Slashdot Mirror
ICANN Asked To Shut Down "Worst" Chinese Registrar
Ian Lamont writes "Anti-spam service Knujon has released reports highlighting how certain registrars in the US and abroad have consistently failed to live up to certain WHOIS-related obligations under ICANN's Registrar Accreditation Agreement (RAA) — specifically, the requirement that people or company registering domains provide valid contact information. Now the firm is requesting that ICANN shut down the worst alleged offender, Xinnet Bei Gong Da Software. According to Knujon, none of the WHOIS records in a sample of 11,000 alleged spam sites registered through Xinnet and reported by Knujon to ICANN's Whois Data Problem Report System were corrected in a six-month period ending in May 2008 — and the Chinese registrar continues to register about 100 spam sites per day. In many cases, says the Knujon document (PDF), Xinnet does not have 'any Whois record data for review while the sites are still active' and the spam sites further promote 'seal abuse' by posting bogus BBB, Verisign, and other trusted industry seals. ICANN says it is investigating. ICANN has just posted a draft revised RAA that is open for public comment until August 4. However, the wording of Section 3.7.8, governing registrars' obligations to check and correct domain owners' contact information, hasn't changed."
Spam from China? GASP!
:(
ICANN has Chinese burglers?
If spam is a "whopper" of a problem, and burger king's "whopper" is a cheeseburger, then...
ICANN has cheezburger?
Funny aside: my captcha is "verified", something which these domains were not.
After an hour or so, though, you need to eat another one.
Which is to say... not at all.
I'm betting they will be about evenly tied with defensive Chinese expats (much smaller numbers but much stronger feelings).
"Seal Abuse"
wow did the mental giants who first thought up using an inline graphic to portray legitimacy ever consider that someone may.... save... said graphic and re-use it.
Snowden and Manning are heroes.
As it stands, I have observed some common practices of simply blocking traffic going to or coming in from IPs from certain foreign nations. For some businesses, this practice alone reduces a tremendous amount of spam without affecting normal business flows. It would also make sense for users and businesses to restrict all communications with peers outside of their borders if, in fact, it has no adverse affect to their business flows.
Ultimately, this could lead to a segmented internet where entire nations find themselves effectively cut off by policy.
I am undecided about whether or not this is a good idea, but if China and Russia won't stop their criminals, perhaps they shouldn't have a presence on the global internet. The message? Play nice or you won't be allowed to play at all! My guess is that internet sanctions would have much faster reaction than economic sanctions.
Korea to Hong Kong.
This includes taiwan.
Yet again, "ID cards" are proposed as a method to curb spam, at the expense of anonymous speech.
When are we going to actually fix our protocols?
http://outcampaign.org/
There's been a formal study of bad WHOIS data by the Government Accounting Office, the investigative arm of Congress, titled "Prevalence of False Contact Information for Registered Domain Names", on this topic. They found at least 8% of contact info in WHOIS to be totally bogus. They also, as a test of ICANN, submitted 45 "WHOIS information problem reports", of which 11 resulted in correction and 33 did not. But GAO didn't break down the data by registrar.
We've been interested in this issue at SiteTruth for some time. We take a broader view of "bad" web sites than most; we consider any commercial site that lacks valid business name and address information to be bogus. Over 35% of Google AdWords advertisers fail that test. For advertisers whose ads appear on Myspace, the ratio is much higher.
Originally, we tried to get contact information from WHOIS data, but the data quality was so appallingly bad that we had to develop another approach. We have a system that looks for contact info the way a user would, looking at pages with names like "About", "Contact", and such, trying to find a user-readable street address. We also have some big databases of business addresses to check against. This turns out to work much better than looking at WHOIS data when the goal is to find the business behind the web site.
(You can see this info using our AdRater plug-in for Firefox. Download our plug-in to see the ratings for each Google advertiser as the ads go by. Unless you're already blocking all such ads, of course.)
This is one reason why ICANN should be made completely independent of the USA government.
ICANN Wants to Shut Down a Registrar
and So Can You!
Not to be more anti-american than I have to, doesn't this show that the United States, in some sense, "owns" the internet? If not, why?
It would have been nice if the IP range would have been in the article, so that I can filter packets from that range in case ICANN somehow fails to block it.
It's ironic that they want domain owners to provide valid contact information in the belief that this will stop spam.
Before I moved to a registrar who provided free anonymous registration, I provided fake contact information specifically to prevent spambots from looking up my information in whois.
The only real solution, but not perfect either, is to send a physical confirmation letter (snail mail) to the address in question. The letter would contain a confirmation code that needs to be used to activate the account. Until that happens the account and domain would be reserved for one month before it is returned to the void.
What would be interesting is whether it would be possible to add some intelligence into the DNS server, which checks the whois database to find out who the registrar is. You could then use that as a method for flagging possible domains at risk, or not resolving them. Another approach would be to include this a plug-in for Firefox or other web browsers. The catch is providing the service without killing the whois servers.
Jumpstart the tartan drive.
Worst registrar EVER.
I've not really notice China/Russia being any worse for SPAM than elsewhere, but one thing I did notice is that they seem to be much more often the source of cracking attempts against my boxen both at home and work. Even if a lot of it is just SSH password-guessing (sorry losers, I don't allow root-level SSH so you can stop trying that username), a large portion of the IP's involved in this seem to original from China and Russia. Still, I couldn't tell you how many are direct, deliberate attempts and how many are already-owned machines trying to expand their little armies...
A well, there's not much iCANN can does about this, as one doesn't need a DNS entry to port-sniff and attempt brute-forcing passwords. Denyhosts is pretty good at handling this, although I'd to find something that works a little closer to the firewall level so I could have some fun with redirects and tarpits.
The problem with a lot of this is, WHOIS records themselves invite SPAM (conveniently having your email address available to spammers) or other issues. Personally, I'd rather not have some internet eTard with a hot temper and righteous indignation at something I posted online coming to hunt me down via my address in a WHOIS entry...
No, actually it really isn't ironic at all. The mechanism makes sense when one considers how many more internet users there are than internet domains. The purpose of requiring valid contact information is so that there is a valid mechanism for contacting the owners of domains that are being spamvertised. The reasoning behind this is simple - if the companies that benefit from spam are required to make their true contact information known, then a mechanism to take action against them is available.
Which is where the problem lies with the registrar mentioned by the article (as well as many others). If you don't know where a company is actually located, you have no mechanism to try to take action against them.
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
Guys, we have to hold on to this ISP, the fact is it is easier to have all the websites on one
ISP, then block that ISP from ever being allowed to show up in your browser, then it is to can them, and have to redo all the tracing work of where is this website now, and where is that one.
We have lost enough resources already fighting this,
we should leave them alone and let them think they are ok where they aren't.
This way I wont have to reconfigure everything all over again to block a new slew of ip addresses.
A few Chinese bad apples:
- HKDND
- yesnic
- easydns
- paycenter
And these are just a few bad registrars that I find by searching through a short collection of my spam.Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
Guess you've never owned a newer American car...
"When information is power, privacy is freedom" - Jah-Wren Ryel
why is that that I seem to get far more spam written by someone that obviously doesn't speak English as a first language?
I am not arguing the point you make, it just seems odd.
Are there really people dumb enough to click on some of these links? I guess there are or people wouldn't waste their time doing it.
Anyone that watches sports (esp American football) will know when they invent a drug that will make actually make your penis bigger...you won't find out via email...it will be every third commercial during the games.
last I checked, nearly every godaddy domain is registered by godaddy itself and not whoever the spammer is that's creating the site. That could be considered unlegitimate address info. Just to site one example - look at the same spade address for http://www.kirksvilletoday.com/ , a massive biggoted website... http://samspade.org/whois/kirksvilletoday.com
I emailed ICANN to suspend xinnet when I noticed that most of my spam came from their domains. First they wanted proof, then they sent back this:
04/05/08
ICANN has no authority to intervene in problems that concern the use of a
domain name. In some cases and depending of the law in the registrar's
and/or the registrant's country, the registrar might not have that
possibility either.
We therefore recommend you to contact a law enforcement agency in the
registrar's country.
Best regards,
Steve Gobin
Registrar Liaison Manager
ICANN Brussels Office
I told them that this was BS and that the registrar was obviously not following their rules and spamming 1/2 the world. If this was about copyright they would be in there swinging their big stick around in 10 seconds flat. I never got a response.
This is an issue of global network abuse. What, are the viagra people going to sue ICANN?
I have received lots of spam from these Xinnet-registered domains. I do get frustrated until I remember I've been getting spammed going on 12 or 13 years, never having once been able to get a blasted spammer in my sights... it's just one of those things you have to live with, it seems, since protocols aren't going to change and neither is the nature of many of our human cousins. Well, this is pessimistic, sure.
And then there is ENOM, a wholly American outfit, and I'm wondering why these folks (and I admire them their work, sure) aren't clamoring for that outfit to be cut out.
Take for example regupdate.net. I decided to one day get a packet dump of some odd UDP traffic that was coming in. Turns out it was from spoofed addresses claiming to be from Shaw Cable IP addresses and sent to windows messenger ports (1026-1028).
Please.note.that.once.you.visit.to.to.
RegUpdate.net.and.install.the..cleaner.
program.you.will.not.receive.any.more.
reminders.or.pop-ups.like.this.one...
RegUpdate.net..
Hah! This crap really gets my ire up.
So checking into this, I saw that they use round-robin A records and one goes to some InterNAP network space (Internap doesn't seem to care--I did contact them).
Domain Name: REGUPDATE.NET
Registrar: ENOM, INC.
$ host regupdate.net
regupdate.net has address 63.251.92.197
Internap Network Services NETBLK-PNAP-11-99 (NET-63 -251-0-0-1) 63.251.0.0 - 63.251.255.255
eNom INAP-WDC002-ENOM-1942 (NET-63-251-92-192-1)
63.251.92.192 - 63.251.92.255
You get redirected to 190.34.148.122, in Panama it seems. I wish I could say what stake ENOM has in this scheme, if any, but after awhile hearing about those creeps I'm willing to bet their hands are elbow-deep in some seriously ill behavior.
So, honestly, while I like that someone is yelling about Xinnet, I wish we could rid ourselves of more of these bad apples at home.
-Aaron