CastleCops, Internet Crime Fighters
Need help? Click here to register for free! Absolutely zero advertisements on this site!

$9736.22 of $21422.68
left sidedonated so farneed $11686.46 donated to reach our goalright side, our goal
Help CastleCops serve the community on new servers, Donate Here to reach our goal.

Donation/Premium
spacer
block bottom
Security Central
spacer
· Home
· PIRT/Fried Phish
· MIRT
· SIRT
· Deutsch
· Wiki
· Newsletter
· O16/ActiveX
· CLSID List
· Contest2007
· Downloads
· Feedback (send)
· Forums
· HijackThis
· Hijacktrend
· LSPs
· My Downloads
· O18
· O20
· O21
· O22
· O23
· O9
· Premium
· Private Messages
· Proxomitron
· Reviews
· Search
· StartupList
· Stories Archive
· Submit News
· WsIRT
· Your Account
· Acceptable Use Policy
block bottom
Survey
spacer
Was 2007 a good year?

Yes it was a wonderful year
Yes, but there is always room for improvement
Status quo
It was a challenge
Other (leave comment)



Results
Polls

Votes: 952
Comments: 28
block bottom
spacer spacer

ICANN Responds

 
Post new topic   Reply to topic       All -> FavForums -> Knujon General Discussion [del.icio.us!] [digg it!] [reddit!]
View previous topic :: View next topic  
Author Message
bjz

Trooper
Trooper


Joined: Dec 31, 2007
Posts: 17
Location: USA

PostPosted: Sat May 24, 2008 6:40 pm    Post subject: ICANN Responds
Reply with quote

ICANN has posted a response to Knujon's release here:

http://www.icann.org/announcements/announcement-23may08.htm

Back to top
View users profile Send private message
Alvaro

Trooper
Trooper


Joined: Jan 28, 2008
Posts: 31
Location: Reno, NV (USA)

PostPosted: Sun May 25, 2008 1:42 am    Post subject:
Reply with quote

Now if only their policy enforcement department would be as incisive and willing to engage in swift response as their marketing people are, in this case to the implicit suggestion that ICANN is too slow...

Back to top
View users profile Send private message Visit posters website
ahoier

SIRT Handler


Joined: Jan 14, 2006
Posts: 1064
Location: USA

PostPosted: Sun May 25, 2008 4:37 am    Post subject:
Reply with quote

yea, it's a whole game of cat and mouse even, when it comes to creating WDPRS reports; since ICANN/InterNIC are not the "Internet Police" - but they allow these companies access to the domain name system registry, so they must follow the bare minimum of requirements, which requires domains to be registered with factual registrant information, and not faked information (like 234567 or whatever, as the tel/fax number?....).

Not enough action has been shown from the WDPRS (or wahtever the acronym is...) and so that's why many have turned away from using it, and instead simply use complainterator....shooting down domains one by one.

Back to top
View users profile Send private message Visit posters website AIM Address Yahoo Messenger MSN Messenger
tembow

Blue Angel
Premium Member

Joined: Oct 10, 2005
Posts: 2901

Blue Security Premium

PostPosted: Tue May 27, 2008 4:27 am    Post subject:
Reply with quote

Stacy.Burnettte at icann.org turns a blind eye to the real hard evidence. Stacy.Burnette at icann.org is an unmitigated disgrace. Though fully informed of the magnitude of the problem with Xin Net, she has done the absolute bare minimum to address the problem.

Stacy should resign her position with ICANN, as she obviously lacks the guts to take firm action. And as for the WDPRS process - it is a total laughing stock designed by a witless group of committee meeting attendees. Criminals and other spammers love it.

ICANN accreditation? It should be delivered on the back of the morning cereal packet.

The only thing that ICANN excels at is attending and documenting meetings, passing resolutions, and scheduling more meetings. They are a toothless gutless inept incapable bunch of losers. But wait, maybe I should say what I really think of them.

Back to top
View users profile Send private message Visit posters website AIM Address
Knujon

Captain
Captain
Premium Member

Joined: May 25, 2006
Posts: 585
Location: USA
Premium

PostPosted: Tue May 27, 2008 7:10 pm    Post subject:
Reply with quote

Having met Stacy I have to come to her defense. She does not necessarily have the authority or control to do all the things that folks like us would like to her to do. She's balancing competing interests and a lot of politics. This does not mean I'm giving her or ICANN a pass, but I think blaming her specifically for the mess with Xin Net misses the mark. This is an organizational issue and one I think can be fixed.

It’s frustrating, especially when Xin Net endures, but I think there are cracks appearing. All the time and energy you have put into this is a big reason why. Don’t give up.

Back to top
View users profile Send private message Visit posters website
tembow

Blue Angel
Premium Member

Joined: Oct 10, 2005
Posts: 2901

Blue Security Premium

PostPosted: Tue May 27, 2008 10:23 pm    Post subject:
Reply with quote

Sorry, sometimes I get so frustrated and reach breaking point. This was one such occasion.

Normal emissions will ensue!

Smile

You might like to inform Stacy that Xin Net is effectively blocking 20% of the Internet's mail exchanges from sending mail to anyone at xinnet.com. That is because the definition of their mail system is not in conformance with the RFC.
The MX records point to the names
mail.xinnet.com
bf-mail.xinnet.com
RFC states that these names must have an Address record.
Ignoring the RFC, Xin Net have set these names to point to an Alias (CNAME) record, which then points to
cemail142.ce.net.cn [123.100.7.9]

About 80% of the Internet's domain name servers use "BIND", which will still resolve the mail server to an IP address, even though Xin Net is not in conformance with the rules. But about 20% do not use BIND, and will fail to send mail to Xin Net.

It is an ICANN requirement that an accredited registrar permits communication with its ICANN listed contact point - see http://www.icann.org/registrars/accreditation-qualified-list.html

Unfortunately, when such problems are reported to Stacy, she does a test, finds that she can communicate OK, and responds that there is no problem.

Xin Net needs to define its mail system so that all people can communicate with them about spam, phish and other criminal activities.

Back to top
View users profile Send private message Visit posters website AIM Address
tembow

Blue Angel
Premium Member

Joined: Oct 10, 2005
Posts: 2901

Blue Security Premium

PostPosted: Tue May 27, 2008 10:50 pm    Post subject:
Reply with quote

Once Stacy has addressed that issue, there is another problem that falls within ICANN's domain of influence. An ever increasing problem in communicating with accedited registrars, is their adoption of spam detection techniques based on reported URL.
For example, emails sent to DNS.COM.CN / Beijing Innovative Linkage Technology are bounced back to sender if they include the name of one of their registered sites, which has made it on to a SURBL blocking list. And most of the sites that people wish to notify them about are already on those lists. They are effectively blocking complaints about thir own criminal sponsorship.
This is again in breach of ICANN requirements.

dns.com.cn is just one of a number of ICANN accredited registrars who have adopted this approach.

Ref:
CastleCops Link/t222604-SIRT_7841_Downloadable_Software_keiuuayr_cn_zabatut_mobi.html
CastleCops Link/t222601-SIRT_70891_VPXL_on_anherbal_dot_com.html

Back to top
View users profile Send private message Visit posters website AIM Address
Knujon

Captain
Captain
Premium Member

Joined: May 25, 2006
Posts: 585
Location: USA
Premium

PostPosted: Wed May 28, 2008 1:02 am    Post subject:
Reply with quote

This is all very important. Every detail about Xin Net's, or any other registrar's, failure to comply needs to be noted and listed. It should all be put together in a comprehensive report and posted publicly and prominently.

Back to top
View users profile Send private message Visit posters website
ahoier

SIRT Handler


Joined: Jan 14, 2006
Posts: 1064
Location: USA

PostPosted: Thu May 29, 2008 5:59 am    Post subject:
Reply with quote

This is a start, but does KnujOn have the power/force to get this into the news - or atleast to Stacy, herself?

I know I had a word with the cornell abuse-desk for using rediculous "filters" on an abuse-desk mailbox.....I mean......"hello? You WILL receive abusive e-mails, you can't "filter" the "abuse" and bounce it back.....duh? lol."

I would think it would be a no-brainer...



Err...oooops, I got that wrong...I didn't contact the Cornell "abuse" desk. But the bounce referred me to the Cornell "Help Desk" - so I voiced my problem/opinion with their abuse-desk filter problem to the help-desk.

They said they would let the abuse department know.

Same deal with ICANN/XIN Net though, the addresses listed as contacts should not be filtering or bouncing anything....

Afterall, we know filters only shield the problem (they think, oooohhh our network must be clean, we don't got any complaints! ...... errr....check the junk folder guys? lol).

Back to top
View users profile Send private message Visit posters website AIM Address Yahoo Messenger MSN Messenger
tembow

Blue Angel
Premium Member

Joined: Oct 10, 2005
Posts: 2901

Blue Security Premium

PostPosted: Thu May 29, 2008 7:05 am    Post subject:
Reply with quote

Just setting the record straight.
There is a technical problem with the way Xin Net / Sino-I.com has defined its Mail Exchange (MX) records in their DNS. About 20% of the Internet's mail senders will not be able to communicate with any name at xinnet.com. I have no evidence of filtering, other than a general lack of response or action.


Beijing Innovative Linkage Technology = dns.com.cn
, a heavily abused Chinese registrar, has implemented URIBL blocking on their email, thus preventing email containing spammed URLs in complaints, even when the URL is registered with them. Complainants have to obfuscate the URL.

Back to top
View users profile Send private message Visit posters website AIM Address
tembow

Blue Angel
Premium Member

Joined: Oct 10, 2005
Posts: 2901

Blue Security Premium

PostPosted: Thu May 29, 2008 12:54 pm    Post subject:
Reply with quote

ICANN and Knujon should also be aware of the good news this past fortnight.

Over the past two weeks, Todaynic has taken significant action to close out the spammer abuse of their registration service.

The list of bulk reported domains listed in the Castlecops Spam Wiki has been taken on board. Todaynic has processed the lists and removed 100% of the entries in http://wiki.castlecops.com/Todaynic_Removals and http://wiki.castlecops.com/Todaynic_Removals_Archive
and 100% of the entries in http://wiki.castlecops.com/Todaynic2_Removals

See the overall statistics at
http://wiki.castlecops.com/Bulk_Spam_Reporting

That totals 6,600 sites suspended.

In addition, they have suspended a further 1,500 spammed URLs detected in spam-traps over the past 5 days.

This is a highly commendable change, and shows what one Chinese registrar can do once they realize that there is a problem, and set out to address it. Todaynic has shown that there is hope for cleaning up the abuse of registrars China, in much the same way as we saw in Hong Kong just a few months ago.

Congratulations also go to the team of Nodus, Trobbins and AlphaCentauri for their tireless efforts in documenting and reporting all of these violations. Knujon likewise has played an important role in filing the WDPRS reports which have kept ICANN aware of the issue.

Back to top
View users profile Send private message Visit posters website AIM Address
Alvaro

Trooper
Trooper


Joined: Jan 28, 2008
Posts: 31
Location: Reno, NV (USA)

PostPosted: Fri May 30, 2008 2:12 pm    Post subject:
Reply with quote

ahoier wrote:
[...] does KnujOn have the power/force to get this into the news - or at least to Stacy, herself?
KnujOn is fast on its way to getting the recognition as an authority needed to seed the information that the general public is desperately looking for. And that is truly the key, in my opinion, to break through the insane end user-centric approach (i.e., focused on filtering) that still generally prevails.

When you deal with a tough, urgent and complex issue, entailing many parties - which, to make it worse, are distributed internationally - the "trick" is to establish clarity of vision with a compelling and cogent rationale, delivered in simple to understand terms.

The "90% balloon" is an excellent example of that; once people understand that ICANN is holding the aces in the fight against spam, yet that it too (like any international authority charged with oversight) must be massaged into action, the ball will roll unstoppably.

I am convinced that within ICANN there are people who are both aware and genuinely concerned. It doesn't make any sense whatsoever to pile onto them (certainly not using "bureaucrats" vernacular); instead, as KnujOn has been pointing out, pressure must be racked up so that the key players within ICANN get the tools they need to overcome the traditional enemies of progress: slow learning, fast forgetting, and most formidable of them all, organized resistance.

Therefore, talking about KnujOn as "a player" won't make a dent - all of us must take co-ownership and do what we can in pushing the message. The immense mound of forensic information that KnujOn delivers with the compelling rationale I mentioned needs a resonance chamber, and that is where we - the community of "users" - can and should come into action.

We all are KnujOn. And I am convinced that we have the power, the force, to put this properly on the general news cycle managers' agenda.

Back to top
View users profile Send private message Visit posters website
tembow

Blue Angel
Premium Member

Joined: Oct 10, 2005
Posts: 2901

Blue Security Premium

PostPosted: Sun Jun 01, 2008 9:51 am    Post subject:
Reply with quote

The good news continues. Thanks to the excellent work of the Complainterator team, especially trobbins, in documenting some 5,500 sites requested for removal by Xin Net we have yesterday seen those 5,500 sites removed.

Thanks to Castlecops for hosting these in the Wiki. And thanks to Jim_P whose persistence in using Complainterator to get his foot in the door at Xin Net has finally paid off in such a spectacular fashion.

Back to top
View users profile Send private message Visit posters website AIM Address
Alvaro

Trooper
Trooper


Joined: Jan 28, 2008
Posts: 31
Location: Reno, NV (USA)

PostPosted: Sun Jun 01, 2008 11:41 pm    Post subject:
Reply with quote

Team, take a bow.

Awesome is the word. Ginormously so.

Back to top
View users profile Send private message Visit posters website
tembow

Blue Angel
Premium Member

Joined: Oct 10, 2005
Posts: 2901

Blue Security Premium

PostPosted: Mon Jun 02, 2008 8:41 am    Post subject:
Reply with quote

A further 1048 sites posted in the Wiki have been suspended within 12 hours.

Prestige Replicas - 51 suspensions
Exquisite Footwear & Bags - 15 suspensions
King Replica - 130 suspensions
Pharmacy Express - 10 suspensions
ED Express - 4 suspensions
Global Pharm - 5 suspensions
Your Online Pharmacy - 3 suspensions
Online Pharmacy - 1 suspension
WonderCum - 3 suspensions
MaxGain+ - 104 suspensions
Express Herbals - 157 suspensions
LNHSolutions - 14 suspended
ED Pill Store - 16 suspended
Canadian Drugstore - 3 suspended
European Pharmacy - 50 suspended
Canadian Pharmacy - 382 suspended
Canadian Healthcare - 100 suspended

Total = 1048

Back to top
View users profile Send private message Visit posters website AIM Address
Display posts from previous:   
Post new topic   Reply to topic       All -> FavForums -> Knujon General Discussion All times are GMT
Page 1 of 1

 
Quick Reply:
Username: 

Quote the last message
Attach signature (signatures can be changed in profile)
 
You can post new topics in this forum
You can reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001 phpBB Group
spacer spacer