Close
  • Latest News
  • Cybersecurity
  • Big Data and Analytics
  • Cloud
  • Mobile
  • Networking
  • Storage
  • Applications
  • IT Management
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
Read Down
Sign in
Close
Welcome!Log into your account
Forgot your password?
Read Down
Password recovery
Recover your password
Close
Search
Menu
Search
  • Latest News
  • Cybersecurity
  • Big Data and Analytics
  • Cloud
  • Mobile
  • Networking
  • Storage
  • Applications
  • IT Management
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
More
    Home Cybersecurity
    • Cybersecurity
    • IT Management
    • Networking

    Russian Spam Domains Increase After China Tightens Domain Registration Rules

    By
    Brian Prince
    -
    September 23, 2010
    Share
    Facebook
    Twitter
    Linkedin

      Spammers have increasingly been moving their operations to Russian domains since China’s domain regulator introduced tighter rules in 2009, security researchers say.

      The CNNIC (China Internet Network Information Center) changed some of its domain registration rules so that applicants are required to submit a formal paper-based application to a registrar that includes, among other things, a photocopy of the registrant’s identification. At the time, some security researchers predicted that the move would have the side effect of making Chinese domains less attractive for cyber-criminals seeking anonymity.

      And in fact, spammers have increasingly migrated to the Russian .ru TLD (top-level domain) to register their domains, reported M86 Security. In August, one-third of all unique domains M86 observed in spam were .ru domains, with nearly all of those being registered through two registrars-Naunet and Reg.ru. “This is the highest proportion of any TLD,” with .com coming in second with “just under one-third of spammed domains,” Gavin Neale, an M86 security researcher, posted Sept. 22 on the company’s Security Labs blog.

      “Spammers generally advertise each domain for only a couple of hours and register new ones all the time,” Gavin Neale wrote. “In the last month from spam alone we have seen over 4,000 .ru domains registered through Naunet. These are hosting a variety of spam Websites, including Ultimate Replica, Dr Maxman, online casinos, Via Grow and Eurosoft Software.

      “We have also seen over 1,800 domains registered through Reg.ru in spam over the last month, all of which lead to Canadian pharmacy Websites,” he continued. “Reg.ru actually has a feature to register up to 600 domains at once, pretty useful for a spammer.”

      The rules for domain registration in Russia are similar to other areas of the world, Bradley Anstis, vice president of technology strategy at M86, told eWEEK. The Internet community could do itself a favor and mandate what the rules should be, but the major issue is not the rules, but enforcement.

      “China has been trying to clean up its act, and good on them, they have made a change, the change is for the spammers to go back to where they used to be, Russia,” Anstis said. “They went to China because of very lax rules, or the complete lack of rules; also a lot of flexibility around automatically registering many domains at once, and doing it programmatically. As China tightened all this up and start actually enforcing these rules, this change has been the result.

      “This is perhaps an issue that the overall Internet community should take up. We need a consistent set of rules, and accountability for the enforcement of those rules,” he continued. “Another example of a rule or policy that is very lax in certain geographies is takedown requests to hosting companies or even registrars and answers to any questions on the activities of the same.

      “Think back a couple of weeks ago [to] the welcome news that Pushdo as a spamming botnet had been wounded with C&C server takedowns … but they were not able to take down 100 percent of the C&C servers, why? Because requests for action went unanswered to some hosting companies and registrars, and so they remained back online and the result is that Pushdo is back growing again.”

      Avatar
      Brian Prince

      MOST POPULAR ARTICLES

      Android

      Samsung Galaxy XCover Pro: Durability for Tough...

      Chris Preimesberger - December 5, 2020 0
      Have you ever dropped your phone, winced and felt the pain as it hit the sidewalk? Either the screen splintered like a windshield being...
      Read more
      Cloud

      Why Data Security Will Face Even Harsher...

      Chris Preimesberger - December 1, 2020 0
      Who would know more about details of the hacking process than an actual former career hacker? And who wants to understand all they can...
      Read more
      Cybersecurity

      How Veritas Is Shining a Light Into...

      eWEEK EDITORS - September 25, 2020 0
      Protecting data has always been one of the most important tasks in all of IT, yet as more companies become data companies at the...
      Read more
      Big Data and Analytics

      How NVIDIA A100 Station Brings Data Center...

      Zeus Kerravala - November 18, 2020 0
      There’s little debate that graphics processor unit manufacturer NVIDIA is the de facto standard when it comes to providing silicon to power machine learning...
      Read more
      Apple

      Why iPhone 12 Pro Makes Sense for...

      Wayne Rash - November 26, 2020 0
      If you’ve been watching the Apple commercials for the past three weeks, you already know what the company thinks will happen if you buy...
      Read more
      eWeek


      Contact Us | About | Sitemap

      Facebook
      Linkedin
      RSS
      Twitter
      Youtube

      Property of TechnologyAdvice.
      Terms of Service | Privacy Notice | Advertise | California - Do Not Sell My Information

      © 2021 TechnologyAdvice. All Rights Reserved

      Advertiser Disclosure: Some of the products that appear on this site are from companies from which TechnologyAdvice receives compensation. This compensation may impact how and where products appear on this site including, for example, the order in which they appear. TechnologyAdvice does not include all companies or all types of products available in the marketplace.

      ×