Add IONOS product domains #2083
Conversation
…omains to the public suffix list
public_suffix_list.dat
Outdated
| // IONOS SE : https://www.ionos.com/, | ||
| // IONOS Group SE: https://www.ionos-group.com/ | ||
| // submitted by Henrik Willert <[email protected]> | ||
|
|
There was a problem hiding this comment.
Please remove the empty line (to avoid breaking some parsers)
There was a problem hiding this comment.
Fixed in ff20b6b ✔️
|
Expiration (Note: Must remain >2 years at all times):
According to WHOIS records, all domains are currently in good standing. Please ensure they are renewed in the coming years to maintain a validity period of more than two years at all times in the future. DNS _psl entries (Note: Must remain in place): The DNS entries appear correct based on checks with multiple public DNS servers. Please ensure they remain in place at all times in the future.
Sources: Sorting: The sorting appears to be correct. Reasoning/Organization Description: The submitter mentioned that different web hosting customers have their own subdomains. This seems to be a reasonable request for PSL inclusion to enable cookie separation between subdomains that belong to different clients of web hosting or entities, consistent with the submitter's description. To assess website usage, I queried multiple search engines and discovered a considerable number of subdomains, which aligns with the reported number of users:
|
|
There doesn't seem to be a relevance issue, but one of the domains, app-ionos.space, has a higher portion of security vendors flagging it as malicious. It's understandable that such issues can occur when you offer namespace on the second-level domain. @1and1tecsec I wonder if you have existing mitigations to prevent future abuse, such as an abuse reporting procedure or some sort of detection that your company handles promptly. This would deter potential adversaries, especially as it will be added to the Public Suffix List. |
|
@groundcat They have different processes in place, depending on the maturity of the integration after the re-organization of our company. This includes internal sensors for detection, external reports, and feeds, to process reports automatically or manually in order to ensure a broad coverage of mitigation measures against abuse. Our products do integrate into those processes at different levels, from the classic "manual case handling" down to "automated lock of the corresponding file/directory/domain/webspace/contract/customer and on-call escalation". As many phishing cases are using fraudulent orders, fraud processes also have an important role to prevent phishing cases in the first place, in addition to the abuse processes mentioned above. The product using the domain app-ionos.space is somewhere in the lower mid-range of such integrations, but we're in the process of improving that to a more advanced level, so it reaches the same maturity as the other domains. |
|
simon-friedberger
added
✔️DNS _psl Validated
Public Suffix List (PSL) Pull Request (PR) Template
Each PSL PR needs to have a description, rationale, indication of DNS validation and syntax checking, as well as a number of acknowledgements from the submitter. This template must be included with each PR, and the submitting party MUST provide responses to all of the elements in order to be considered.
Checklist of required steps
Description of Organization
Robust Reason for PSL Inclusion
DNS verification via dig
Run Syntax Checker (make test)
Each domain listed in the PRIVATE section has and shall maintain at least two years remaining on registration, and we shall keep the _PSL txt record in place in the respective zone(s) in the affected section
Submitter affirms the following:
For Private section requests that are submitting entries for domains that match their organization website's primary domain, please understand that this can have impacts that may not match the desired outcome and take a long time to rollback, if at all.
To ensure that requested changes are entirely intentional, make sure that you read the affectation and propagation expectations, that you understand them, and confirm this understanding.
PR Rollbacks have lower priority, and the volunteers are unable to control when or if browsers or other parties using the PSL will refresh or update.
(Link: about propagation/expectations)
Description of Organization
The IONOS Group offers shared, dedicated, managed and cloud hosting and domain registration services, managing around 6 million customer contracts and more than 22 million domains. Roughly 2/3 of our customer base is located in Europe (Germany, UK, France, Spain, Italy, ...).
IONOS has essentially been around under various names for more than 2 decades (Schlund+Partner, 1&1 Puretec, 1&1 Internet, ...). After merging with more acquisitions (Fasthosts, Arsys, Strato, home.pl, World4you, ...) and some restructuring, IONOS has been spun off into a separate company with a new name.
The PR is submitted by Security Engineer Henrik Willert, acting on behalf of the Technical Security team of IONOS. This is a collaborative effort, mostly driven and made possible by Systems Architect Anders Henke and Software Architect Jonas Julino.
Organization Website: https://www.ionos-group.com/
Products Website: https://www.ionos.com/
Reason for PSL Inclusion
Customer instances of our shared web hosting products come with one or more free subdomains of a product-line specific domain.
Those subdomains allow customers to test changes without affecting their primary website. In some products, the subdomain is also used to configure a customer's individual instance. In all of those cases described below, those subdomains do host only customer-generated content and/or applications.
Common patterns for the WordPress-range of products are:
The (alphanumeric) string is usually derived from other user-provided information, such as a project or domain name.
One of our website builder products uses the following patterns:
A recent hosting product connecting GitHub repositories to fully-featured shared hosting webspaces does use the following pattern:
The ids for websitebuilder.online and app-ionos.space are automatically generated.
Each of those those subdomains mentioned above are independent instances and so should be treated accordingly:
A PSL inclusion should help with both of this.
Other products also do have further list of domains who should've been put on PSL a long time ago, but we're still evaluating what could possibly break and will file another request when we're ready to have them included.
To meet the 2y-criteria from #1109, we've been manually renewing those domains to the following registry expiry dates:
We also intend to keep those registrations in good standing and plan automating renewal according to PSL requirements.
Additionally, those domains are set to auto-renewal, so at worst: they'll renew during the last month before expiry.
Number of users this request is being made to serve:
We estimate that more than 600k customer instances are affected by the domains mentioned above.
DNS Verification via dig
Results of Syntax Checker (
make test)