ICANN cast as online scam enabler
And now a word for our illegal online pharmacy sponsor
Customer Success Testimonial: Recovery is Everything
Note: Officials at LogicBoxes and Directi take strong exception to the reports discussed in this story. Their objections are detailed in this follow-up story.
Two recently issued reports portray the Internet Corporation for Assigned Names and Numbers (ICANN) as a bureaucracy that enables cyber criminals.
In one report (PDF), researchers Jart Armin, James McQuaid and Matt Jonkman detail how one of ICANN's prized sponsors has ties to one of the net's more prolific sources of malware and illegal online pharmacies. It's called LogicBoxes, and over the past two years, ICANN has listed it as a sponsor for meetings that took place in Los Angeles and Delhi, India.
It turns out that LogicBoxes has an association with Atrivo, a network provider that also goes by the name of Intercage. According to the study, a random sampling of 2,600 addresses hosted by Atrivo revealed 7,340 malicious web links, 910 infected websites, 310 malicious binaries, and 113 botnet command and control servers. As an autonomous systems (AS) provider, the Concord, California-based company controls a large number of IP addresses.
The report details how Atrivo works with a rogue's gallery of other companies to enable anonymous sites that punt scareware, malware and online sites pushing Viagra and other sites. Other companies include Hostfresh, EstHost, EstDomains and PrivacyProtect.
In an email to The Register, Atrivo principal Emil Kacperski declined to comment.
A second report issued by an outfit known as Knujon (that's "no junk" spelled backwards) details 48 phantom domain name registrars whose sole purpose seems to be the registration of addresses used in spam and malware campaigns. All of them can be linked back to the Directi Group, which has long been a prolific provider of URLs to scammers.
According to Knujon, the 48 registrars are violating ICANN's own rules requiring them to clearly identify their business name and business address. That's something registrars are reluctant to do when they're spewing out sites as unpopular as these.
ICANN is the government-appointed group that accredits registrars. A spokesman for the group didn't return our calls for comment.
Yes, we realize the net is a big place and it's not possible to know the reputation of every group ICANN accredits or takes money from. But it's not unreasonable to expect the gatekeeper to enforce its own rules, especially given the proliferation of sites pushing spam, malware and other scams. And while ICANN did nothing wrong accepting sponsorship money from LogicBoxes, it's fair to say the the relationship doesn't look good, so long as LogicBoxes continues to keep company with the likes of Directi and Atrivo.
So next time you receive a spam or a popup fraudulently claiming your PC is hosed, think of ICANN. ®
COMMENTS
Directi's official response to inaccurate reports which falsely implicate the Directi Group
From Bhavin Turakhia’s Desk:
There have been some articles and reports recently published by Garth Bruen at Knujon and by Jart Armin and James Mcquad at Hostexploit, that somehow link Directi with groups that support organized internet crime. The motives behind these reports are still unknown, but as an organization that prides itself in setting industry benchmarks in ethics and best practices, we are extremely shocked by these allegations. While I applaud the efforts of volunteers such as Knujon and Hostexploit who spend their personal time to try and combat spam, I am personally quite saddened when the very individuals who we trust to combat fraud engage in publicity moves without consideration for the reputation of legitimate businesses.
Neither Knujon nor Hostexploit extended a basic courtesy of even contacting us to verify any of the facts in their report before publishing the same. Directi is not even remotely related to the organizations or activities listed in those reports. The arguments presented in these reports are either downright baseless, or based on complete fabrication of facts.
Various other news agencies and blogs have further referenced these reports in the form of a story or post, once again without any attempt to verify or validate the facts in these reports. Given the amount of noise this has created - it is imperative that we clarify our stand and rectify the factual inaccuracies in those reports.
The first false and inaccurate report in question is one published by Garth Bruen of Knujon. Find below each of the factual inaccuracy or misstatement in his report and our response to the same -
1. The report claims that “48 ICANN-accredited Registrars (affiliated with Directi) … do not seem to exist and are phantom.”
This statement is factually incorrect, and was completely unverified by Knujon. Knujon did not even bother to contact ICANN in this regards to get the right facts. The truth of the matter is that all 48 companies which belong to Directi and its clients, are in existence and are duly incorporated and validly existing under law.
2. Other Online reports further claim that these 48 registrars are involved in illicit activities.
This allegation is made without providing ANY evidence to corroborate the same. This statement is grossly inaccurate. The reporters did not bother to support such claims with any factual evidence, nor contacted us for clarification. All 48 companies combined have under a few thousand customers who have registered legitimate domains with these registrars and have not received any abuse complaints. Yet these companies have been dragged in, without evidence, into an issue that is unrelated to them.
3. Garth of Knujon further claims that the Directi Group owns a company by the name of ESTDomains.
This is another blatantly false insinuation. Directi has never owned ESTDomains. Garth has no documentation that shows Directi owning ESTDomains. We have challenged Knujon to produce any evidence with respect to this. In fact the only relationship between Directi and ESTDomains is that ESTDomains has purchased certain software from Logicboxes a few years ago to power their Registrar operations. They are otherwise an independent company and we do not control their actions or their behavior.
To continue reading our response and comments on all the inaccuracies within each report, please visit our Corporate Blog:
http://blog.directi.com/company/our-official-response-to-malicious-reports-which-falsely-implicate-the-directi-group/
Okay, then...
Take away the accreditation and deal with the domains that registrar used to handle.
There.
It *is* "a bit more than just taking away [an] accreditation", but it's still not the domain police.
ICAAN does more that accredit registrars
I was involved with the Registerfly debacle, fortunately I lost no domains, transfering them all months before the downfall .. I was smart never to use thier privacy services, webhosting or other services ( in fact you should never use any registrar for webhosting, nor a webhost for registration services, as any dispute about webhosting or other services can turn into locking up your domain )
ICAAN ultimately awarded GoDaddy a bulk transfer of Registerfly client domains .. a *bit* more than *just* taking away registerfly's accreditation
ICAAN resolves name (trademark) disputes, so it already has an adjudication and enforcement mechanism in place, so it's not a stretch to increase thier powers to to deal with, or make easier for law enforcement to shut down and remove domains / addresses participating in illegal activity
If they really can't or won't, perhaps it would be better to throw it back to the US Dept. of Commerce to regulate and enforce .. don't think that would be the *prefered* solution however
IT infrastructure monitoring strategies
What you need to know about cloud backup
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Customer Success Testimonial: Recovery is Everything
