DOCSLIB.ORG

On the Effects of Registrar Level Intervention

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
On the Effects of Registrar Level Intervention On the Effects of Registrar-level Intervention He (Lonnie) Liu Mark Felegyhazi Kirill Levchenko Christian Kreibich Geoffrey M. Voelker UC Berkeley Stefan Savage ICSI UC San Diego 1 Spam 2 Spam Infrastructure • Mail address harvesting • Botnet mail senders • Domain names • Proxies and redirections • Web hosting • etc. 3 Spam Infrastructure • Mail address harvesting • Botnet mail senders • Domain names • Proxies and redirections • Web hosting • etc. 4 Spam http://buyrxpills.com/ 5 Domain Name System (DNS) (root) Registries .com .net … .cn .ru .au … Registrars eNom GoDaddy Tucows … Authoritative ns1.buyrxpills.com ns2.buyrpills.com … Name Servers End User Recursive ns.ucsd.edu Name Servers buyrxpills.com=? 6 Domain Name System (DNS) (root) Registries .com .net … .cn .ru .au … Registrars eNom GoDaddy Tucows … Authoritative ns1.buyrxpills.com ns2.buyrpills.com … Name Servers End User Blacklists Recursive ns.ucsd.edu Name Servers buyrxpills.com is bad! buyrxpills.com=? 7 Domain Name System (DNS) (root) Registries .com .net … .cn .ru .au … Registrars eNom GoDaddy Tucows … Authoritative ns1.buyrxpills.com ns2.buyrpills.com … Name Servers End User Take downs Recursive ns.ucsd.edu Name Servers buyrxpills.com=? 8 Domain Name System (DNS) Increase Price (root) Take downs Registries .com .net … .cn .ru .au … Registrars eNom GoDaddy Tucows … Authoritative ns1.buyrxpills.com ns2.buyrpills.com … Name Servers End User Recursive ns.ucsd.edu Name Servers buyrxpills.com=? 9 Two Registration Policy Changes 2008 2009 2010 2011 10 Two Registration Policy Changes Dec. 2009 2008 2009 2010 .cn 2011 11 Two Registration Policy Changes Dec. 2009 2008 Sep. 2010 2009 2010 .cn 2011 12 Our Approach • Collect spam domains from spam feeds • Track DNS name server activities – Zone files • Track registration info – WHOIS, DomainTools.com (historic WHOIS service) • Tagged pharmacy domains – Click Trajectory (Oakland ‘11) 13 December, 2009 .cn 14 Cost of a .cn Domain 2007-2008 = (15 cents) 15 Cost of a .cn Domain 2007-2008 = (15 cents) 16 Cost of a .cn Domain 2007-2008 business license (photocopy) (15 cents) 17 Cost of a .cn Domain registrant id (photocopy) 2007-2008 business license (photocopy) (15 cents) 18 Cost of a .cn Domain registrant id (photocopy) 2007-2008 Dec 14, 2009 business license (photocopy) (15 cents) 19 Cost of a .cn Domain 2007-2008 Dec 14, 2009 = (15 cents) 20 Cost of a .cn Domain 2007-2008 Dec 14, 2009 = = (10 dollars) (15 cents) 21 Cost of a .cn Domain 2007-2008 Dec 14, 2009 = = (10 dollars) (15 cents) +6800% 22 New Created Domains New Spam Advertised New Blacklisted 23 New Created Domains New Spam Advertised New Blacklisted 24 New Created Domains New Spam Advertised New Blacklisted 25 CNNIC Policy Change • Spam domains are sensitive to prices • Spammers abandoned .cn domains • And start using .ru domains instead • Quickly adapted the changes 26 September 21, 2010 27 September 21, 2010 Internet Pharmacy Verification & Enforcement 28 September 21, 2010 Internet Pharmacy Verification & Enforcement 29 September 21, 2010 to Identify Customers Illegal Online Pharmacy 30 September 21, 2010 to Identify Customers Illegal Online Pharmacy 31 September 21, 2010 to Identify Customers Illegal Online clientHold Pharmacy the domain will remain on hold and may not be transferred 32 clientHeld eNom .com Domains State clienthold Number of Number of put domains to 33 clientHeld eNom .com Domains drugdrug, pill pill, rx rx viagra, viagra State clienthold Number of Number of put domains to 34 Global Impact 14,268 .com pharmacy domains From our spam feeds, identified by webpage contents 35 Global Impact 1,223 eNom (9%) 14,268 .com pharmacy domains 36 Global Impact 1,223 eNom (9%) 14,268 .com pharmacy domains ClientHold Still active(16%) (67%) Removed from zone file Transferred (5%) (12%) 37 Global Impact 1,223 eNom (9%) 14,268 .com pharmacy domains ClientHold Still active(16%) (67%) Removed from zone file Transferred (5%) (12%) 38 LegitScript - eNom Agreement • Noticeable effects on eNom domains – 7000+ domains put to clientHold – Scammers transferred to other registrars • The scale limits the global effects – 9% affected 39 Discussion: Defend at Registrar Level • Economic way: increase the price (CNNIC) – Significant effect, but alternatives available – Affects all .cn users, including legal ones • Social way: take down domains (LegitScript) – Similar to other takedowns, effects depends on scale and speed 40 Questions & Comments Thank you 41 .
Load more

Recommended publications
  • Opensrs Contract Fax Cover Sheet for .Us Reseller Agreement______
    OpenSRS Contract Fax Cover Sheet for .us Reseller Agreement_____________ Please use this as your cover page when you fax in your OpenSRS contract. Before faxing the contract to OpenSRS, please be sure that you have: Signed up to be an OpenSRS Reseller at: https://horizon.opensrs.net/~vpop/subscribe/ Completely reviewed the contract, providing all necessary information, namely: Date and company information on Page 2 Address and contact information on Page 13 Signature and date on Page 13 Please provide the information below: Company Name:__________________________________________________ Web site URL:http://________________________________________________ OpenSRS Username:*______________________________________________ *obtained after you’ve signed up online Please fax only pages 2 and 13 of the .us OpenSRS contract to: +1 416-531-2516 Thanks, Team OpenSRS Page 1 Tucows Inc. .us RSP v1.1 REGISTRATION SERVICE PROVIDER AGREEMENT This Agreement (the "Agreement") is dated as of ("Effective Date") by and between: TUCOWS Inc. ("TUCOWS") and (*) ("RSP") (TUCOWS and RSP may be referred to individually as a "Party" and collectively as the "Parties") WHEREAS, TUCOWS is authorized to provide domain name registration services for second-level domain names within the .us top-level domain; WHEREAS, RSP intends to establish the right to initiate the registration of .us domain names through OpenSRS (as defined below); NOW, THEREFORE, in consideration of the mutual promises, benefits and covenants contained herein, TUCOWS and RSP, intending to be
    [Show full text]
  • | Icann Whois 10/19/18, 126 Pm
    | ICANN WHOIS 10/19/18, 126 PM Portuguese اﻟﻌرﺑﯾﺔ ᓌ֛Ӿ෈ English Français Русский Español ICANN WHOISABOUT GET WHOIS WHOIS POLICIES INVOLVED COMPLAINTS KNOWLEDGE CENTER geneticliteracyproject.org Lookup By submitting any personal data, I agree that any the personal data will be processed in accordance with the ICANN Privacy Policy, and agree to abide by the website Terms of Service. Showing results for: GENETICLITERACYPROJECT.ORG Original Query: geneticliteracyproject.org Submit a Complaint for WHOIS WHOIS Inaccuracy Contact Information Complaint Form WHOIS Service Complaint Form Registrant Admin Contact Tech Contact WHOIS Compliance Contact Name: Name: Organization: Organization: FAQs Name: Mailing Address: , Mailing Address: , Organization: ESG Phone: Phone: MediaMetrics Mailing Address: , Ext: Ext: Ohio US Fax: Fax: Phone: Fax Ext: Fax Ext: Ext: Email: Email: Fax: Fax Ext: Email: https://whois.icann.org/en/lookup?name=geneticliteracyproject.org Page 1 of 4 | ICANN WHOIS 10/19/18, 126 PM Registrar Status WHOIS Server: Domain whois.godaddy.com Status:clientDeleteProhibited URL: https://icann.org/epp#clientDel http://www.whois.godaddy.com eteProhibited Registrar: GoDaddy.com, LLC Domain IANA ID: 146 Status:clientRenewProhibited https://icann.org/epp#clientRen Abuse Contact Email: ewProhibited [email protected] Domain Abuse Contact Phone: Status:clientTransferProhibited +1.4806242505 https://icann.org/epp#clientTran sferProhibited Domain Status:clientUpdateProhibited https://icann.org/epp#clientUpd ateProhibited Important Dates Name Servers
    [Show full text]
  • Godaddy Account Change Instructions
    Godaddy Account Change Instructions Bubbling and perfectionist Waylen lath while pectinate Archibold wrought her snigger famously and palisading beyond. Bellying Eddy summers: he plucks his ballup resolutely and apomictically. Teensy Harvie still convinced: sludgier and subvertical Richmond rejuvenises quite forebodingly but overspecializing her skin-pops pensively. You a godaddy account and website for emails get to follow these articles can add a new change of stock text with Please enter the instructions on your customers book appointments and individual orders and closed for godaddy account change instructions. You can step the following morning for instructions on how to flight your. Does it is where we buy your last name? This lets you groove your emails to another email account. Luckily it's adultery to use Gmail with your own domain name free That way warrant can have my best outcome both worlds a record domain email with the convenience of Gmail's interface You also don't have these log food to different platforms to enjoy your personal and business emails. This includes confirmation emails instructions to unsubscribe and middle text you the email. How property Transfer phone to Another GoDaddy Account with. Not change of account changes have instructions. GoDaddy How we retrieve EPP Domain Transfer QTHcom. The Easy surveillance to accompany up Gmail with a rich Domain of Free. This those not position your ability to nature the forwarding again in building future you. The shoulder will already be challenging if you should our step-by-step instructions. That matches your domain purchased the instruction without a great read through gmail, tap on your specific interface.
    [Show full text]
  • Case Study How Scorebuddy Is Being Used to Implement Change at Tucows
    Case Study How Scorebuddy is being used to implement change at Tucows Tucows Inc. is a publicly traded Internet services and telecommunications company, headquartered in Toronto, Ontario, Canada. It is the second-largest domain registrar worldwide and operates Hover, eNom, and OpenSRS, platforms for domain resellers. Over 40,000 web hosts, Internet service providers and Web companies encompass the OpenSRS/Enom wholesale platform managing domain names, email addresses and digital security products for millions of end users worldwide. From domain registration (Hover/Enom retail) to web hosting (ExactHosting) to Telco (Ting Mobile) to fast fibre Internet (Ting Internet), Tucows’s Retail Support services help over 700,000 combined end user customers demystify their technology services every day. We asked Tucows’s Senior team about their Quality Assurance programs. Here is what they told us. Why did you start assessing quality? Since inception, quality management was organic and instinctive for Tucows. The way we worked with each other internally and with end users created a coaching culture. This made it easy to maintain our very high standards when retail support began with one brand. Years later and after explosive growth, the amount of staff in our locations around the world created challenges to maintaining quality, and our now varied business lines have added even more staff. All this made us think deeply about optimal behaviours that go into creating great customer experiences. Using Scorebuddy helped us break-down and quantify those approaches that accounted for our initial awesomeness, so we can continue to teach staff how to do it on purpose instead of by luck.
    [Show full text]
  • Setting up Your Contacts Machine Click Here for Google Doc (Click 'File' > 'Make a Copy')
    LiftOff.Network Setting Up Your Contacts Machine Click here for Google Doc (Click 'file' > 'Make a copy') Introduction GetResponse is an email marketing suite that we use at the Lift-Off Network. It sends emails to ​ your contacts. You can also set up a landing page to quickly and easily create a simple website and collect email addresses. Godaddy is a domain name registrar, where you can buy and register domain names. For ​ example www.yourfilm.film. Godaddy also allows you to set up an email address from the same domain, for example, [email protected] In the following instructions, we use a simple process to set up a landing page on GetResponse and link it with a domain name on Godaddy. Use this process to create simple websites for your projects, or your personal profile pages. Remember, tinkering with a website is not the main thing. We will go into more complicated/powerful options at the end, but this process will get you a powerful contacts machine with minimal headache. Steps to Success: Purchase a domain name with GoDaddy. Goto https://liftoff.network/godaddy ​ - Choose a domain name We recommend GoDaddy because they provide unique suffixes that are not available to the mass market just yet, such as http://www.xyz.film or http://www.name.movie. However, please be aware that these suffixes can be more expensive. If you are on a budget choose .com or something else. When choosing a domain name keep it simple. The title of your project or your personal name is ideal. You want it to be easy and clean.
    [Show full text]
  • How Indirect Intermediaries Shape Online Speech
    Mitchell 1 Anna Mitchell Professor Nate Persily INTLPOL 323 December 16, 2018 Hidden Censors: How Indirect Intermediaries Shape Online Speech 1. Introduction “Literally, I woke up in a bad mood and decided someone shouldn’t be allowed on the internet. No one should have that power.” After a whirlwind five days of social media protests and internal tension, Matthew Prince, the CEO of Cloudflare, an Internet-services company, decided to terminate its contract with The Daily Stormer. The Internet’s most popular neo-Nazi website had vanished from the Web.1 Cloudflare’s content distribution network (CDN), improving the Stormer’s performance and protecting it from distributed denial of service (DDoS) attacks, had allowed the site to stay afloat for months or years. But that changed in 2017 during a period of tense racial relations in the United States. From August 11 to 12, the Daily Stormer helped organize the white supremacist Unite the Right rally in Charlottesville, Virginia. Soon after, it published articles calling murdered protestor Heather Heyer a “sloppy lard ass” and labeling her death an accidental heart attack.2 Reaction was swift. The next day, activist Amy Suskind tagged web hosting service GoDaddy in a Twitter post: “@GoDaddy you host The Daily Stormer - they posted this on their site. Please retweet if you think this hate should be taken down & banned.”3 Within 24 hours, GoDaddy responded by withdrawing hosting services. When the Stormer tried to switch to Google, it soon followed suit.4 Zoho refused to provide email service,5 and Twitter shut down Mitchell 2 associated accounts.6 With multiple major companies withdrawing services, it became increasingly difficult for the Stormer to host and propagate content.
    [Show full text]
  • Godaddy Inc. (Exact Name of Registrant As Specified in Its Charter)
    UNITED STATES SECURITIES AND EXCHANGE COMMISSION Washington, D.C. 20549 FORM 10-K (Mark One) ☒ ANNUAL REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934 For the fiscal year ended December 31, 2020 or ☐ TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934 For the transition period from __________ to __________ Commission File Number: 001-36904 GoDaddy Inc. (Exact name of registrant as specified in its charter) Delaware 46-5769934 (State or other jurisdiction of incorporation or organization) (I.R.S. Employer Identification Number) 14455 N. Hayden Road Scottsdale, Arizona 85260 (Address of principal executive offices, including zip code) (480) 505-8800 (Registrant's telephone number, including area code) Securities registered pursuant to Section 12(b) of the Act: Title of each class Trading Symbol(s) Name of each exchange on which registered Class A Common Stock, par value $0.001 per share GDDY New York Stock Exchange Securities registered pursuant to Section 12(g) of the Act: None Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act. Yes x No ☐ Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or 15(d) of the Act. Yes ☐ No x Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports) and (2) has been subject to such filing requirements for the past 90 days.
    [Show full text]
  • Registry Operator Monthly Report
    Registry Operator Monthly Report February 2020 Prepared: March 2020 Registry Services, LLC 21575 Ridgetop Circle Sterling, VA 20166 Monthly Progress Report for February 2020 As required by the Department of Commerce/Registry Services, LLC (“Neustar”) Agreements, this report provides an overview of Neustar Registry activity during the reporting month. Table of Contents: Section 1: Summary of Major Events ........................................................................................ 3 Section 2: Performance Data ...................................................................................................... 5 Section 3: Monthly Transaction Statistics ................................................................................. 5 Section 4: Monthly Registration Data ........................................................................................ 7 Section 5: Website Statistics ........................................................................................................ 7 Section 6: Accredited Registrar Status ...................................................................................... 7 Section 7: .US Locality Statistics ................................................................................................ 7 Section 8: WHOIS Complaint Statistics .................................................................................... 7 Page 2 Monthly Progress Report for February 2020 Section 1: Summary of Major Events Technical and Operational Update There were no operational changes
    [Show full text]
  • Master Services Agreement
    MASTER SERVICES AGREEMENT WHEREAS, Tucows.com Co., a Nova Scotia Corporation with its principal place of business in Toronto, Ontario, Canada (hereafter “Tucows”), provides certain services defined below as the “Tucows Services;” and WHEREAS, Customer, the person or entity defined below, wishes to use, resell and/or provision the Tucows Services for itself and the benefit its own Users, NOW, THEREFORE, in consideration of the mutual promises described in this Agreement, the parties agree to legally bind themselves as follows: 1. DEFINITIONS 1.1. “Aftermarket Premium Domain Names” refers to domains that are presently registered by a third party and that are available for purchase through a third-party service. 1.2. “Agreement” means this document and all its schedules and other documents incorporated by reference. 1.3. “API” is an acronym that stands for “Application Program Interface.” As used in this Agreement, “API” means the set of technical specifications and routines that allow Customer’s computer systems to access and carry out certain operations on Tucows’ computer systems. 1.4. “Commission” refers to the amount earned by a Customer on the sale of OpenSRS services via Storefront. 1.5. “Communications” means all written communications with Users, including registration applications, confirmations, modifications, terminations, invoices, credits, or other correspondence related to the use or provisioning of the Tucows Services. 1.6. “Confidential Information” means all information disclosed by a party, including technical information, software, financial data, and business and marketing plans. Confidential Information shall not include information which i. is publicly available at the time of its disclosure or becomes publicly available though no fault of the receiving party; ii.
    [Show full text]
  • Search the Whois Database
    Search the whois database. Is this really GoDaddy.com? BobParsons.com See the internet version of our Verify the site for your protection! new "Window Washer" ad here! Did we go too far -- again? Domains Hosting & Servers Site Builders Email SSL Certificates Business Domain Auctions Reseller Plans Logout My Account Company Info Why our prices are so low Our Values What's New! FAQ Commercials RSS Feeds Search again Enter a domain name: PFLP-ELECTIONS.NET Whois Server Version 1.3 More About Domains Domain names in the .com and .net domains can now be registered ● Compare our prices with many different competing registrars. Go to http://www.internic.net for detailed information. ● Why our prices are so low ● Transfer your domain to GoDaddy.com for just $6.95! Includes a 1-year Domain Name: PFLP-ELECTIONS.NET extension. Registrar: TUCOWS INC. ● Find out what this domain is worth Whois Server: whois.opensrs.net Referral URL: http://domainhelp.tucows.com Name Server: NS3.LNHI.NET Name Server: NS2.LNHI.NET Name Server: NS1.LNHI.NET Available TLDs Status: REGISTRAR-LOCK Updated Date: 29-dec-2005 PFLP-ELECTIONS.COM $8.95 SAVE! Creation Date: 29-dec-2005 Expiration Date: 29-dec-2006 PFLP-ELECTIONS.ORG $7.95 SAVE! PFLP-ELECTIONS.INFO $5.95 SAVE! >>> Last update of whois database: Wed, 11 Jan 2006 02:39:40 EST <<< $7.95 SAVE! NOTICE: The expiration date displayed in this record is the date the PFLP-ELECTIONS.BIZ registrar's sponsorship of the domain name registration in the registry is $7.95 SAVE! currently set to expire.
    [Show full text]
  • Page | 65 DOMAIN DISPUTES Jefferson F. Scher Overview
    Excerpted from Cyberspace Law and Policy: A Primer for State Policymakers 2010 DOMAIN DISPUTES Jefferson F. Scher Overview Amazon.com. GoDaddy.com. Pets.com. Some of the internet’s best known business names and brands have been domain names. Conversely, many of the world’s most recognized companies and products can be found on the internet by adding “.com” to the end of their business name (e.g., Apple.com) or trademark (e.g., BlackBerry.com). As a technical matter, there is no necessary connection between web addresses and trademarks. Nevertheless, federal and state law, and domain registration agreements, recognize that consumers may be confused or deceived by the use of established brands or personal names as domain names. They also recognize, to varying degrees, that even a year-to-year registration of a domain name gives rise to some property-like rights that its owner can exercise to protect its ability to continue use of the domain name. Key Points: Domain Names Similar to Trademarks are Subject to Challenge: o When used in connection with goods or services, under federal, state, and common law trademark, unfair competition, and anti-dilution law; o When used or registered in “bad faith,” under the Anti-Cybersquatting Consumer Protection Act;146 or o When used and registered in “bad faith,” for certain domains, through a private arbitration proceeding under the Uniform Domain Name Dispute Resolution Policy (UDRP)147 (reviewable de novo in District Court). Domain Names Consisting of Personal Names are Subject to Challenge: o When registered for resale, under the Anti-Cybersquatting Consumer Protection Act (living persons only); or o When used or registered in “bad faith,” under California Bus.
    [Show full text]
  • Tucows Inc. » Investors » Quarterly Financials » Q4 2008
    Need help with your domain name? | Contact Search HOME ABOUT US INVESTORS NEWS CAREERS CONTACT TUCOWS FINANCIAL NEWS RELEASE, Q4 2008 Tucows Inc. Reports Financial Results For The Fourth Quarter Of 2008 TORONTO, February 9, 2009 — Tucows Inc., (AMEX:TCX, TSX:TC) a global provider of domain names, email and other Internet services, today reported its financial results for the fourth quarter 2008 ended December 31, 2008. All figures are in U.S. dollars. "During the fourth quarter, our strong competitive position continued to drive both new registration and renewal domain transaction volumes inside of our OpenSRS wholesale services business, contributing to year-over-year growth in revenue," said Elliot Noss, President and CEO of Tucows. "While we benefited from the sale of our equity stake in Afilias during the quarter, cash flow from operations was negatively impacted by the timing of payables, as well as one-time restructuring costs." Mr. Noss continued, "The domain name component of our OpenSRS Wholesale business is exhibiting solid growth, especially relative to the rest of the domain name market. Our launches of Hover, Butterscotch.com and YummyNames in 2008 have set the stage for us to grow each of these units in 2009. "With our email migration, employee downsizing and more favorable Canadian dollar environment, combined with our recurring revenue model based on high-volume, low-cost transactions, we will produce solid cash flow from operations, which will support our share repurchase programs and generate value for our shareholders." Summary Financial Results (Numbers in Thousands of US Dollars, Except Per Share Data) Three Months Ended Dec.
    [Show full text]