How to get a domain unblocked from Akamai's Nominum?

Question

I recently purchased a domain and set up hosting at AWS for the root and a subdomain for the static asset files, set to CloudFront.

After a brief public test, I received many issues from customers saying content was being blocked by ISPs. After deeper investigation, it appears the root of the problem is Akamai's product Nominum has blocked the domain for malware. Because the domain is so new to me, I assume it was blocked prior to my owning it.

I've reached out to abuse@akamai, called their support line, chatted with their sales people and pinged them on Twitter, all to no avail.

Does anyone know how to get a domain unblocked by Nominum?

Answer 1

Yes, the problem is indeed with the Akamai Nominum blacklist, and we have been having this issue for over 5 years with no resolution. The issue is that they are using the Suppobox DGA list supplied by Bambanek, and blocking any domains that appear on that list. The issue is that this list is just a mashup of words, and has a very high false positive rate: https://osint.bambenekconsulting.com/manual/suppobox.txt

"FALSE POSITIVE RISK: High

OTHER NAMES KNOWN AS: none

Suppobox is a word based DGA and as such, can have many collisions with legitimate domains. In the case of Suppobox, this risk is high. The DGA is date and time seeded using two wordlists to create the domains. All domains end in .net."

It's been very frustrating trying to get whitelisted by Akamai. Eventually I managed to contact an executive at Akamai and he managed to get us onto their global whitelist. However, after a few years the blocks started happening again, and Akamai refuse to even talk to us. I sent a cease and desist letter to them, which they received, but that hasn't stopped the blocks.

The only solution is to contact ISPs who use Akamai's DNS, and get them to whitelist your domain.