Anonymous domain registration nixed amid fraud complaints

Directi strikes back


A company that provides a controversial service to domain name registrars says it is severing ties with Estdomains amid complaints that the Eastern European company makes it too easy to register sites that are used by spammers and scammers.

Directi, through a subsidiary called LogicBoxes, had been providing an array of products and services to Estdomains, including one known as PrivacyProtect, which shields the identity of domain-name owners. Critics have long claimed it is used by operators of sites that engage in spam, malware and other illegal acts.

About a month ago, Directi amended its relationship with Estdomains and stopped providing the Estonian registrar with the PrivacyProtect service, company officials said. While PrivacyProtect is used by many registrars, they say most of the abuse came from customers registering sites through Estdomains. That, in turn, prompted Directi to terminate its agreement in hopes that anti-fraud proponents would stop targeting the service.

"Just the reputation loss and the confusion because of these linkups has been more detrimental to us than the commercial gain from that one-off sale," said Directi CEO Bhavin Turakhia. "We felt it was the right move morally."

Turakhia's comments came in response to an El Reg article published Tuesday that he takes strong exception to. Among other things, he strenuously contested the claim made by security researchers that LogicBoxes is associated with network provider Atrivo, which the researchers found to host malware, malicious websites and other net-based parasites.

The alleged connection was the frequent use of PrivacyProtect by many of Atrivo's less reputable customers. These customers were using the service through Estdomains, not directly through LogicBoxes, so any claim of an association in inaccurate, Turakhia said.

Turakhia also challenged claims in a second report mentioned in our article that Directi had established 48 "phantom" registrars that appeared to violate policies mandated by the Internet Corporation for Assigned Names and Numbers requiring their physical location to be disclosed on websites operated by ICANN and InterNIC. In fact, Turakhia said, the registrars, which belong to Directi and possibly several of its clients, are completely legitimate enterprises that are in full compliance with all ICANN requirements.

"In order to get ICANN accreditation, they have to go through a very complicated due diligence process where ICANN verifies the appropriate documents, the financial stability, the business stability, technology capability of these companies," he said.

The companies are incorporated in Delaware, although no employees actually work there, Turakhia added. Listings for all 48 registrars contain a phone number and email address where a principal can be reached.

Indeed, Stacy Burnette, director of contractual compliance at ICANN, said the organization is satisfied the registrars are incorporated in the location listed in their application. Telephone numbers in the contact information need not correspond to the location of incorporation, she said. ICANN doesn't require registrars to publicly disclose their place of incorporation.

Directi's decision to sever its relationship with Estdomains was in part spurred by this article from Brian Krebs's Security Fix, which reported that the majority of websites that punted spam over the past year were registered through PrivacyProtect. Even prior to the article, Turakhia says Directi had already stopped providing hosting services for Estdomains.

Konstantin Poltev, the registry liaison for Estdomains, said the company is in the process of giving customers the choice of de-anonymizing themselves or transferring stewardship of their domain names to other registrars who offer the PrivacyProtect service.

He said he was surprised as anyone when he learned the extent of abuse of the PrivacyProtect. He characterized the termination of the service as a mutual decision between Estdomains and LogicBoxes and insists Estdomains has a zero tolerance policy for abusive domains it registers.

"We suspend all spam, all phishing, all fraud of any type," he said during a phone interview.

Perhaps, but it's worth noting that xpantivirus.com, which was registered using the Estdomains service, remains (at time of writing, anyway) up and running more than 10 days after we provided this detailed anatomy documenting the site's propagation of a diabolical piece of malware known as XP Antivirus 2008.

LogicBoxes is still contractually obligated to provide software support and additional services to Estdomains, but Turakhia says he looks forward to the day when he can completely sever ties with Estdomains.

"I would really love to detach ourselves from that organization," he said. "We'll have to let portions of that contract run out on its own." ®

Update

Within a few hours of this story being published, the xpantivirus.com site was removed. The link to report abusive domains to Estdomains is here.

Broader topics


Other stories you might like

  • Azure issues not adequately fixed for months, complain bug hunters
    Redmond kicks off Patch Tuesday with a months-old flaw fix

    Updated Two security vendors – Orca Security and Tenable – have accused Microsoft of unnecessarily putting customers' data and cloud environments at risk by taking far too long to fix critical vulnerabilities in Azure.

    In a blog published today, Orca Security researcher Tzah Pahima claimed it took Microsoft several months to fully resolve a security flaw in Azure's Synapse Analytics that he discovered in January. 

    And in a separate blog published on Monday, Tenable CEO Amit Yoran called out Redmond for its lack of response to – and transparency around – two other vulnerabilities that could be exploited by anyone using Azure Synapse. 

    Continue reading
  • International operation takes down Russian RSOCKS botnet
    $200 a day buys you 90,000 victims

    A Russian operated botnet known as RSOCKS has been shut down by the US Department of Justice acting with law enforcement partners in Germany, the Netherlands and the UK. It is believed to have compromised millions of computers and other devices around the globe.

    The RSOCKS botnet functioned as an IP proxy service, but instead of offering legitimate IP addresses leased from internet service providers, it was providing criminals with access to the IP addresses of devices that had been compromised by malware, according to a statement from the US Attorney’s Office in the Southern District of California.

    It seems that RSOCKS initially targeted a variety of Internet of Things (IoT) devices, such as industrial control systems, routers, audio/video streaming devices and various internet connected appliances, before expanding into other endpoints such as Android devices and computer systems.

    Continue reading
  • If you're using older, vulnerable Cisco small biz routers, throw them out
    Severe security flaw won't be fixed – as patches released this week for other bugs

    If you thought you were over the hump with Patch Tuesday then perhaps think again: Cisco has just released fixes for a bunch of flaws, two of which are not great.

    First on the priority list should be a critical vulnerability in its enterprise security appliances, and the second concerns another critical bug in some of its outdated small business routers that it's not going to fix. In other words, junk your kit or somehow mitigate the risk.

    Both of these received a CVSS score of 9.8 out of 10 in severity. The IT giant urged customers to patch affected security appliances ASAP if possible, and upgrade to newer hardware if you're still using an end-of-life, buggy router. We note that miscreants aren't actively exploiting either of these vulnerabilities — yet.

    Continue reading
  • Symantec: More malware operators moving in to exploit Follina
    Meanwhile Microsoft still hasn't patched the fatal flaw

    While enterprises are still waiting for Microsoft to issue a fix for the critical "Follina" vulnerability in Windows, yet more malware operators are moving in to exploit it.

    Microsoft late last month acknowledged the remote code execution (RCE) vulnerability – tracked as CVE-2022-30190 – but has yet to deliver a patch for it. The company has outlined workarounds that can be used until a fix becomes available.

    In the meantime, reports of active exploits of the flaw continue to surface. Analysts with Proofpoint's Threat Insight team earlier this month tweeted about a phishing campaign, possibly aligned with a nation-state targeting US and European Union agencies, which uses Follina. The Proofpoint researchers said the malicious spam messages were sent to fewer than 10 Proofpoint product users.

    Continue reading

Biting the hand that feeds IT © 1998–2022