ICANN cast as online scam enabler

Note: Officials at LogicBoxes and Directi take strong exception to the reports discussed in this story. Their objections are detailed in this follow-up story.

Two recently issued reports portray the Internet Corporation for Assigned Names and Numbers (ICANN) as a bureaucracy that enables cyber criminals.

In one report (PDF), researchers Jart Armin, James McQuaid and Matt Jonkman detail how one of ICANN's prized sponsors has ties to one of the net's more prolific sources of malware and illegal online pharmacies. It's called LogicBoxes, and over the past two years, ICANN has listed it as a sponsor for meetings that took place in Los Angeles and Delhi, India.

It turns out that LogicBoxes has an association with Atrivo, a network provider that also goes by the name of Intercage. According to the study, a random sampling of 2,600 addresses hosted by Atrivo revealed 7,340 malicious web links, 910 infected websites, 310 malicious binaries, and 113 botnet command and control servers. As an autonomous systems (AS) provider, the Concord, California-based company controls a large number of IP addresses.

The report details how Atrivo works with a rogue's gallery of other companies to enable anonymous sites that punt scareware, malware and online sites pushing Viagra and other sites. Other companies include Hostfresh, EstHost, EstDomains and PrivacyProtect.

In an email to The Register, Atrivo principal Emil Kacperski declined to comment.

A second report issued by an outfit known as Knujon (that's "no junk" spelled backwards) details 48 phantom domain name registrars whose sole purpose seems to be the registration of addresses used in spam and malware campaigns. All of them can be linked back to the Directi Group, which has long been a prolific provider of URLs to scammers.

According to Knujon, the 48 registrars are violating ICANN's own rules requiring them to clearly identify their business name and business address. That's something registrars are reluctant to do when they're spewing out sites as unpopular as these.

ICANN is the government-appointed group that accredits registrars. A spokesman for the group didn't return our calls for comment.

Yes, we realize the net is a big place and it's not possible to know the reputation of every group ICANN accredits or takes money from. But it's not unreasonable to expect the gatekeeper to enforce its own rules, especially given the proliferation of sites pushing spam, malware and other scams. And while ICANN did nothing wrong accepting sponsorship money from LogicBoxes, it's fair to say the the relationship doesn't look good, so long as LogicBoxes continues to keep company with the likes of Directi and Atrivo.

So next time you receive a spam or a popup fraudulently claiming your PC is hosed, think of ICANN. ®