Coronavirus and the DNS: view from the .nl ccTLD

A new technical report that evaluates how the pandemic has affected DNS traffic at the .nl ccTLD

The coronavirus pandemic has caused major changes in the daily life of billions of people. We have released a new technical report that evaluates how the pandemic has affected DNS traffic at the .nl ccTLD and how crooks are attempting to profit from the current situation, by registering malicious domain names.

Huge rise in .nl domain name lookups

Coronavirus and internet traffic

We are living very difficult times. The Corona virus (COVID-19) pandemic has impacted the lives of a large portion of world’s population, not only with of those unfortunately infected by this virus, but also people otherwise healthy that have their lives styles changed after measures were enacted by governments to curtain the spread of the virus.

In Europe, many countries are in lockdown – including Italy, Spain and Belgium. Others, like Germany and the Netherlands, have seen their social activities spaces (bar, cafes, restaurants, gyms) to be closed, as well as schools and childcare facilities.

Such measures have caused major changes in the life of their citizens. In the Netherlands, since 2020-03-15, those who can are requested to work from home (among other measures). More people staying home and less things to do outdoors have led to an increase of internet traffic, as reported by various sources. Netflix, for example, has reduced temporarily the quality of their videos in Europe to not overload networks that cannot cope with the increase of traffic caused by more people staying in.

SIDN’s mission: keep .nl secure and stable

As a DNS registry and operator for the Netherlands’ .nl ccTLD, SIDN strives for maximum security and stability of the .nl zone. With this in mind, we release today a technical report presenting our preliminary analysis on if and how the Coronavirus has been impacting the DNS traffic we observe, and if crooks have been abusing the Coronavirus pandemic to register malicious domain names that attempt to profit from this current pandemic.

We found that the number of DNS queries has increased about 4% after the schools have been closed, and employees were requested to work from home (Week 12 in the figure below). That correspond to 560 million queries per day.

We also found the number of domain names registered on .nl with terms related to the Coronavirus pandemic in their titles increased significantly. Why most of them are regular domain names, a subset of them seem to be malicious ones, attempting to scam users into buying products related to the pandemic, which may never arrive (similar to the so-called counterfeit webshops). We have those currently under scrutiny.

Technical report

These are two of the results we present in the technical report. You find these and others in the technical report, publicly available on this website.

Downloads