For every complaint regarding a .RU domain, RU-CENTER NCC sends a reply as follows

You can filter your spam so everything with a .ru TLD goes in the trash.

They are ICANN accredited, but for the .ru domains, they don't even have to put the registration info in the whois. That makes it hard to report sites for false whois, the only rule ICANN expects registrars to enforce.

RU-CENTER NCC's latest response

They need better clarification.

Perhaps, mention of "fast-flux" and/or "round robin", "botnet hosting" etc...would be of use.

It's not simply a "spam" problem, it's a fraud problem, as well as a malware/infection problem.

The "machines" connected to the IP addresses which point to these domains are being infected by malware.

Russia doesn't have anti-spam laws, so maybe it would be possible to go this route...then again who knows, this is the same country that was offering the first "create-a-botnet" CDs on the streets...



Something to note...I was reading http://www.nic.ru/dns/contract/en/sup1_1_ru.html which is their "regulations" for registering a domain name

Under "3.2. Conditions of domain delegation" their is the following mention:

Add them all to the CC: area of your complainterator contacts file and let the complaints fly


If you want to phone em,
Telephone: +7 (495) 737-0601
Fax: +7 (495) 737-0602

A new Russian registrar (REGISTRATOR-REG-RIPN = mastername.ru) sent me the following reply to a removal request

So, we gotta try and fight it from the "malware" or "fraud" department.

When mailing requests don't mention anything spam related.

Link to siteadvisor as evidence, but mention "bad shopping experience" related to the domain, or fraudulent use, etc.

My guess, is if the report contain any "spam" keyword, they will dump it in the trash :<

So try the malware route, and/or "fraud" route which are/can be closely related.

Sites are being hosted by large-scale botnets that have been infected by malware

As AC pointed out with Chinese registrars, when chiming in the HK Police Force, evidence of HK citizens have been included. Perhaps get some netstat logs of Russian Citizens who are victims of these botnets, including time/date stamps, including GMT Offset.

Is there a "Russian Police Force" address or other equivalent that can be mailed?


I'd say, let them know "Filtering is not an option, incarceration is the only option" or some such, but just move on, try tending the reports to Russian registrars from the fraud/malware/botnet front instead.

I think links to the Spamtrackers.eu wiki will still be sufficient....

But perhaps try using a short URL service to hide the "spam"trackers URL behind one of the "preview.tinyurl.com" links, incase they have some auto-responder that triggers in the keyword "spam"

Just do a play on words. Canadian Pharmacy could be considered a "fraud-gang" or "malware-gang" instead of a "spam-gang" within reports to Russian registrars.

Just some ideas

He said everything I was about to say.
Sometimes it is nice to feel redundant !

A reply from REGISTRATOR-REG-RIPN:

Which route did you go, reporting it as a "spammed" or "spamvertised" domain used in "spam"?

Or the malware/fraud/botnet approach?

hmm....atleast they linked to Wikipedia with an explanation of Black_PR...

Well...any idea if the spammed domain was registered using stolen credit cards...? That could fall under the following statement at Wikipedia

I just sent a standard complinterator report; the spammed website domain was office-v.ru - looks like a real estate site.

I don't think there was any joe-job, fraud, malware, or stolen credit cards involved. The spam was sent from Brazil. Full details
http://www.spamcop.net/sc?id=z1785586945zee54d2c3d2fc7316918b0df20e9157e0z

I suggest that only cases of clearly illegal spam sites be directed to registrars when using complainterator. As the author, I would prefer that its reputation as a serious reporting tool be maintained.

Using it because you got one spam for a possibly legitimate site is a bit over the top, and reduces credibility for both the reporter and for the report tool.

In this case, a respectable looking web site in Russia was promoted via unsolicited mail emanating from Brazil. That's a good one for Spamcop to handle, as it goes after the email source as its main thrust.

I am not surprised by the registrar's response. Putting myself in their shoes as a registrar I would feel inclined to send the same response myself.

I appreciate your advice, but it's sometimes hard to check out every spamvertized website. I get a quite good number of Russian spams every day; most are of pornographic nature, and they do change their domains often. As I do not read Russian, some websites are completely unclear what they are about. This particular one I only checked after receiving the reply.

But since most Russian registrars don't act at all, maybe we should stop sending reports that way?

Spam is completely legal in Russia; that's why we get spammed by the type of companies that would never risk their reputations by spamming if they were in other countries.

I don't bother reporting those, as the only response will be a polite explanation of Russian antispam laws or lack thereof (except for registrars like ESTDomains that have their own antispam policies that users must agree to up front). It's easier to set Mailwasher to filter for common words in Cyrillic and their various encodings and just delete.

As the Russian economy grows, they'll start to get sick of spam, get concerned about why they can't get their emails to potential business partners in other countries past spam filters, and start wondering whether the RBN is so harmless after all.

Not sure if this is the same as RU-CENTER: