ICANN Asked To Shut Down "Worst" Chinese Registrar

Ian Lamont writes "Anti-spam service Knujon has released reports highlighting how certain registrars in the US and abroad have consistently failed to live up to certain WHOIS-related obligations under ICANN's Registrar Accreditation Agreement (RAA) — specifically, the requirement that people or company registering domains provide valid contact information. Now the firm is requesting that ICANN shut down the worst alleged offender, Xinnet Bei Gong Da Software. According to Knujon, none of the WHOIS records in a sample of 11,000 alleged spam sites registered through Xinnet and reported by Knujon to ICANN's Whois Data Problem Report System were corrected in a six-month period ending in May 2008 — and the Chinese registrar continues to register about 100 spam sites per day. In many cases, says the Knujon document (PDF), Xinnet does not have 'any Whois record data for review while the sites are still active' and the spam sites further promote 'seal abuse' by posting bogus BBB, Verisign, and other trusted industry seals. ICANN says it is investigating. ICANN has just posted a draft revised RAA that is open for public comment until August 4. However, the wording of Section 3.7.8, governing registrars' obligations to check and correct domain owners' contact information, hasn't changed."

In other words

ICANN has Chinese burglers?

seal abuse

"Seal Abuse"

wow did the mental giants who first thought up using an inline graphic to portray legitimacy ever consider that someone may.... save... said graphic and re-use it.

Re:seal abuse

You know you're living in the 21st century when "seal abuse" does not involve clubbing large numbers of adorable baby amphibious mammals in the Arctic.

Re:

Yes they did.

If the seal is valid you can click on it and get an information page about the site.

If you get a page about another site or the seal isn't a link then the site isn't legitimate.

A faked verisign seal on a web site is a great clue that they're not the right people to shop with. It also makes spotting phishing sites a lot easier.

My prediction: Internet segmentation

As it stands, I have observed some common practices of simply blocking traffic going to or coming in from IPs from certain foreign nations. For some businesses, this practice alone reduces a tremendous amount of spam without affecting normal business flows. It would also make sense for users and businesses to restrict all communications with peers outside of their borders if, in fact, it has no adverse affect to their business flows.

Ultimately, this could lead to a segmented internet where entire nations find themselves effectively cut off by policy.

I am undecided about whether or not this is a good idea, but if China and Russia won't stop their criminals, perhaps they shouldn't have a presence on the global internet. The message? Play nice or you won't be allowed to play at all! My guess is that internet sanctions would have much faster reaction than economic sanctions.

Re:My prediction: Internet segmentation

Well, I'd be all for a segregated internet if it could keep all the American spam comments advertising drugs, loans, insurance and porn off my blog. Remember the USA is still the biggest spam producer. It would be nice if you could only spam yourselves.

Re:My prediction: Internet segmentation

"If China and Russia won't stop their criminals..."

You're aware that the US is still, by a factor of almost 4, the number one spamming nation on Earth? But don't take my word for it:

http://www.spamhaus.org/statistics/countries.lasso [spamhaus.org]

Now, you were saying? Sorry, it's hard to hear you when you're speaking from atop such a high horse.

Re:My prediction: Internet segmentation

Sorry, it's hard to hear you when you're speaking from atop such a high horse.

That's a pretty condescending attitude on your part as well.
We may have more spammers here, but at least we have a history of prosecuting and convicting at least some of them.
I don't really know whether China/Russia have ever convicting anyone of spamming, but TFA refers to a registrar that is either incompetent or complicit dealing with spammers and located in China.
Sometimes it's ok to criticize a country other than the USA.
Just let that sink in a little.

Re:My prediction: Internet segmentation

We may have more spammers here, but at least we have a history of prosecuting and convicting at least some of them.

What difference does that make to me, sitting here with an inbox full of American spam?

Re:My prediction: Internet segmentation

I don't really know whether China/Russia have ever convicting anyone of spamming

I think the Russians are actually more effective than the Americans - they murder their Spam King Pins [theregister.co.uk]!

Re:My prediction: Internet segmentation

Here is a list of the most prolific spammers in the world - aka. the people controlling these bots:
http://www.spamhaus.org/rokso/index.lasso [spamhaus.org]

They're mostly american.

Re:My prediction: Internet segmentation

The problem is that this ISP takes international registrations from spammers everywhere so blocking by a nations IP blocks is not going to help at all. Xenophobia may be comforting but is no help when the many of the criminals are likely to be in your own nation, it's better to go after them directly. As for hampering commerce with major trade partners to slow down some petty crooks that may be next door - implications are worth thinking about.

Re:

I don't claim the US is innocent, not even by implication. I am only pointing out that blocking out other countries is quite effective unless you're doing business overseas.

And as far as finding it impossible to communicate with people in the US is concerned, you can see the how and the why in action.

Sometimes really bad solutions have to be enacted before people will be interested in fixing the solution better which results in the problem being solved in a better way. Otherwise, it's just easier to do no

anti-spam kills anonymous speech

Yet again, "ID cards" are proposed as a method to curb spam, at the expense of anonymous speech.

When are we going to actually fix our protocols?

Re:anti-spam kills anonymous speech

RespectMyPrivacy.com [respectmyprivacy.com] is a service provided through NearlyFreeSpeech.Net [nearlyfreespeech.net] that allows users to put up proxy contact information with which people may still contact you. Snail mail and faxes are forwarded to their addresses, and when they receive any snail mail or faxes addressed to your domain, they will ask you whether you want these forwarded to yourself. There is also a proxy email that forwards to the email account that you used to register. All of this (allegedly) complies with ICANN regulations, since the information can be used to contact you. The simple solution is the one provided by RMP.C, and it doesn't compromise anonymity.

Perhaps the situation is not as bleak as you make it out to be.

Contact info is better found on the web site.

There's been a formal study of bad WHOIS data by the Government Accounting Office [gao.gov], the investigative arm of Congress, titled "Prevalence of False Contact Information for Registered Domain Names", on this topic. They found at least 8% of contact info in WHOIS to be totally bogus. They also, as a test of ICANN, submitted 45 "WHOIS information problem reports", of which 11 resulted in correction and 33 did not. But GAO didn't break down the data by registrar.

We've been interested in this issue at SiteTruth [sitetruth.com] for some time. We take a broader view of "bad" web sites than most; we consider any commercial site that lacks valid business name and address information to be bogus. Over 35% of Google AdWords advertisers fail that test. [sitetruth.net] For advertisers whose ads appear on Myspace, the ratio is much higher.

Originally, we tried to get contact information from WHOIS data, but the data quality was so appallingly bad that we had to develop another approach. We have a system that looks for contact info the way a user would, looking at pages with names like "About", "Contact", and such, trying to find a user-readable street address. We also have some big databases of business addresses to check against. This turns out to work much better than looking at WHOIS data when the goal is to find the business behind the web site.

(You can see this info using our AdRater [sitetruth.com] plug-in for Firefox. Download our plug-in to see the ratings for each Google advertiser as the ads go by. Unless you're already blocking all such ads, of course.)

Diplomatic incident

This could cause a Chinese/USA diplomatic incident. The Chinese upset ''because ICANN (a branch of the government of the USA) is exerting unfair control over the Internet''.

This is one reason why ICANN should be made completely independent of the USA government.

It's ironic. Don't you think?

It's ironic that they want domain owners to provide valid contact information in the belief that this will stop spam.

Before I moved to a registrar who provided free anonymous registration, I provided fake contact information specifically to prevent spambots from looking up my information in whois.

Shamelessly stealing previous joke

If spam is a "whopper" of a problem, and burger king's "whopper" is a cheeseburger, then...

ICANN has cheezburger?

Funny aside: my captcha is "verified", something which these domains were not.

Re:GASP and SHOCK!

So if they shut down the registrar, wouldn't that invalidate all domains currently registered through them? I'm assuming some of those belong to legitimate non-spammers....

Re:GASP and SHOCK!

Yes, it will. And those legitimate domains can get themselves transferred to a new registrar. Of course, in order to do that, I'd hope that they'd have to provide proper contact details, which would sieve out all the spammers.

Re:

Spam from China? GASP!

Funny how all the spam I receive is from Chinese servers but advertising for US products only available for purchase in the US and leading to US websites.

pot. kettle.

Re:GASP and SHOCK!

A lot of the spam from China is from US spammers: throwaway domains are very useful, to duck blacklists. It's really an international problem, and tends to fester due to companies like this, which ICANN is typically unable or unwilling to disconnect.

Re:I don't trust the Chinese

Their eyes are a little bit too slanted for my taste.

Actually, if you're going to taste them, it's best to remove them from the eyelid entirely. At that point, they're really indistinguishable from European eyes, but much more flavorful.

After an hour or so, though, you need to eat another one.

Re:So the US owns the internet?

The US doesn't exactly own the internet. ICANN however is supposed to be the central authority on DNS naming(someone has to be and they're the ones who started it), whether you agree with this or not is really rather immaterial.

However as this isn't really an issue of the US overriding China's rights on the internet it's not really all that important.

The registrar, who happens to be in China, but could be anywhere for all that it matters signed an agreement with ICANN to follow its rules regarding domain registration. One of those rules it that valid contact information has to be present for all domains. It doesn't as far as I can see have to lead to the person who runs the address, or to any individual involved in the domain(so it's not really an ID card), it simply has to lead to an actual someone who is responsible for that domain. That person is free to decline any requests for information regarding the actual users of their domain, and even to not collect said information at all. They are also entitled to allow said users to continue any activity which doesn't breach the agreement they signed with ICANN or any laws which are applicable to them(ie US law does not apply to a Chinese registrar, but the registrar's agreement with ICANN does). Yes there are potential issues of censorship and you might argue that requiring an individual to be responsible for the registration is wrong, it is however the agreement which the registrars signed in exchange for being able to give out registrations which will be honoured by the internet as a whole and so therefor they're responsible for holding to it.