Categories: SecurityWorkspace

Russian Domains Increase As China Cans Spam


Spammers have increasingly been moving their operations to Russian domains since China’s domain regulator introduced tighter rules in 2009, security researchers say.

The CNNIC (China Internet Network Information Centre) changed some of its domain registration rules. Now, applicants are required to submit a formal, paper-based application to a registrar that includes, among other things, a photocopy of the registrant’s identification.

At the time, some security researchers predicted the move would have the side effect of making Chinese domains less attractive for cyber-criminals seeking anonymity.

Rushing To Register

In fact, spammers have increasingly migrated to the Russian .ru top-level domain (TLD) for registration, reported M86 Security. In August, one-third of all unique domains that M86 observed spamming were .ru domains, with nearly all of those being registered through two registrars – Naunet and Reg.ru.

“This is the highest proportion of any TLD, with just under one-third of spammed domains,” Gavin Neale, an M86 security researcher, posted on the company’s Security Labs blog. The .com domain came in second

Spammers generally advertise each domain for only a couple of hours and register new ones all the time,” Gavin Neale wrote. “In the last month from spam alone we have seen over 4,000 .ru domains registered through Naunet. These are hosting a variety of spam Websites, including Ultimate Replica, Dr Maxman, online casinos, Via Grow and Eurosoft Software.

“We have also seen over 1,800 domains registered through Reg.ru in spam over the last month, all of which lead to Canadian pharmacy Websites,” he continued. “Reg.ru actually has a feature to register up to 600 domains at once, pretty useful for a spammer.”

The rules for domain registration in Russia are similar to other areas of the world, Bradley Anstis, vice president of technology strategy at M86, told eWEEK. The Internet community could do itself a favour and mandate what the rules should be but the major issue is not the rules, it is enforcement.

“China has been trying to clean up its act, and good on them, they have made a change. The change is for the spammers to go back to where they used to be, Russia,” Anstis said. “They went to China because of very lax rules, or the complete lack of rules; also a lot of flexibility around automatically registering many domains at once and doing it programmatically. As China tightened all this up and start actually enforcing these rules, this change has been the result.

“This is perhaps an issue that the overall Internet community should take up. We need a consistent set of rules and accountability for the enforcement of those rules,” he continued. “Another example of a rule or policy that is very lax in certain geographies is takedown requests to hosting companies, or even registrars, and answers to any questions on the activities of the same.

“Think back a couple of weeks ago [to] the welcome news that Pushdo as a spamming botnet had been wounded with C&C server takedowns…  but they were not able to take down 100 percent of the C&C servers. Why? Because requests for action went unanswered to some hosting companies and registrars and so they remained back online and the result is that Pushdo is back growing again.”


Brian Prince eWEEK USA 2014. Ziff Davis Enterprise Inc. All Rights Reserved

Share
Published by
Brian Prince eWEEK USA 2014. Ziff Davis Enterprise Inc. All Rights Reserved

Recent Posts

Amazon Pumps Another $2.75 Billion Into Anthropic

Amazon completes its $4bn investment into AI firm Anthropic, after providing an additional $2.75bn in…

14 mins ago

The Sustainability of AI

While AI promises unparalleled efficiency, productivity, and innovation, questions regarding its environmental impact loom large.…

3 hours ago

Trump’s Truth Social Makes Successful Market Debut

Shares in Donald Trump’s social media company rose about 16 percent after first day of…

3 hours ago

Dutch PM Raises Cyber Espionage Case With China’s Xi

Beijing visit sees Dutch Prime Minister Mark Rutte discuss cyber espionage incident with Chinese President…

4 hours ago

Vodafone Germany Confirms 2,000 Job Losses, Amid European Restructuring

More downsizing at Vodafone after German operation announces 2,000 jobs will be axed, as automation…

20 hours ago

AI Poses ‘Jobs Apocalypse’, Warns Report

IPPR report warns AI could remove almost 8 million jobs in the United Kingdom, with…

21 hours ago