On the Effects of Registrar-level Intervention
He (Lonnie) Liu Mark Felegyhazi Kirill Levchenko Christian Kreibich Geoffrey M. Voelker UC Berkeley Stefan Savage ICSI UC San Diego
1 Spam
2 Spam Infrastructure
• Mail address harvesting • Botnet mail senders • Domain names • Proxies and redirections • Web hosting • etc.
3 Spam Infrastructure
• Mail address harvesting • Botnet mail senders • Domain names • Proxies and redirections • Web hosting • etc.
4 Spam
http://buyrxpills.com/
5 Domain Name System (DNS)
(root)
Registries .com .net … .cn .ru .au …
Registrars eNom GoDaddy Tucows …
Authoritative ns1.buyrxpills.com ns2.buyrpills.com … Name Servers End User
Recursive ns.ucsd.edu Name Servers
buyrxpills.com=? 6 Domain Name System (DNS)
(root)
Registries .com .net … .cn .ru .au …
Registrars eNom GoDaddy Tucows …
Authoritative ns1.buyrxpills.com ns2.buyrpills.com … Name Servers End User Blacklists Recursive ns.ucsd.edu Name Servers buyrxpills.com is bad! buyrxpills.com=? 7 Domain Name System (DNS)
(root)
Registries .com .net … .cn .ru .au …
Registrars eNom GoDaddy Tucows …
Authoritative ns1.buyrxpills.com ns2.buyrpills.com … Name Servers End User
Take downs Recursive ns.ucsd.edu Name Servers
buyrxpills.com=? 8 Domain Name System (DNS)
Increase Price (root) Take downs Registries .com .net … .cn .ru .au …
Registrars eNom GoDaddy Tucows …
Authoritative ns1.buyrxpills.com ns2.buyrpills.com … Name Servers End User
Recursive ns.ucsd.edu Name Servers
buyrxpills.com=? 9 Two Registration Policy Changes
2008
2009
2010
2011
10 Two Registration Policy Changes
Dec. 2009 2008
2009
2010
.cn 2011
11 Two Registration Policy Changes
Dec. 2009 2008 Sep. 2010
2009
2010
.cn 2011
12 Our Approach
• Collect spam domains from spam feeds • Track DNS name server activities – Zone files • Track registration info – WHOIS, DomainTools.com (historic WHOIS service) • Tagged pharmacy domains – Click Trajectory (Oakland ‘11)
13 December, 2009
.cn
14 Cost of a .cn Domain
2007-2008
=
(15 cents)
15 Cost of a .cn Domain
2007-2008
=
(15 cents)
16 Cost of a .cn Domain
2007-2008
business license (photocopy)
(15 cents)
17 Cost of a .cn Domain registrant id (photocopy) 2007-2008
business license (photocopy)
(15 cents)
18 Cost of a .cn Domain registrant id (photocopy) 2007-2008 Dec 14, 2009
business license (photocopy)
(15 cents)
19 Cost of a .cn Domain
2007-2008 Dec 14, 2009
=
(15 cents)
20 Cost of a .cn Domain
2007-2008 Dec 14, 2009
= = (10 dollars) (15 cents)
21 Cost of a .cn Domain
2007-2008 Dec 14, 2009
= = (10 dollars) (15 cents)
+6800% 22 New Created Domains
New Spam Advertised
New Blacklisted
23 New Created Domains
New Spam Advertised
New Blacklisted
24 New Created Domains
New Spam Advertised
New Blacklisted
25 CNNIC Policy Change
• Spam domains are sensitive to prices • Spammers abandoned .cn domains • And start using .ru domains instead • Quickly adapted the changes
26 September 21, 2010
27 September 21, 2010
Internet Pharmacy Verification & Enforcement
28 September 21, 2010
Internet Pharmacy Verification & Enforcement
29 September 21, 2010 to Identify Customers Illegal Online Pharmacy
30 September 21, 2010 to Identify Customers Illegal Online Pharmacy
31 September 21, 2010 to Identify Customers Illegal Online clientHold Pharmacy
the domain will remain on hold and may not be transferred
32
clientHeld eNom .com Domains
State
clienthold Number of Number of put domains to
33 clientHeld eNom .com Domains
drugdrug, pill pill, rx rx viagra, viagra
State
clienthold Number of Number of put domains to
34 Global Impact
14,268 .com pharmacy domains
From our spam feeds, identified by webpage contents
35 Global Impact
1,223 eNom (9%) 14,268 .com pharmacy domains
36 Global Impact
1,223 eNom (9%) 14,268 .com pharmacy domains
ClientHold Still active(16%) (67%) Removed from zone file Transferred (5%) (12%)
37 Global Impact
1,223 eNom (9%) 14,268 .com pharmacy domains
ClientHold Still active(16%) (67%) Removed from zone file Transferred (5%) (12%)
38 LegitScript - eNom Agreement
• Noticeable effects on eNom domains – 7000+ domains put to clientHold – Scammers transferred to other registrars • The scale limits the global effects – 9% affected
39 Discussion: Defend at Registrar Level
• Economic way: increase the price (CNNIC) – Significant effect, but alternatives available – Affects all .cn users, including legal ones • Social way: take down domains (LegitScript) – Similar to other takedowns, effects depends on scale and speed
40 Questions & Comments
Thank you
41