Spammers Moving To Disposable Domains

Trailrunner7 writes "Spammers and the botnet operators they're allied with are continuing to adapt their techniques to evade security technologies, and now are using what amount to disposable domains for their activities. A new report shows that the spammers are buying dozens of domains at a time and moving from one to another as often as several times a day to prevent shutdowns. New research shows that the amount of time that a spammer uses a given domain is basically a day or less. The company looked at 60 days worth of data from their customers and found that more than 70 percent of the domains used by spammers are active for a day or less."

Comments

Good, it's costing them money

[Anonymous Coward]

Assuming they're not "tasting" it's going to cost them about $10 a pop.

Re:Good, it's costing them money

[fifedrum]

except they're using disposable stolen credit cards to pay for it, so really, they don't care about the $10 a pop.

Re:Good, it's costing them money

[Ambiguous Puzuma]

except they're using disposable stolen credit cards to pay for it, so really, they don't care about the $10 a pop.

Not sure why parent is modded funny; there is likely a lot of truth to it. Sony Online Entertainment discovered this:

It isn't just issues of game balance and gold farming, Smedley says. "We're seeing a lot of stolen credit cards. Say you buy gold from a service in China -- you may not know it's in China, but you give them your credit card and buy gold only once. They use these credit card numbers to set up new accounts in these games. They buy an EverQuest account key, farm for a month, and then charge it back to the stolen credit card."

And this isn't just damaging to the consumer. "What happens is that over time, as that rate of chargebacks rises, we start getting fined. We have been fined over a million dollars since June. That's not the chargebacks themselves -- just the chargeback fine. It's brutal; it's the dirty little secret of the industry."

These temporary accounts, paid for with stolen credit cards, are additionally used to spam in-game (although spam filtering has improved the situation significantly).

It would not surprise me in the least if this applied to temporary domain registration for spam/malware purposes as well.

Re:Good, it's costing them money

[socz]

You hit the nail on the head! Domains in bulk are a lot cheaper. I'm getting a decent deal with about 8-10 domains, but I know it could be better if I had more! So they're probably buying them up in 100's at a time (I would!).

But, what I suspect could be happening, is that they're actually working with a top level registrar who can get them at the cheapest price possible and probably gets a % back of what the spammer makes. Just a thought.

so a new rule for email filtering?

[TravisHein]

in addition to a commonly accepted practice of doing a reverse domain name lookup on who is sending you email, where by rejecting email from bogus domains, no domain, to now also have the mail server also do a whois lookup, and arbitrarily reject email from a domain that has been registered less than a few days ago?

Re:so a new rule for email filtering?

[2obvious4u]

Almost, they could have registered it weeks, months or even years earlier. You would need to see if it had X days of activity. I don't know how you would do that.

Re:so a new rule for email filtering?

[fifedrum]

there are email reputation providers out there who can tell you things like that. It may even be free (it is for us anyway)

Re:so a new rule for email filtering?

[fifedrum]

This is the way our reputation provider works: If the IP hasn't been seen delivering email before (no matter it's age), it has a 0 reputation. The more email that is processed the higher the reputation and the reputation is, of course, modified down by complaints. The more complaints,the lower the reputation. Think feedback loop, or where your email goes when you click "mark as junk."

If someone else wanted to get into the game, services like spamcop could be used (who knows, maybe can already be used?) to determine domain name reputation by keeping an independent database of domain names and keeping the ratio of good to bad email handy for rapid lookups, maybe in something like dnsrbld type lookup table. It's the same as IP reputation engines, just with text domain names.

Maybe someone alread does. I know our antispam provider keeps a level of spaminess for domain names, but those are for domains that already exist. You would have to determine by policy what to do with domains that don't have a reputation.

That and implementing tighter SPF and DKIM will help eliminate this stuff.

Flag email that comes from new domains

[harmonise]

Score email higher that comes from newer domains. The older the domain, the lower the score. I'm thinking spamassassin scores here.

Filtering out new domains?

[HikingStick]

They obviously are making enough money to afford the registration fees. I wonder if there would be a way to greylist/blacklist new domains, though that simply might mean that spammers would sit on the domain for a period of weeks or months before using them. Still, would there be a way to flag young domains so that they end up with higher scores in various spam filters?

Persistent little bastards...

[sixteenbitsamurai]

It's like an underground revolutionary movement, except selling male enhancement products.

been happening for years

[fifedrum]

As an SA at a hosted email provider I see this on a daily basis and could list several hundred domains just from the last few days' worth of reports. They hit the big registrars, attempt to automate as much as possible, create dozens of email accounts per domain, and turn on the spigot disposing of the domains immediately in the case of sending domains, and putting off the demise of the web domains as long as possible.

Fortunately, the activity levels of the greedy spammers far outstrips the activity levels of the normal user, that said, we still see occasional drip spammers.

Long ago I proposed a pay-per-view spectacular. Pasty faced pudgy sysadmins from around the world get air dropped onto an island studded with cameras and stocked with spammers and 419 scammers... Viewers can then vote online which sysadmins get which weapons. (Please gentle viewer, let me have the M1)

Re:been happening for years

[ajlitt]

Ah, the cluebat. An elegant weapon for a less civilized luser.

This is a new technique?

[interval1066]

I could have sworn they have been using this one for a few years now.

Validate domain ownership

[Animats]

When you buy a domain, you should be mailed a letter with an activation code, sent to the registrant address. No valid mailing address, no domain activation.

Re:Validate domain ownership

[fifedrum]

to which they'll use mules

really, there's no way around this that can't also be worked around by the spammers. Every single step is met by counter action and evasion. The only thing that works is jail time.

Re:Validate domain ownership

[BitZtream]

Mules at a known valid address are far easier to trace than stolen credit cards.

This is news???

[Eggplant62]

They've been doing this since 1999 from my personal memory aiding the antispam fight. What suddenly brings this back to the fore as if it were some stunning revelation? It's an old trick that Alan Ralsky used when he was scamming and spamming.

Changing domains or changing servers?

[NevarMore]

Its pretty trivial to have 10000 domain names pointing to 10 servers.

It also seems trivial that when a domain name is flagged to also flag its server, then when a new domain name shows up that points to a flagged server rate it appropriately.

Its a clever trick, but hardly an unfightable step in the spam-arms-race.

ahhh, but what are the resolved addresses?

[swschrad]

if, for instance, they keep coming from the block reserved by {scumpuppy.net}, for instance, you know who to blacklist by range.

One maybe bad aspect of IPv6?

[JSBiff]

This got me to thinking. In a world where IPv6 provides an astronomical number of subnet blocks, what's to keep spammers and malware distributors from jumping from IP block to IP block the way they jump from domain to domain?

Re:One maybe bad aspect of IPv6?

[shentino]

To make a TCP connection both ends have to have routable addresses.

Sooner or later either they'll all have common subnets, or they'll cause a noticeable spike in routing traffic.

Re:Can't say I'm surprised

[Zemplar]

... assessments about my lack of adequate manhood.

So you're the one! I've got a bunch of email that must belong to you.

I don't understand spam folders

[XanC]

This is why spam folders should be Considered Harmful. Effectively, it's a delivery failure without a notice. You should either accept mail or reject it, not pretend to accept it and then stash it someplace where nobody reads it.

Using a spam folder treats outright, obvious spam with more courtesy than the borderline stuff.

EOL?

[BrokenHalo]

Maybe this is a symptom of the beginning of the end for the professional spammer. If the whole thing ends up being more trouble than it's worth, maybe these asswipes will look for an alternative source of income.

Probably premature, I know, but we can hope...

No!

[night_flyer]

Really? Are you serious? And this is news how?

Levels of accountability

[aapold]

If a bar sells beer to an underage person, they get in trouble. Roll the layers back and put it on them to institute their own methods of verification or face consequences for not doing so. As it is, they practically have a vested business interest in continuing to sell them these domains.

Mod parent (and GP) up.

[khasim]

IPv6 will cause a huge problem with existing blacklists.

It won't cause any problems with whitelists (which should be checked PRIOR to the blacklists).

But they're still going to have to go through routers. So we're going to have to work on hacks that identify the routers that the communication is traversing. Then you should be able to see the "gateways" to the spammy networks and adjust the scoring.

Not Even Remotely New

[damn_registrars]

Anybody who has ever really looked at the spam they've received knows this has been going on for years. Spammers buying domains in bulk for quick switching is a very old game. Fortunately as this gets more attention we get a little bit closer to paying attention to something we can do something about (for a little while longer anyways):

Registrars. We have often pointed to the spammers, the ISPs, and the spamvertised domains as groups who make money off of spam. We have for various reasons frequently overlooked the registrars who are taking in a profit on the deal as well. There have been registrars in bed with spammers for almost as long as we have had spammers.

The big difference though is that we could do something about the registrars - if we really wanted to. The registrars are supposed to keep valid data on their customers, and are supposed to adhere to specific ICANN guidelines (at least for specific TLDs). If the registrars couldn't register anything in the TLDs they want, they would think twice about knowingly dealing with spammers.

The 'tasting' comments confirm, this is not new.

[rickb928]

I've been seeing this for at least five years. First, tasting was the preferred method. Now it seems some serious spammers have an 'in' with a registrar, where by the time I get to looking up the whois, the domain is gone and no longer registered. Not even the previous whois is available.

I can't imagine that allowing someone to register a domain for a few days or even less, and then deleting all trace of the registration, is permitted by ICANN, but they haven't been able to police registrars very well at all for a decade now. Between the obvious front-running, search scanning, and tasting scams, most registrars are just plain shady. A pox on them all. It's gotten to the point that when someone asks me to look up a domain to see if it's available, I tell them to make the decision, and I will try to register it for them. For a while now, EVERY domain I've checked on was available when I looked it up, and minutes later it was gone.

I'm not the dullest turnip to fall off the truck last night. Front-runnng is a scam. Disposable domains are not new. This article is at least 5-6 years late.