As a registrar's abuse engineer, do you suspend 30,000 pre-computed botnet domains?

## The chair, and what it can actually reach An abuse engineer at a registrar or hosting provider sits on the other side of the fence from everyone who owns a victim estate. The levers are narrow and specific: suspend or hold a name the registrar sponsors, change its delegation, terminate a hosting account, refuse a registration. That is the entire toolkit. It does not include removing code from a machine, notifying the people who are infected, or even knowing who they are. Any answer that drifts into cleaning up victims has left the chair. This matters because it bounds the promise. Suspending a rendezvous name removes one pre-committed path. The implants continue to run, continue to wake on their trigger, and continue down the ladder to the next thing the author compiled in. ## Splitting the list A crop computed from a sample is not a list of things you can act on. It divides: - **Names you sponsor.** Actionable, and the smallest slice. Each needs evidence linking that specific registration to the family, not just membership of a computed list, because acting is a contractual act against a paying customer with a right to complain. - **Names nobody has registered.** The majority. There is nothing to suspend. The only lever is a pre-emptive reservation or block of the string, which costs money per name, must be renewed, and is a policy decision rather than an abuse one. - **Names registered elsewhere, or in registries you do not operate.** Someone else's decision entirely, under someone else's law, at someone else's pace. Country registries in particular have their own processes, evidence standards and languages. - **Collisions.** Generators emit pronounceable strings, and some will already be legitimate businesses. Every batch action needs an exclusion pass, and getting this wrong is the mistake that ends up in a lawsuit rather than a write-up. ## Suspend, or redelegate? Two very different acts, and the difference is not technical vanity. **Suspension** stops the name resolving. It is cheap, fast, reversible, and it puts the population beyond anyone's sight: the hosts try, fail, and move down the ladder without a trace anyone can hold. **Redelegation** points the name at nameservers you control, so the population keeps arriving — at you. That is materially heavier. You are now receiving connections from every infected machine, which means addresses belonging to identifiable people and organisations flowing into your systems: a data-protection question about lawful basis, retention and who may receive it, and a question about what you are obliged to do with knowledge of who is infected. It usually requires a court order or a formal arrangement with law enforcement, and an infrastructure commitment for as long as the population lives. It also, unlike suspension, is distinguishable to the implant: a name that answers with an address that does not behave like the operator can trip anti-takeover checks and push hosts down the ladder anyway. ## The timing problem, which is the actual judgment Everything above is procedure. The judgment is *when*, and it comes from the fact that the ladder is pre-committed. The operator cannot revise it, so each layer you take is one they cannot get back — but only if they cannot simply step down. Take one path in isolation and you have told the operator which layer you reached, converted a population you could still find into one you cannot, and left them the rest of the ladder. Coordinated action across every registrar and registry holding a layer, at one moment, is worth far more than any single suspension; that coordination is slow, involves parties with different legal exposure, and is frequently what a careful engineer is waiting for rather than being obstructive. Which leads to the honest position to hold in front of a caller who wants the list actioned today: name what suspension delivers (one path, this period), name what it does not (any change on any infected machine), name the cost of doing it uncoordinated (the operator learns, and the population walks to the next layer), and say what would change your answer — sponsorship of the names, evidence per name, legal cover, and a coordinated window with the other holders. ## What a good answer sounds like Refuse the framing that thirty thousand computed strings are thirty thousand actionable items. Split the list, name the evidence and contractual bar, distinguish suspension from redelegation on duties rather than mechanics, and finish on coordination and timing — because that is the part that decides whether the action was worth taking at all.