Forgot your password?
typodupeerror
Spam Crime Security The Internet IT

Spammers Moving To Disposable Domains 147

Posted by timothy
from the filling-up-our-landfills dept.
Trailrunner7 writes "Spammers and the botnet operators they're allied with are continuing to adapt their techniques to evade security technologies, and now are using what amount to disposable domains for their activities. A new report shows that the spammers are buying dozens of domains at a time and moving from one to another as often as several times a day to prevent shutdowns. New research shows that the amount of time that a spammer uses a given domain is basically a day or less. The company looked at 60 days worth of data from their customers and found that more than 70 percent of the domains used by spammers are active for a day or less."
This discussion has been archived. No new comments can be posted.

Spammers Moving To Disposable Domains

Comments Filter:
  • by Anonymous Coward

    Assuming they're not "tasting" it's going to cost them about $10 a pop.

    • by fifedrum (611338) on Wednesday July 14, 2010 @01:52PM (#32903860) Journal

      except they're using disposable stolen credit cards to pay for it, so really, they don't care about the $10 a pop.

      • by Ambiguous Puzuma (1134017) on Wednesday July 14, 2010 @03:13PM (#32904962)

        except they're using disposable stolen credit cards to pay for it, so really, they don't care about the $10 a pop.

        Not sure why parent is modded funny; there is likely a lot of truth to it. Sony Online Entertainment discovered this [gamasutra.com]:

        It isn't just issues of game balance and gold farming, Smedley says. "We're seeing a lot of stolen credit cards. Say you buy gold from a service in China -- you may not know it's in China, but you give them your credit card and buy gold only once. They use these credit card numbers to set up new accounts in these games. They buy an EverQuest account key, farm for a month, and then charge it back to the stolen credit card."

        And this isn't just damaging to the consumer. "What happens is that over time, as that rate of chargebacks rises, we start getting fined. We have been fined over a million dollars since June. That's not the chargebacks themselves -- just the chargeback fine. It's brutal; it's the dirty little secret of the industry."

        These temporary accounts, paid for with stolen credit cards, are additionally used to spam in-game (although spam filtering has improved the situation significantly).

        It would not surprise me in the least if this applied to temporary domain registration for spam/malware purposes as well.

        • Probably just a miss-click. You'll notice Slashdot also gave him 40% Insightful, 30% Interesting and 30% Funny, yet somehow it shows up labelled as funny. Gotta love logic errors!

        • If you're buying gold from a shady site with a real CC, you kind of deserve what coming to you.

    • $10 for a .com TLD maybe but there are plenty of substantially cheaper options.
    • EOL? (Score:3, Insightful)

      by BrokenHalo (565198)
      Maybe this is a symptom of the beginning of the end for the professional spammer. If the whole thing ends up being more trouble than it's worth, maybe these asswipes will look for an alternative source of income.

      Probably premature, I know, but we can hope...
      • If the whole thing ends up being more trouble than it's worth

        Perhaps. But part of the problem is that a lot of these problems are originating from places where people's trouble (ie time and effort) isn't worth very much to begin with, because there aren't better paying options for employment. Think gold farming...

      • by mlts (1038732) *

        Be careful, spammers may move into other territory. There was a sense of victory when ISPs were successful at blacklisting spammers, then they went to bouncing IP addresses to duck blackholes.

        I'd expect the next thing will be to find ways to compromise E-mail accounts en masse (hacking a server at a free E-mail provider and using accounts, or compromising a backbone SMTP server.) With the money spammers make, paying a blackhat with a 0-day would be small potatoes compared to the money rolling in.

        Another t

        • by yuna49 (905461)

          I'd expect the next thing will be to find ways to compromise E-mail accounts en masse (hacking a server at a free E-mail provider and using accounts, or compromising a backbone SMTP server.)

          Just this week I've seen two spams that appear to have come from real accounts at AOL and Hotmail. I know for a fact that the first was a real account since it belonged to someone subscribed to a limited-membership listserver I manage. The second was from an account I knew nothing about, but it was essentially identica

          • Both came from the mail providers' own SMTP servers.

            And best of all, when you attempt to notify Hotmail of this kind of spam, they blow you off. They'll usually tell me "your headers were forged" when I can clearly see it's a genuine Hotmail server connecting to my SMTP box, and any general communication to the abuse address gets bounced because "in order to process your request, Hotmail Support needs a valid MSN/Hotmail hosted account".

            As far as I'm concerned, Microsoft is directly contributing to
        • hacking a server at a free E-mail provider and using accounts

          Already happens - mostly with Hotmail, Yahoo, and GMail accounts.

          My Hotmail account hacked - all my contacts spammed !! How to avoid it happening to you. [gillmoorep...aphy.co.uk]

          (just one of many such occurrences)
      • by Lennie (16154)

        When you look at the numbers, it's pretty close already. I think the last research suggests, the spammers sends 320 milion messages, he/she gets 28 responses. The email providers already filters out 90% to 98% of all mail (not all of it is spam, some of it is spyware, virus or phishing ofcourse).

  • by TravisHein (981987) on Wednesday July 14, 2010 @01:47PM (#32903774)
    in addition to a commonly accepted practice of doing a reverse domain name lookup on who is sending you email, where by rejecting email from bogus domains, no domain, to now also have the mail server also do a whois lookup, and arbitrarily reject email from a domain that has been registered less than a few days ago?
    • by 2obvious4u (871996) on Wednesday July 14, 2010 @01:49PM (#32903822)
      Almost, they could have registered it weeks, months or even years earlier. You would need to see if it had X days of activity. I don't know how you would do that.
      • by fifedrum (611338) on Wednesday July 14, 2010 @01:53PM (#32903882) Journal

        there are email reputation providers out there who can tell you things like that. It may even be free (it is for us anyway)

        • by fifedrum (611338) on Wednesday July 14, 2010 @02:04PM (#32904038) Journal

          This is the way our reputation provider works: If the IP hasn't been seen delivering email before (no matter it's age), it has a 0 reputation. The more email that is processed the higher the reputation and the reputation is, of course, modified down by complaints. The more complaints,the lower the reputation. Think feedback loop, or where your email goes when you click "mark as junk."

          If someone else wanted to get into the game, services like spamcop could be used (who knows, maybe can already be used?) to determine domain name reputation by keeping an independent database of domain names and keeping the ratio of good to bad email handy for rapid lookups, maybe in something like dnsrbld type lookup table. It's the same as IP reputation engines, just with text domain names.

          Maybe someone alread does. I know our antispam provider keeps a level of spaminess for domain names, but those are for domains that already exist. You would have to determine by policy what to do with domains that don't have a reputation.

          That and implementing tighter SPF and DKIM will help eliminate this stuff.

          • by XanC (644172)

            Can you explain how SPF would be of any help at all here?

            • by hedwards (940851)
              To prevent free riding on a known good domain name from somewhere else.
              • by Bert64 (520050)

                Which isn't what they're doing, they are registering their own domains which means they can then create valid SPF and DKIM records for them.

                • by mikael_j (106439)

                  Sure, they can create valid SPF records for their domains but if they're using their own machines (rented or owned) then that ISP is most likely shady and will end up getting on a few blacklists. If they're using botnets then overly broad SPF records could be filtered (since they can't control reverse DNS for the zombie machines they're using to send spam).

      • by Skapare (16644)

        Dealing with it is simple. Keep a database of domains with their date of first appearance and first successful acceptance. For each arriving email, look up the domain in the database. If its first appearance is less than 3 days ago, do a soft reject which will cause a normal mail server to re-queue it. If more than 3 days but less than 4 days, go ahead and accept it and record that it was accepted in the other date field. At any other time, if the record shows there was an email accepted between day 3

    • by Snowhare (263311)

      The problem with this is pretty much all of the whois servers rate limit requests. Make than a very small number of requests per day and they simply quit answering. What we need is basic whois info available like domain created dates via DNS queries.

    • by mikael_j (106439)

      The biggest problem with using reverse lookup is that it's a horrible method. Sure, ten or fifteen years ago it was a half-decent method for filtering but these days lots of companies have broken reverse DNS pointers, even big companies (one I've seen with many companies here in Sweden is that email from user@company.se from a server claiming to be mailhost.company.se is sent from xxx.xxx.xxx.xxx for which a reverse lookup gives mailhost.company.com or something like ext-12-sthlm.se.company.com).

      Personally

    • by Lumpy (12016)

      Better yet, all domains are rejected unless it has been up for 1 week. If the server receives a single email from that domain, let it through, if it get's 20 ro more, bounce them all. All email servers treat all domains as suspect and let in 1 email from the domain an hour until it's proven to be good, then allows more. Instantly Blacklist any new domain heard that has more than 10 emails for the customer. Instant blacklist if any email from that domain during the probation triggers the spam filters.

      C

  • by harmonise (1484057) on Wednesday July 14, 2010 @01:48PM (#32903786)

    Score email higher that comes from newer domains. The older the domain, the lower the score. I'm thinking spamassassin scores here.

    • by Tom (822)

      They'll just buy in bulk in advance, let it sit there for a year, then use it.

      You can not solve the spam problem technologically. You have to reduce the opportunities and incentives on all fronts. That means making it harder (= more expensive) to spam, making spam less profitable (various methods like bringing credit card companies into responsibility have been discussed) and making it more dangerous (actually enforcing the law, and making the law less easy to exploit).

      None of that on its own will solve the

  • by HikingStick (878216) <z01riemer@hotmail . c om> on Wednesday July 14, 2010 @01:49PM (#32903808)
    They obviously are making enough money to afford the registration fees. I wonder if there would be a way to greylist/blacklist new domains, though that simply might mean that spammers would sit on the domain for a period of weeks or months before using them. Still, would there be a way to flag young domains so that they end up with higher scores in various spam filters?
  • by sixteenbitsamurai (1070810) on Wednesday July 14, 2010 @01:51PM (#32903844)
    It's like an underground revolutionary movement, except selling male enhancement products.
  • by fifedrum (611338) on Wednesday July 14, 2010 @01:51PM (#32903850) Journal

    As an SA at a hosted email provider I see this on a daily basis and could list several hundred domains just from the last few days' worth of reports. They hit the big registrars, attempt to automate as much as possible, create dozens of email accounts per domain, and turn on the spigot disposing of the domains immediately in the case of sending domains, and putting off the demise of the web domains as long as possible.

    Fortunately, the activity levels of the greedy spammers far outstrips the activity levels of the normal user, that said, we still see occasional drip spammers.

    Long ago I proposed a pay-per-view spectacular. Pasty faced pudgy sysadmins from around the world get air dropped onto an island studded with cameras and stocked with spammers and 419 scammers... Viewers can then vote online which sysadmins get which weapons. (Please gentle viewer, let me have the M1)

    • Long ago I proposed a pay-per-view spectacular. Pasty faced pudgy sysadmins from around the world get air dropped onto an island studded with cameras and stocked with spammers and 419 scammers... Viewers can then vote online which sysadmins get which weapons. (Please gentle viewer, let me have the M1)

      I'm going for a Barrett and a tall hill or tree, this will be fun. Although I would still be partial to a rocket launcher with rockets that have painted on Smiley faces on the nose....

    • by Locke2005 (849178)
      (Please gentle viewer, let me have the M1) Sorry, you're ALL getting the aluminum bats -- much more entertaining to watch!
    • M1 is a bit old school. There are a LOT of spammers, and you'd need a higher rate of fire. I'd suggest a Saiga 12. Or if you really want the retro look, an AK-47 is still hard to beat.
      • by Firethorn (177587)

        I think he's going for quality of kills over quantity.

        Besides, I figure there are fewer than you might think. Remember, one spammer can send out millions of emails in less than a day, easy.

      • by fifedrum (611338)

        definitely going for style points. nothing gives you the chills quite like the "sproing!click!" of the M1 running out of ammo. The plan was to have a limited number of spammers on the island, maybe at a 1:1 ratio kind of like "Running Man" (not smit running man either)

  • by interval1066 (668936) on Wednesday July 14, 2010 @01:52PM (#32903856) Homepage Journal
    I could have sworn they have been using this one for a few years now.
    • I left the field in 2001 and they were already doing it then. It's just cheaper now (cheaper with real money, and cheaper to buy stolen credit cards).

  • by Animats (122034) on Wednesday July 14, 2010 @01:53PM (#32903880) Homepage

    When you buy a domain, you should be mailed a letter with an activation code, sent to the registrant address. No valid mailing address, no domain activation.

    • by fifedrum (611338) on Wednesday July 14, 2010 @01:57PM (#32903940) Journal

      to which they'll use mules

      really, there's no way around this that can't also be worked around by the spammers. Every single step is met by counter action and evasion. The only thing that works is jail time.

      • Re: (Score:3, Insightful)

        by BitZtream (692029)

        Mules at a known valid address are far easier to trace than stolen credit cards.

      • by guruevi (827432)

        Oh really? As in: they can make a couple of million and all they face is an extremely small chance that they get maybe 6 months in prison? Besides how do you get caught when there are no laws against it, no police force in the world cares (your company is not big enough to afford those laws) and you could be anywhere in the world, maybe in a small banana-republic where you can treat the police as your personal mercenaries for a couple of $100.

        • by fifedrum (611338)

          you are, of course, exactly right. There's nothing to be done but label them, put them on a list, and wait for them to step foot in a foreign land that has these controls in place.

          Maybe we can declare a Fatwa against them, and any righteous sysadmin can achieve a greater score in mario brothers if they take the spammer out?

      • really, there's no way around this that can't also be worked around by the spammers.

        There's a fairly simple way around it on the client end (and which could easily be implemented by webmail providers); allow the user to designate "safe" domains, any mail that isn't from a known contact or a domain identified by the specific recipient as "safe" is shunted to an "unsolicited" box (or tagged "unsolicited"), essentially serving as a lower-probability "possible spam" box to a traditional Spam mailbox/tag.

        • by fifedrum (611338)

          that's whitelist-only and works great, actually. In our service, you put * in your blacklist, then *@dom in your whitelist (or of course, individual email addresses).

          • that's whitelist-only and works great, actually.

            Well, not quite. What I was really proposing is actually more like a three or four tiered system, with:

            1. Stuff that is whitelisted: treated as most likely not spam and presented to user.
            2. Stuff that is neither whitelist nor identified as probable spam by traditional spam filtering: treated/flagged as possible spam and presented to user.
            3. Stuff that is caught as probable spam by traditional spam filtering, treated/flagged as probable spam and presented to us

      • by mlts (1038732) *

        The threat of jail isn't going to happen. A lot of spammers are in countries whose government doesn't give a rat's ass about computer crime, cannot afford to, or hates everyone else so much that they consider the spammers an income source for their nation.

        Even in countries with computer crime laws, the good spammers will not be directly connected to machines, just like a good drug dealer is never near his stash when making transactions. They will be hiring script kiddies to do grunt work for them, or they

        • by fifedrum (611338)

          they already use raw IPs, but the vast majority of MX servers reject email that doesn't resolve in reverse DNS, or doesn't have a resolvable HELO hostname, or the from address is phony.

          And they already use compromised clients, see it every day.

          • by mlts (1038732) *

            Correct. However, if other avenues of spammers dropping their spew is blocked, they will start focusing on trying to compromise legit machines, as opposed to just spraying and praying from IP ranges. Spammers have a lot of money behind them, so I'm sure a larger spam organization may end up spending their time compromising ISP servers just to get their stuff out.

            At least if they do focus on compromising machines, a lot of zero days floating around will be found and squashed.

            • by fifedrum (611338)

              ah, gotcha, good point, looks like even more interesting times ahead for admins of all stripes.

      • by kvezach (1199717)
        really, there's no way around this that can't also be worked around by the spammers. Every single step is met by counter action and evasion. The only thing that works is jail time.

        How about the idea of proof-of-work with price discrimination [psu.edu]? Unknown domains start at a fairly high level, so it takes a long time to send mail. If the user or domain has sent a few good mails, it's "trusted" (but using a robust trust metric so that spammers can't just trust each other), and then sending mail is fast. If the
    • by NevarMore (248971)

      So when you want to register a domain for unpopular political, social, or religious activities you can be outed?

    • by Skapare (16644)

      What if I gave up using email long ago? Why should making oneself vulnerable to spam a requirement to participate in non-email internet stuff?

  • This is news??? (Score:4, Informative)

    by Eggplant62 (120514) on Wednesday July 14, 2010 @01:55PM (#32903900)

    They've been doing this since 1999 from my personal memory aiding the antispam fight. What suddenly brings this back to the fore as if it were some stunning revelation? It's an old trick that Alan Ralsky used when he was scamming and spamming.

  • A fine match for their disposable e-mails. I have to give kudos to Gmail; my personal account has not seen a single unwanted spam message since its inception. Not one. I used to check the Spam folder to see if anything legit got trashed, but now I just mainly ignore it unless I really want to see anonymous scumbags' assessments about my lack of adequate manhood.
    • Re: (Score:3, Funny)

      by Zemplar (764598)

      ... assessments about my lack of adequate manhood.

      So you're the one! I've got a bunch of email that must belong to you.

    • A fine match for their disposable e-mails. I have to give kudos to Gmail; my personal account has not seen a single unwanted spam message since its inception. Not one. I used to check the Spam folder to see if anything legit got trashed, but now I just mainly ignore it unless I really want to see anonymous scumbags' assessments about my lack of adequate manhood.

      Agreed. My spam folder has plenty of spam but what actually has made it to the inbox in all these years was been about 3 messages. And that's after being lambasted on a previous /. post in which I willingly gave out my email milsorgen@gmail.com. I think someone tried to sign me up for like 3 mailing lists, but other than that it was nothing but hubris.

      I think the problem has been over exaggerated and we are too eager to cater to users too dumb to avoid being suckered.

    • by XanC (644172) on Wednesday July 14, 2010 @02:28PM (#32904314)

      This is why spam folders should be Considered Harmful. Effectively, it's a delivery failure without a notice. You should either accept mail or reject it, not pretend to accept it and then stash it someplace where nobody reads it.

      Using a spam folder treats outright, obvious spam with more courtesy than the borderline stuff.

      • by Firethorn (177587)

        If I'm expecting an email from a new source, like I've signed up somewhere new, and the email doesn't show up, I'll check the spam filters.

        If the new request is outright rejected, how am I supposed to get my confirmation email?

        • by XanC (644172)

          Does any email from a new source get put into a spam folder? You might want to fix that problem first.

          • by Firethorn (177587)

            Does any email from a new source get put into a spam folder?

            No, but it's iffy on new signups for small forums and such.

        • If the new request is outright rejected, how am I supposed to get my confirmation email?

          The same thing would happen as in the situation where you wouldn't expect mail from that source: the sender would get the bounce, which would contain a reason why the mail was rejected (such and such keyword in mail, no text, ...), he then would change his mail to match, and try again.

          And if he was unable to comply, he would use a different channel (i.e. phone) to communicate with you.

          • by Firethorn (177587)

            The same thing would happen as in the situation where you wouldn't expect mail from that source: the sender would get the bounce, which would contain a reason why the mail was rejected (such and such keyword in mail, no text, ...), he then would change his mail to match, and try again.

            I'm not talking about an individual's mail; I'm talking about those new account confirmation emails many forums send out, that you have to acknowledge before you can post.

            Odds are a rejection mail is going into the bitbucket.

            The administrator, assuming he's paying attention and knows how, can't just 'change the email', because that's only a temporary fix - the spammers will just adapt to the NEW template.

            And if he was unable to comply, he would use a different channel (i.e. phone) to communicate with you.

            Like I want to give www.randomforum.com my phone number? Like they have an administrator that active?

            I'

            • I'm not talking about an individual's mail; I'm talking about those new account confirmation emails many forums send out, that you have to acknowledge before you can post.

              Odds are a rejection mail is going into the bitbucket.

              On a properly configured automailer, any error messages are supposed to go to the administrator. How else would he be made aware that something is amiss?

              Like I want to give www.randomforum.com my phone number? Like they have an administrator that active?

              In case of an automailer, if there is trouble, probability is that the trouble is related to the software they are using. If the administrator manually mails you using his normal MTA, chances are good that this time it succeeds.

              And if the automailer is so badly set up that it can't set up a proper reply, are you really trusting that outfit that it handles

              • by Firethorn (177587)

                On a properly configured automailer, any error messages are supposed to go to the administrator. How else would he be made aware that something is amiss?

                And he still has to care enough to fix the problem of MY mail server rejecting his notices.

                And if the automailer is so badly set up that it can't set up a proper reply, are you really trusting that outfit that it handles all other aspects of the service well? (such as not communicating your e-mail to a spammer anyways...)

                'set up a proper reply'? What does that mean?

                My point would be that spammers have and will send out emails that are crafted to look like these confirmation emails. They're an attempt to get you to click on the link. As such, forums small enough to not end up on whitelists often get blocked.

                You start sending reject messages with resubmission requirements to allow email through and the spammers will automate that pro

      • by mlts (1038732) *

        Rejections just allow them to keep trying E-mail addresses and/or keep trying to figure out what will jump past. However, just having a SMTP server blindly slurp all incoming mail at one end and blow it out the other may cause false positives, and maybe causing big problems with mail troubleshooting.

        One needs to do both sanity checking during the E-mail transaction and post-receipt scanning. The SMTP server needs to outright rejects obvious crap, greylist suspect stuff, and tarpit mass entries that are ob

        • by XanC (644172)

          Post-receipt scanning is evil. Either accept the mail and deliver it, or reject it at SMTP time.

          I reject your assertion that the spambot will employ machine learning and figure a way through after a rejection.

          The correct solution is to employ massive delays on the SMTP transaction if an email is spam. This is a pseudo-tarpit. The mail is eventually rejected.

    • by hedwards (940851)
      Rarely do I get any spam in my Gmail inbox, that being said, it's tight enough that I do have to add things to my address book fairly often to make sure that it's not listed spam. But, the rate at which they mistakenly categorize something is impressively low.
  • by NevarMore (248971) on Wednesday July 14, 2010 @01:58PM (#32903968) Homepage Journal

    Its pretty trivial to have 10000 domain names pointing to 10 servers.

    It also seems trivial that when a domain name is flagged to also flag its server, then when a new domain name shows up that points to a flagged server rate it appropriately.

    Its a clever trick, but hardly an unfightable step in the spam-arms-race.

    • by mlts (1038732) *

      Then a spammer will DoS a legit site by using the ISP they use for an attack. It may be useful, but can easily be used by blackhats to sully the name and reputation of a legit site, especially if the attacker does a joe job and sends E-mail from that site's normal outgoing server's SMTP server that is shared.

      And spammers will do this. I have helped small businesses who got threatened with their domain contacts being the in the fake From: headers of a spammer, who threatened to send out spam in their name

  • by swschrad (312009) on Wednesday July 14, 2010 @01:58PM (#32903970) Homepage Journal

    if, for instance, they keep coming from the block reserved by {scumpuppy.net}, for instance, you know who to blacklist by range.

    • by JSBiff (87824) on Wednesday July 14, 2010 @02:09PM (#32904090) Journal

      This got me to thinking. In a world where IPv6 provides an astronomical number of subnet blocks, what's to keep spammers and malware distributors from jumping from IP block to IP block the way they jump from domain to domain?

      • Re: (Score:3, Interesting)

        by shentino (1139071)

        To make a TCP connection both ends have to have routable addresses.

        Sooner or later either they'll all have common subnets, or they'll cause a noticeable spike in routing traffic.

        • by khasim (1285)

          IPv6 will cause a huge problem with existing blacklists.

          It won't cause any problems with whitelists (which should be checked PRIOR to the blacklists).

          But they're still going to have to go through routers. So we're going to have to work on hacks that identify the routers that the communication is traversing. Then you should be able to see the "gateways" to the spammy networks and adjust the scoring.

  • This reminds me of the copyright protection on the Commodore 64 games and the game crackers.

    No matter what you can come up with, the spammers will find a way around. RBL's, disposable domains, IP banning => IP Spoofing, the list goes on. This may not be a winnable fight.

    I hate to say that because I have had my e-mail address for 10 years now and average 300 spam messages a day. Thanks to Spam assassin and a probability filter I can knock it down to only 3 or 4 a day getting through.

    Maybe it is time to st

    • by Firethorn (177587)

      Maybe it is time to stop fighting the spammers and start training the users!

      Consider, scammers have been using the same tactics for centuries, often simply updated to keep up with modern communication techniques.

      'Male Enhancement'? Snake Oil, just no longer sold personally with the attendant risk of getting lynched.
      Nigerian scheme? Fake ransom demands.

      We've tried educating people; I think there are certain types of people more suseptable than others. Perhaps they need a financial guardian or something. Along with the compulsive gamblers and such. :(

      It's not a bad idea, I try avo

    • by istartedi (132515)

      This may not be a winnable fight

      For as long as the Internet has been public, it's been an arms race. The real winners in any arms race are the arms dealers. Of course, since this is a "cyber" war, the "arms" are software, hardware, and bandwidth.

  • Really ... spammers are moving to disposable domains ...

    All those fja3lgah12.com email addresses I've been seeing for the last 10 or so years have been bots on real domains then eh?

    Seriously Tim, if you think something is new and exciting then you are experiencing one of two things, either its not really old and its actually common knowledge to everyone BUT you and the website your viewing ... or ... the website you're viewing is wrong.

    Think that EVERY TIME you go to post stories to the front page and we'll

  • No! (Score:3, Funny)

    by night_flyer (453866) on Wednesday July 14, 2010 @02:44PM (#32904540) Homepage

    Really? Are you serious? And this is news how?

  • Since the usual idea of spam is to get people to send money somewhere why not send a cop to that point and grab the account holders. Fines plus prison time should discourage them.

  • by aapold (753705) on Wednesday July 14, 2010 @02:52PM (#32904654) Homepage Journal
    If a bar sells beer to an underage person, they get in trouble. Roll the layers back and put it on them to institute their own methods of verification or face consequences for not doing so. As it is, they practically have a vested business interest in continuing to sell them these domains.
  • by damn_registrars (1103043) <damn.registrars@gmail.com> on Wednesday July 14, 2010 @04:20PM (#32905852) Homepage Journal
    Anybody who has ever really looked at the spam they've received knows this has been going on for years. Spammers buying domains in bulk for quick switching is a very old game. Fortunately as this gets more attention we get a little bit closer to paying attention to something we can do something about (for a little while longer anyways):

    Registrars. We have often pointed to the spammers, the ISPs, and the spamvertised domains as groups who make money off of spam. We have for various reasons frequently overlooked the registrars who are taking in a profit on the deal as well. There have been registrars in bed with spammers for almost as long as we have had spammers.

    The big difference though is that we could do something about the registrars - if we really wanted to. The registrars are supposed to keep valid data on their customers, and are supposed to adhere to specific ICANN guidelines (at least for specific TLDs). If the registrars couldn't register anything in the TLDs they want, they would think twice about knowingly dealing with spammers.
  • by rickb928 (945187) on Wednesday July 14, 2010 @04:32PM (#32905990) Homepage Journal

    I've been seeing this for at least five years. First, tasting was the preferred method. Now it seems some serious spammers have an 'in' with a registrar, where by the time I get to looking up the whois, the domain is gone and no longer registered. Not even the previous whois is available.

    I can't imagine that allowing someone to register a domain for a few days or even less, and then deleting all trace of the registration, is permitted by ICANN, but they haven't been able to police registrars very well at all for a decade now. Between the obvious front-running, search scanning, and tasting scams, most registrars are just plain shady. A pox on them all. It's gotten to the point that when someone asks me to look up a domain to see if it's available, I tell them to make the decision, and I will try to register it for them. For a while now, EVERY domain I've checked on was available when I looked it up, and minutes later it was gone.

    I'm not the dullest turnip to fall off the truck last night. Front-runnng is a scam. Disposable domains are not new. This article is at least 5-6 years late.

  • If your site IPv6 address is on the "naughty list" it doesn't matter what you spoofed the DNS to call the web site.

    Its is also a lot faster to do a binary hash on a fixed bit length IP address rather than a variable length domain name.

    Most of the current problems from miscreants and other forms of low-lifes will disappear, as will most script kiddies and pirate sharers out there when they realize that there is no more anonymity on the internet.

    Most traffic will be point-to-point and one of the things it wil

  • Maybe I worked sometimes around bad people, who chose bad advertising methods (I have never sent SPAM out, or worked SPAM machines), but this is just so old news, like saying:

    "Robbers are now using stolen cars",
    or
    "thieves are stealing credit card numbers"

    Either way, when it comes to spamming, the linked domain is mostly a throw-away one, and that is not even the problem. The problem is, the IP that sends the mail. At least for the weak/poor, who cannot build/pay for a botnet mailer. You can however always f

  • A global law against spamming with punishment of death by axe in the face for proved involvement with spam e-mail would probably frighten many spammers enough to make them stop. Just a thought.
  • In the US, doesn't can-spam act allow us to go after spammers? If so, who's the responsible party: the spammers... or the sites being advertised? *They* can't have disposable domains, and they're the ones who are paying the spammers.

                mark

What the scientists have in their briefcases is terrifying. -- Nikita Khruschev

Working...