpage, filtering out the irrelevant reports and sending them to NetBeacon for redirection to the relevant registrar. 
* '''Flexible on format''': One could choose which email address the standardized report should go to, and pick human readable format or XARF, or consume reports via API. 
* '''Customizable''': One was able to decide if reports were wanted instantly, or compiled and sent daily, and also which types of reports were  to be received (phishing, malware, botnets and spam). 
* '''Simplifying Triage''': If some reporters send particularly useful reports (or not), they and their subsequent reports could be labeled to speed and simplify the triage processes.<ref name="netbeacon1"></ref>

==Function==

NetBeacon’s core functions are designed to make it easier for registrars to receive and process abuse claims. By providing a single venue, with standardized fields and evidence requirements, NetBeacon aims to improve the quality of reports. Each report includes fields for the domain in question, the type of abuse, a description of abuse, date of abuse, and any additional evidence. The Institute accepts DNS Abuse reports through three core mechanisms. Reports can be submitted via NetBeacon’s website (www.netbeacon.org).<ref name="service">[https://netbeacon.org/dns-abuse-institute-launches-netbeacon-first-ever-centralized-dns-abuse-reporting-service/ NetBeacon: DNS Abuse Institute Launches NetBeacon Reporter]</ref>

== Reports ==

In April 2023 came the second Annual Report from the Institute, which included content about NetBeacon Reporter. It said that the reception of NetBeacon was overwhelmingly positive, with multiple references from the [[GAC|ICANN Governmental Advisory Committee]], and positive press. Although report recipients, primarily registrars, were generally well served by the service, there was also the need more features to help abuse reporters. As such, new features started being developed to:

* Allow registries to use NetBeacon to distribute reports to their registrar channel
* Enable the verification of DNS Abuse reporters
* Enable branded reports with boilerplate text for verified abuse reporters <ref name="annual">[https://netbeacon.org/wp-content/uploads/2024/04/DNSAI-Annual-Report-2022.pdf DNS Abuse Institute: Annual Report 2022]</ref>.

==References==
{{reflist}}

[[Category:DNS Abuse Responses]]