I did say fast flux. Take down one compromised vm in a cheap datacenter somewhere and it pops up on some random company's exposed file and print server somewhere else. <div class="gmail_quote">On Jun 26, 2013 8:49 PM, "Frank Gadegast" <<a href="mailto:ripe-anti-spam-wg@powerweb.de">ripe-anti-spam-wg@powerweb.de</a>> wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> Suresh Ramasubramanian wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> Consider, if you will, a domain that has absolutely no "content", but is the command and control for a fast flux botnet. Which has been the case with both the latvian as well as austrian cctld cases. </blockquote> Same thing. The controllers must run on a server with an IP address, destroy these servers. The domainname is just a name, its the hostnames in the domains nameserver pointing to an IP and a server with whatever service running under that IP. Its likely that the botnet owner uses another domainname, if you remove it. botnet owners arent stupid. Kind regards, Frank <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> On Jun 26, 2013 7:52 PM, "Frank Gadegast" <<a href="mailto:ripe-anti-spam-wg@powerweb.de" target="_blank">ripe-anti-spam-wg@powerweb.de</a> <mailto:<a href="mailto:ripe-anti-spam-wg@powerweb.de" target="_blank">ripe-anti-spam-wg@powerweb.de</a>>> wrote: Suresh Ramasubramanian wrote: Just want to note, that domainnames themself cant be dangerous (of course using a similar name could cos problems with trademarks and the like). Its only the content thats dangerous, eMail or webpage. So its more a problem of the people running the services and these are either hacked sites or ISPs tolerating or deliberatly hosting this content. Asking a TLD registry to remove domainnames because of pishing its then somehow to wrong place to start, specially for Spamhaus, they should know better and simply place all those IPs on their lists ... BTW: just found the service "Google Safe Browsing Alerts for Network Administrators" where every AS owner can register under <a href="http://www.google.com/__safebrowsing/alerts/" target="_blank">http://www.google.com/__safebrowsing/alerts/</a> <<a href="http://www.google.com/safebrowsing/alerts/" target="_blank">http://www.google.com/safebrowsing/alerts/</a>> to receive notification about doubtful content Google might find, when spidering your network. This could be pretty usefull to remove pishing and hacked sites for pretty quick. Kind regards, Frank There are of course multiple sides to that story as well. Like a massive infestation of rock phish domains which, too, were knowingly disregarding local law, and were present in rather massive quantities on the .at ccTLD at that time. <a href="http://www.spamhaus.org/__organization/statement/7/" target="_blank">http://www.spamhaus.org/__organization/statement/7/</a> <<a href="http://www.spamhaus.org/organization/statement/7/" target="_blank">http://www.spamhaus.org/organization/statement/7/</a>> --srs On Wednesday, June 26, 2013, Wilfried Woeber wrote: Erik Bais wrote: [...] > For those that want to read up on what actually happened on that specific > incident in Latvia (July/August 2010), have a read on the following open > letter from CERT.lv > > <a href="https://cert.lv/uploads/__uploads/OpenLetter.pdf" target="_blank">https://cert.lv/uploads/__uploads/OpenLetter.pdf</a> <<a href="https://cert.lv/uploads/uploads/OpenLetter.pdf" target="_blank">https://cert.lv/uploads/uploads/OpenLetter.pdf</a>> And this actually wasn't the only or the first "incident" with Spamhaus. They also tried similer *piep*^Wbullying against NIC.at before. Which actually has discredited Spamhaus in my personal opinion for sure, for knowingly disregarding local law, but that's slightly OT here - but maybe not... > Erik Bais Wilfried. -- --srs (iPad) </blockquote> </blockquote></div>