Detecting and mitigating registrar collusion in drop-add acquisitions of domain names

A method for detecting domain name system (DNS) registrar collusion, the method comprising:

• obtaining information related to a plurality of name acquisition requests, wherein a plurality of DNS registrars submit the plurality of name acquisition requests attempting to acquire one or more targeted domain names in a drop pool of expired domain names, wherein the drop pool of expired domain names comprises one or more domain names that are scheduled to be dropped from the DNS registry after a registration period of each of the one or more domain names has expired;
• providing, for the plurality of DNS registrars, a plurality of attempt sets containing the one or more targeted domain names, wherein the plurality of attempt sets each contains at least one targeted domain name that a respective DNS registrar of the plurality of DNS registrars attempted to acquire via at least one of the plurality of name acquisition requests;
• determining a similarity of overlap between two or more attempt sets of the plurality of attempt sets corresponding to a pair of DNS registrars of the plurality of DNS registrars;
• estimating a likelihood of collusion between the pair of DNS registrars based on the similarity;
• and
• performing mitigation actions in response to the likelihood of collusion.

A non-transitory computer-readable storage medium including instructions that, when executed by at least one processor at a domain name system (DNS) registry, causes the at least one processor to execute a method for detecting DNS registrar collusion, the method comprising:

• obtaining information related to a plurality of name acquisition requests, wherein a plurality of DNS registrars submit the plurality of name acquisition requests attempting to acquire one or more targeted domain names in a drop pool of expired domain names, wherein the drop pool of expired domain names comprises one or more domain names that are scheduled to be dropped from the DNS registry after a registration period of each of the one or more domain names has expired;
• providing, for the plurality of DNS registrars, a plurality of attempt sets containing the one or more targeted domain names, wherein the plurality of attempt sets each contains at least one targeted domain name that a respective DNS registrar of the plurality of DNS registrars attempted to acquire via at least one of the plurality of name acquisition requests;
• determining a similarity of overlap between two or more attempt sets of the plurality of attempt sets corresponding to a pair of DNS registrars of the plurality of DNS registrars;
• estimating a likelihood of collusion between the pair of DNS registrars based on the similarity;
• and
• performing mitigation actions in response to the likelihood of collusion.