US Web Firm Described As "Phantom Registrar" Haven
snydeq writes "InfoWorld's Martin Heller directs attention to ongoing investigations of more than 40 phantom registrars linked to The Directi Group, including PDR, one of the 10 worst offenders on the Net. According to KnujOn, an additional 19,000 domains advertised through spam have been hiding their ownership behind PrivacyProtect.org, which The Washington Post has outed as Directi-owned. Directi claims it suspends illicit domains, but KnujOn provides documentation suggesting that Directi reports the registrars suspended and then reinstates them at another IP address. 'There has been some outcry about all this from the ICANN At-Large Committee, but as of this writing there has been no response from ICANN's Tim Cole,' Heller writers. 'Perhaps that has something to do with the fact that LogicBoxes, a Directi-owned registrar, has sponsored ICANN meetings in L.A. and Delhi.' Directi has since issued an official response to the allegations."
Shocking.
you misspelled pantom
Quite simply, even if they shut Directi down, another company will take over the job of hiding the spammers for one simple reason: money. The spammers can afford to pay a company to hide them because they are making bank. Amazingly, about 1% of all spam emails actually result in a sale! So if you send out 1,000,000 emails, you can expect 10,000 sales! If people would just stop buying shit from spam emails, this wouldn't be a problem.
Now on the other hand, why do we even bother to try to pass spamming laws? Talk about another waste of time and money. If we pass a law saying all spam email must contain the words "unsolicited email" in the subject line, everyone will set their servers to block such email and therefore the spammers will certainly not put that in the subject line. So now we have to spend even more money to try and track the spammers down, which in essence we can't do because they pay companies like Directi money to hide their domains, IPs, etc.
Bottom line, this is an endless loop, and if anyone has any REAL suggestions on how to get rid of spammers, or how to force companies to stop hiding them and their domains, I'd love to hear it.
Reminds me of that one PVP cartoon, except replace normal person with capitalism.
Anything to make a buck..
Are you serious?
Come the revolution, the Bourgeois, Capitalistic, "A PARKING STICKER HOLDERS", will be first against the wall!
Make sending unsolicited mail slightly criminal. Say, one minute in prison per recipient. 1M spams would be 695 days in jail.
Spam and viruses cost people money that they could have spent elsewhere. When a company buys a spam filter and hires people to run it, that's money that could have been profit or could have been spent on something useful to the company. Maybe that budget could go to making the health insurance a bit cheaper. Or give the receptionists a raise. Put a foosball table in the break room. 1K$/year is 1K$/year too much to spend on something you never wanted. Spammers are making people/companies/agencies throw away time and money. The only way to not get spam is to not have an address.
Hell, make it the penalty the sum of the amount other peoples time they wasted, 1 second per recipient. Even that would get people to think twice.
Alas, the spam from outside the US and extradition friendly countries would not be unabated, but it would be something.
Maybe such a law would be wrong/unethical, but it would give us some kind of satisfaction. i don't know, i'm speaking mostly out of frustration here. When i was a sys admin dealing with spam was a frustrating waste of my time and the time of my users.
Any law grokkers on hand to tell us what laws and penalties are in place?
Utilizing the synergization of benchmark e-solutions to pre-workaround action items!
On a related note, Spamhaus recently issued this statement about Atrivo/Intercage, US-based persistent criminal spammer hosts. In the news.admin.net-abuse.email newsgroup, Steve Linford of Spamhaus indicated they made this statement because they are highly frustrated with law enforcement's inaction.
"Other Online reports further claim that these 48 registrars are involved in illicit activities.
This allegation is made without providing ANY evidence to corroborate the same. This statement is grossly inaccurate. The reporters did not bother to support such claims with any factual evidence, nor contacted us for clarification"
So it's inaccurate. Which part? The number of registrars or the illicit activities portion?
Al Capone was prosecuted and imprisoned because he failed to pay his taxes. Use the same tactic on spammers. Subpoena the customer list of these registrars under conspiracy to avoid taxation. Then audit the taxes of all the domain owners.
These types of registrars and domain owners will no longer have a viable business if the expense of avoiding the government is too high. This would also be a useful method of giving lawyers something to do and stop bothering us normal people (with NewYorkCountryLawyer as an exception of course).
Every mans' island needs an ocean; choose your ocean carefully.
I've been doing some digging into this over the last few months and noticed an awful lot of spamvertized sites seem to have their domains registered with such privacy protecting registrars.
I've been thinking about how to use the fact that a domain is registered with such a registrar as part of a spam scoring metric and whether anyone else has already done work on this? Just on the mail passing through my systems, I'm seeing a very strong correlation between a mail being spam and it referring to a domain registered with such a registrar, with the domain nameservers being on dynamic IP space, and with the DNS for the spam domain having a very low TTL value set.
It's also interesting to track back the nameservers for any domains referred to in the NS records of the spam domain. By doing so I can find fairly large networks of interrelated spam domains and spam websites, the addresses of many of which already appear on the likes of the Spamcop and Spamhaus SBL/XBL lists or appear there shortly afterwards.
The point is, is it practical to use this sort of information against spammers and is anyone already doing it?
Apparently, Bhavin Turakhia Founder, CEO & Chairman of Directi "...also serves as a technical advisor to the local CyberCrime Investigation Cell" it says on the Directi website.
Ha Ha Ha Ha Ha Ha! Sometimes you can't beat real life for a great laugh.
Hold on, it also says,"Directi operates various online web properties and web services. To report any form of abuse activity (spam, phishing, adware etc) with respect to any Directi service simply send an email to abuse [at] directi [dot] com"
Argh, ha ha, oh dear, oh dear, I think I'll never stop laughing...
Bad credit.
Simply give them a sentence of a 5 year bad credit report. No more loans, no more credit-cards etc etc.
If you can't handle money responsibly, you get a warning period in which you can't spend any money easily.
It keeps the jails for real criminals, protects people from themselves while still being a massive deterent.
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
In the Directi response, "# The report claims that âoe48 ICANN-accredited Registrars (affiliated with Directi) ⦠do not seem to exist and are phantom.â
This statement is factually incorrect, and was completely unverified by Knujon. Knujon did not even bother to contact ICANN in this regards to get the right facts. The truth of the matter is that all 48 companies which belong to Directi and its clients, are in existence and are duly incorporated and validly existing under law."
IANAL, but I don't think phantom corporations are illegal in the USA. There seems to be plenty of corporations that exist only as a name on a piece of paper. So, yes, given this, they are right in saying that they validly exist. That does not address the fact that the companies may in fact be phantoms and appear to be a rather inappropriate way of doing business.
Bearded Dragon
Disclaimer: DirectI is the wholesaler for my micro registrar company, http://gopedro.net/ , which I have discussed here in Slashdot in the past.
Yesterday DirectI issued a rebuttal to these accusations:
http://blog.resellerclub.com/2008/09/04/our-official-response-to-malicious-reports-which-falsely-implicate-the-directi-group/
The privacy protection for WHOIS is a necessary evil. I am tired of getting letters from the "Domain Registry of America" telling me that I need to renew my domains, usually at triple of what I actually charge my own customers. With privacy protection in place, this kind of scam dies.
I have zero knowledge of what any spammers may or not have done while customers of DirectI, but my personal, first hand experience is that this is a company that has never let me down in over four years, have always been prompt with their technical and billing support and have been nothing but pure joy to deal with.
Pedro
----
The Insomniac Coder
Isn't this domain hiding a GOOD thing? Isn't this one of our few remaining protections against oppression? I think this is a bad cause to get behind. I wouldn't let SPAM -- a mere inconvenience and resource drain -- mean the end of privacy mechanisms. I'd quote Ben Franklin here, but I think you already know what I'm getting at.
Anyhow, the response to SPAM by the government is wrong. The solution should be technological, not legal. I think people should be free to send whatever unsolicited messages they want, and that technology should be used to protect would-be recipients from the unwanted nuisance. Seriously, people simply need to choose a messaging system that is different than the obsolete "e-mail" mechanism. I'm happy with the old e-mail system for now, because SPAM filters based on content analysis, etc, keep me from seeing any of it! But if e-mail SPAM ever starts to annoy me, my response will be to SWITCH TO A CAPTCHA-PROTECTED BLOG (or something similar), rather than support penalties for spammers!
People should have been more vigilant about inviting government to turn Internet packets in to crimes. Sure, the masses might like the idea of annoying spammers getting fined and getting put in jail -- and it's easy to say: "If they couldn't [pay the fine/do the time], then the shouldn't have committed the crime", but, think about it: Certain uses of the Internet are now criminal, and the government now has a role, and an interest in legislating more restrictions and requirements to make it easier to enforce the laws that the people initially asked for.
So, we have ideas like "Internet tax" and "banning off-shore, online gambling" and "monitoring traffic for child porn (and, hence, anything else)" and "the ability to snoop on VoIP", etc.
Stop thinking of spammers as CRIMINALS. Stop thinking of SPAM as a problem caused by criminals. Stop being a victim and shifting responsibility to the government to "fix" the situation. The "problem", if you choose to think of spam this way, is with E-MAIL. Switch to a web-page based blog-like system, and require unsolicited messages to be posted by entering a CAPTCHA, just like every blog in existence. The problem of a flood of unsolicited messages is solved, while people who genuinely want to contact you get through with little inconvenience. Messages from known users can be filtered with your own "white list". Anyhow, the key is to make the process for sending unsolicited e-mail messages different from messages sent from known senders. Messaging systems simply need to make this distinction. Requiring the sender of the unsolicited message to interact "live" with the intended receiver's server, and respond to the spontaneous challenge of a CAPTCHA, will almost entirely eliminate messages intended for indiscriminate bulk distribution. (Some marketing firms might hire humans to solve CAPTCHAs, or they might devote racks of PCs to try to solve CAPTCHA challenges, but that's a huge investment on their part, and simply making your CAPTCHA have additional random variation makes the idea of automating an attack suitable for spamming the masses economically unrewarding.)
I dislike spam, but trying to stop it with laws and various hacks (content recognition, blacklists, etc) is futile. E-mail is simply too open to attack. Sure, it's not "right" that people should choose to exploit the weakness of e-mail, but the Universe doesn't care about our feelings of justice; there will always be people who will, for malice, profit, accident, stupidity, sadness, fame, power, etc, exploit e-mail, and they'll find some way to do it. Meanwhile, a mere CAPTCHA, despite stories about how some computers can (barely) solve them fast enough to make spamming economically viable, can easily make it totally futile for the idea of unsolicited bulk messaging to work anymore! The solution is the CAPTCHA on the RECIPIENT server, not laws or filtering technology. Kill spam by moving away from "e-mail"; it will be the end of an era, and poor souls who, for whatev
Isn't that the registrar for Google hosted websites?
Help a man when he is in trouble and he will remember you when he is in trouble again.
what's this spam you speak of?
regards,
ac@gmail.com
First of all spammers don't get a 1% conversion rate (sales), a lot of legitimate businesses don't even get that from their own targeted email lists. They get a 1%-3% click-through rate, which than leads to another 1%-3% conversion rate.
So at best your looking at 1,000,000 emails leading to 30,000 clicks and then to 900 sales. And again 3% for both would be absurdly high for spam. Your real conversion number for 1 million un-targeted email addresses is going to be a lot closer to 100 than 900. The reason they can still make money with such small numbers is because there is no significant upfront cost for sending email to millions of random email addresses.
If email cost $0.001, that's one tenth of a penny, per recipient, it wouldn't cost your average user anything significant but it would cost your hypothetical spammer $1000.00 for a million addresses. That's a very significant upfront cost and would kill almost all spam instantly.
After that we can start instituting tokens for legitimate email lists like newsletters, or simply setting up something like a white list so email from authorized senders doesn't get charged. There would still be enough random email to generate a nice revenue stream for the email overlords that take it on while still being cheap enough to be thought of as free.
goes to show EVEN ICANN can be bought
and illegal to block ,within days or weeks the average user will get 2000 spams a day forcing isp's to implement whitelisting and users to accept whitelisting any email address without it will be unusable in days.
when only a couple spams get thru a day users will read them when 3000 spams get thru a day users are forced to just delete them.
We have no right of privacy when registering a domain. Big brother wants to know all.
This reminds me of the Mexican immigration debate. Rather than to crack down on the companies employing the immigrants, the police arrest individual workers who came here to work. The companies creating the incentive for workers to come to the US generally get off scott-free.
In this case, it's rather than cracking down on the spammers and the companies benefiting from the spam -- and an increasing amount of my spam is "mainstream"/large corporate spam -- the gov't will crack down, killing my privacy, and hinder me from hiding from the spammers.
Actually nail the spam companies and the companies making spammers rich? Naww, that ain't the way it's done in the land where corporations run the gov't.
They are exercising their freedom.
It may be modern art, or postmodern theory, or avantgarde poetry -- but you see it as spam.
The problem is that your interpretation is that... just an interpretation! There is no objective reality, even known relativistically, for it to correspond to.
Reality is anything you want it to be.
Spam might be the most genius works of our culture, and you would ban it.
Only Hitler is anti-spam. Stand for freedom: stand up for spam!
Anti-Globalism, Traditionalism, and FreeBSD.
I'm going to go ahead and disagree here.
Timothy is probrably the least bad of the bunch.
I was getting a lot of spam which had links redirecting to this scam site. It was one of those sites that does a fake virus scan and claims you're infected so they can sell you a bogus product (funny how it was scanning windows-related files on my Linux system, eh).
I sent the offending URL to privacyprotect and was surprised when they actually responded by pulling the spammer's protection, then forwarding the info to his ISP and having the domain itself pulled (the nameserver has been changed to "ns1.suspended-domain.com" and DNS no longer resolves).
This is simply an illustration — the privacy we fight for for ourselves is also very handy for crooks. Be they the "traditional" criminals, whose conviction is thrown out, because the cops did not jump through all of the hoops authorizing their surveillance and other privacy-busting aspects of investigation... Or be they spammers, whose identities are hidden by the same means, intended (or purporting) to keep private identities of honest domain owners.
So, if a terrorist can escape prosecution due to "prosecutorial misconduct" and become a professor of an otherwise reputable University (and a chance of counting a President among his friends), is it any wonder, a spammer can reappear under a different name every week with impunity?
I'm not saying, we demolish the privacy protections or stop punishing overzealous prosecutors. Just reminding of the flip side of it...
In Soviet Washington the swamp drains you.
...and take all their property, bank accounts, and also toss them in prison for a minimum of 5 years, no club fed, hard core prison.
Any company found to have conspired with the spammer would receive the same treatment as a "partner" in the illegal act.
If the offense is also spreading viruses, Trojans, or worse, then we can toss their asses in to the fire by adding a long term of service in the military digging ditches and poking through soil to remove land mines in areas full of them...
terrorism. There problem solved. Time to use that Patriot Act and DMCA to the fullest extent of the law.
Registrars have chosen to establish shell corporations for the express purpose of gaming the domain name aftermarket. More accreditations equate with additional access to registry queues and thus an increased opportunity to secure expiring domain names. Directi is not the only organization that has set up a bevy of these corps; there are many other registrars with multiple accreditations engaged in the same game.
At issue is the concept of establishing a level playing field. Most users are unaware that certain registrar "families" have 100+ shots at the registry queue while other registrars have only a single time at bat.
The fault, of course, is in ICANN's accreditation process that enables this set of circumstances. In the future, you can count on these phantoms gaming the new gTLD landrush cycle (just as happened during the .eu landrush).
A year and a half ago ICANN's CEO called for a comprehensive review of the registrar accreditation process in the wake of the RegisterFly meltdown. That review has still not been published.
Directi shouldn't be faulted for playing within the established rules, rather ICANN should be blamed for not having implemented necessary changes to the registrar accreditation process that could thwart the unacceptable gaming currently underway.
Your post advocates a
( ) technical ( ) legislative (x) market-based ( ) vigilante
approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)
( ) Spammers can easily use it to harvest email addresses
(x) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
( ) It will stop spam for two weeks and then we'll be stuck with it
( ) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
( ) Requires too much cooperation from spammers
( ) Requires immediate total cooperation from everybody at once
( ) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
(x) Anyone could anonymously destroy anyone else's career or business
Specifically, your plan fails to account for
( ) Laws expressly prohibiting it
( ) Lack of centrally controlling authority for email
(x) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
(x) Asshats
(x) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
( ) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
(x) Armies of worm riddled broadband-connected Windows boxes
( ) Eternal arms race involved in all filtering approaches
(x) Extreme profitability of spam
(x) Joe jobs and/or identity theft
(x) Technically illiterate politicians
(x) Extreme stupidity on the part of people who do business with spammers
(x) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
( ) Outlook
and the following philosophical objections may also apply:
(x) Ideas similar to yours are easy to come up with, yet none have ever
been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
( ) Countermeasures must work if phased in gradually
( ) Sending email should be free
( ) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
( ) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
( ) Killing them that way is not slow and painful enough
Furthermore, this is what I think about you:
( ) Sorry dude, but I don't think it would work.
(x) This is a stupid idea, and you're a stupid person for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your
house down!
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
It seems to me that directi is being unfairly targeted for the same practices that all large registrars follow.
PrivacyProtect.org is not a unique service of its kind, similar services are offered by every large registrar (see http://en.wikipedia.org/wiki/Domain_privacy).
Examples are:
1. Go Daddy -- https://www.godaddy.com/gdshop/dbp/landing.asp?ci=9002
2. Enom -- http://www.enom.com/privacy-protection/domain-name-whois-privacy.asp
3. Network Solutions -- http://www.networksolutions.com/en_US/name-it/private.jhtml?siteid=100&channelid=P68C100S1N0B2A1D231E0000V106&clickid=1000000000
Also, some of the ways these conclusions have been arrived at are a bit tenuous and improbable.
Just because ESTDoamins and other spammers use privacyprotect doesnt make directi complicit in their act.
Directi is not apparently an American company.
Check out the the Flicker site attached to their "official response". They are located in India. They're an Indian company.
Nah, he's a comrade who works with the same organization (CORRUPT).
When you think about it, modern life IS spam.
* Movies like Burn After Reading: you learn nothing, you laugh a little at recycled jokes, six months later you don't even care. It's brain-spam to keep you from noticing how much your life sucks.
* Fast food is clearly caloric and nutritional spam, but it's also a spam meme. "I need food quickly" should mean "make a sandwich."
* Sex is spam. Get drunk, find some random slag in a bar, and then afterwards you're thinking you should be happy because all your friends will no longer think you're a loser because you had sex. Brain spam.
* Politics is spam. The same lobbyists own all the candidates, so they make a cute little show before deciding which industries need support this year.
The only difference is that people think they want this spam instead of radical spam, which only 29% at any given time think they want.
Anti-Globalism, Traditionalism, and FreeBSD.