Home Malware

Below are the M3AAWG published materials related to our work on preventing and mitigating malware. There is also a Malware video playlist on our YouTube channel at www.youtube.com/maawg and there are a few selected videos on our website in the Training Videos and Keynotes Videos sections under the Meetings menu tab.

Best Practices

PDF
May 18, 2023

M3AAWG Present and Future of the Public Suffix List

This document describes the PSL, explains its current strengths and limitations, and outlines some possible future enhancements. Most importantly, though, the community must step up and help to make sure it continues to exist. 

PDF
May 12, 2023

M3AAWG Ransomware Active Attack Response Best Common Practices

This document addresses the options available if you realize that you are a victim of a Ransomware attack. It explains how to consider risks and alternatives in resolving the recovery and supporting continuity for your business, and how to tackle those issues. 

PDF
February 21, 2022

M3AAWG Brand Protection Kit Domain Management

This document focuses on domain management. It outlines how to protect brands from threat actors who are keen to register domains that mimic a brand in order to steal information and/or assets. 

PDF
December 14, 2020

M3AAWG Best Practices for Sending Mandated Emails to Large Audiences

There are a number of scenarios in which senders may be required or compelled to send a bulk message despite the fact that such messages are highly likely to exhibit poor delivery metrics such as increased bounces or complaints. These messages are not intended to be used for standard marketing or transactional notices; these are the exceptions to the rule. Prominent examples of high-risk sends would be items such as breach notifications, product recalls, health and safety notices, or other notifications that might need to be sent to individuals who have been previously been suppressed or unsubscribed.

PDF
November 09, 2020

Exploring the Impact of Nonhuman Interactions on Email Send Metrics

Received email may not be handled only by a human. It may be partially or even fully handled by a software program. The purpose of this document is to offer guidance to marketing and sales staff about the way that nonhuman interactions (NHI, also known as “automated clicks”) affect the performance metrics of their email messages and reporting systems. This document is not intended to solve issues, but rather to provide insights into the effects of NHI and offer some best practices for senders.

Pages

Public Policy Comments

May 25, 2023

M3AAWG Comments on the NTIA's Introduction of Accountable Measures Regarding Access to Personal Information of .us Registrants

M3AAWG has submitted comments on the National Telecommunications and Information Administration's Introduction of Accountable Measures Regarding Access to Personal Information of .us Registrants. In this set of Comments, M3AAWG urges the Agency NOT to implement the potential changes described in this request for comments. Read more for additional insight into M3AAWG's submission.

April 04, 2023

M3AAWG Comments on Review of the Computer Misuse Act 1990: consultation and response to call for information (accessible)

M3AAWG has submitted Comments focused on technical recommendations in response to the UK government's request for Review of the Computer Misuse Act 1990: consultation and response to call for information. These comments provide recommendations supporting efforts to tackle online abuse and cybercrime while respectfully urging the UK government to liaise with key security and anti-abuse groups including M3AAWG and its partner organizations as well as key UK-based and international industry stakeholders.

March 02, 2023

M3AAWG Comments on NIST Cybersecurity Framework 2.0 Concept Paper

The Messaging Malware Mobile Anti-Abuse Working Group (M3AAWG) has submitted comments in response to the National Institute on Standards and Technology (NIST) Cybersecurity Framework 2.0 Concept Paper: Potential Significant Updates to the Cybersecurity Framework (CSF Concept Paper), released on January 19, 2023. As discussed in the Comments, M3AAWG generally supports the proposals outlined in the CSF Concept Paper. However, M3AAWG urges NIST to consider the impact of proposals that could potentially dilute the usefulness of a framework originally developed to focus on critical infrastructure cybersecurity risks and needs.​

September 30, 2021

Recommendations pertaining to findings from the M3AAWG and APWG WHOIS Survey Report presented to ICANN in June, 2021

As a followup to the June 2021 survey report of cyber investigators and anti-abuse service providers on the ongoing impacts of ICANN’s implementation of the EU GDPR, the Temporary Specification for gTLD Registration Data (Temporary Specification, adopted in May 2018), M3AAWG and the Anti-Phishing Working Group (APWG) has released their recommendations for ICANN'S consideration.

June 08, 2021

ICANN, GDPR, and the WHOIS: A Users Survey - Three Years Later

M3AAWG and the Anti-Phishing Working Group (APWG) conducted a follow up survey to our 2018 survey of cyber investigators and anti-abuse service providers to determine the ongoing impacts of ICANN’s implementation of the EU GDPR, the Temporary Specification for gTLD Registration Data (Temporary Specification, adopted in May 2018). The report contains our findings and presents some recommendations for consideration.

Pages

M3AAWG Reports

M3AAWG Bot Metrics Report

September 01, 2014

Combines data from our first report in 2012 through 2013

M3AAWG Email Metrics Report

September 01, 2014

Combines data from our first report in 2012 through 2013

DM3Z Blog

Updates and Commentary from the Messaging, Malware and Mobile Anti-Abuse Working Group

None at this time.

News

Articles About M3AAWG

URL
June 01, 2020

Should you deploy a TLS 1.3 middlebox?


To inspect or not to inspect, that is the question.

TLS 1.3 is by far the most secure version of the Transport Layer Security (TLS) protocol, but its use of ephemeral elliptic curve keys--and the deprecation of static RSA keys--means that TLS sessions now offer forward secrecy, a bane to enterprise security administrators who want to maintain visibility into their network traffic.

URL
May 07, 2020

MarTech Interview with Len Shneyder, VP of Industry Relations at Twilio SendGrid


Domain-based Message Authentication, and Reporting, and Conformance is a policy that adds to SPF and DKIM and gives a receiving set of instructions on what they should do when an email they received fails other authentication checks.
https://martechseries.com/mts-insights/interviews/len-shneyder-twilio-sendgrid/

URL
February 20, 2020

Messaging, Malware and Mobile Anti-Abuse Working Group (M3AAWG) Celebrates Jerry Upton's 15 Years as Executive Director at the 48th General Meeting

The Messaging, Malware and Mobile Anti-Abuse Working Group (M3AAWG), the largest global industry consortium developing collaborative approaches to combat online abuse, today announced that Jerry Upton will retire from his role as M3AAWG's Executive Director after 15 years of service. He will be succeeded by Amy Cadagin.

HTML
January 07, 2020

How to stop email spoofing of parked domains


https://www.csoonline.com/article/3512239/how-to-stop-email-spoofing-of-parked-domains.html
J.M. Porup includes M3AAWG recommendations on protecting parked domains in an article on the importance of publishing a DMARC record for every domain a business owns.

Pages

Subscribe to