September 2008 - At-Large - lists.icann.org

Where is the promised Comprehensive Review of ICANN Accreditation Processes?
by Danny Younger Sept. 4, 2008

Sept. 4, 2008

Source: http://www.knujon.com/news.html Phantom Registrars In investigating the 48 Directi-owned Registrars with questionable locations, we reported facts. The address used by many of these Registrars: "14525 SW Millikan Way Beaverton, OR 97005-2343" is the address of a mail forwarding service called Earthclassmail. According to Directi, the listed companies are registered in Delaware, but not in Oregon or New York as listed in the ICANN Directory. Directi is headquartered in Mumbai, India. KnujOn feels that any company given so much responsibility over the Internet should fully disclose where they are located, but this is apparently not an ICANN requirement. Indeed, Stacy Burnette, director of contractual compliance at ICANN, said the organization is satisfied the registrars are incorporated in the location listed in their application. Telephone numbers in the contact information need not correspond to the location of incorporation, she said. ICANN doesn't require registrars to publicly disclose their place of incorporation. To which KnujOn says: Huh? So, as the expression goes, don't hate the player hate the game. Directi merely acquired these accreditations by ICANN's own rules. Summary: One address in the application, a second address disclosed to the public. Read this line again: "ICANN doesn't require registrars to publicly disclose their place of incorporation." How does this figure into ICANN's mission to be an open and transparent organization? "Telephone numbers in the contact information need not correspond to the location of incorporation". How can there be any accountability? This situation is upside-down. Registrants are required to list their valid contact information, but the Registrars who sponsor their domains are not.

3 2

DIRECTI Demands Takedown of KNUJON Post
by Danny Younger Sept. 3, 2008

Sept. 3, 2008

Source: http://infosecurity.us/?p=1105 On Wed, Sep 3, 2008 at 01:09, Bhavin Turakhia <bhavin.t(a)directi.com wrote: Hi Marc We came across your article on http://infosecurity.us/ based on Knujons factually inaccurate and baseless report. Directi is not linked with any of the activities described in that report and Knujon, in their research have never bothered to get their facts straight from either ICANN or us. The article you publish is false and defamatory and hence I urge you to take it down immediately. Feel free to connect with me for any clarifications - my cellular number is <<REDACTED>> and I will be happy to share the actual facts with you - something that Knujon has not bothered to do so far. Find below our email to Knujon concerning the gross inaccuracies in their article Warm Regards Bhavin Turakhia Founder, Chairman & CEO Directi T: +91-22-66797600 M (IN): +91 <<REDACTED>> —- Dear Garth (from Knujon), This is with regards to the numerous articles on your website www.knujon.com that frivolously implicate the Directi Group. Before I move to the specifics, Id like to comment on the challenge you’ve thrown open to us, to take a lead in the endeavor of suspending every illicitly run domain name. Please understand that Directi continues to be one of the most proactive Registrars today in terms of combating abuse and implementing strict AUPs and we have a significant investment in terms of manpower and processes to achieve just this. We do so, not because were contractually obligated, or to protect our own business interests, but because we sincerely believe in the ideology of making the internet a safer and more secure medium for conducting business. Its really unfortunate that your analysis misrepresents the details, and conveniently ignores all of the active measures we take regularly against spamming, phishing and other forms of abuse activity on the internet. As a matter of fact, we have a ZERO tolerance policy towards unscrupulous activities, and therefore extremely shocked to learn about the baseless allegations made in your report. Given below, is a list of all the false information, conclusions and accusations that you have repeatedly made about our organization: 1. EST is NOT affiliated to the Directi Group in any way: EST just happens to be one of the several thousand service providers that use our technology to provide domain registration services. Therefore all of the claims that EST is a part of our Group is grossly incorrect. 2. Your claim that the accredited companies we own are: a) Phantom Registrars (ex: Jumbo Names) that are not incorporated or Do Not Really Exist and b) somehow involved in supporting the fake pharmacy business in some way, is not only grossly incorrect, but also seriously defamatory. You may not be privy to the strategic reasons why several of the top web services cos. need to invest in multiple registrar companies. However, there is absolutely no substance in suggesting that these companies are somehow involved in illegal activities. Not only do these registrars operate legitimately, but they also implement the strict AUPs for all sponsored domain names. 3. You claim that the Directi Group is somehow closely linked with Atrivo, which probably is a false conclusion drawn from pt. 1. above. 4. There are several other domain names that you have listed for various issues - software piracy, for instance - and claim that they are privacy protected. These domain names and their sponsoring registrar have not used privacy protection services for several months now; it is unfortunate that you did not choose to verify your data before making these accusations. 5. The statement “While Directi claims they will suspend illicit domains, KnujOn has found on many occasions Directi sponsored domains being removed temporarily only to be restored after a brief period with the same content” is incorrect, but we do acknowledge a technical lapse that may have led you to believe this. The domain names that you’ve listed were not intentionally restored, but did not get suspended in due process because of a technical error. When vigilant netizens alerted us about the situation, the domain names were suspended immediately. 6. The statement “If a consumer complains to Directi/PublicDomainsRegistry about these sites they simply direct them to the ISP host that serves the content. If and when the site content is closed by the ISP host, Directi/PublicDomainsRegistry just helps them set up at a new IP.” is baseless and seriously defamatory. We do not condone any abusive behavior using domain names registered through us, much less facilitate it. There are cases where we forward complaints to the host to pursue in accordance with their AUP, but in no circumstance do we enable purported abusive registrants to setup in any fashion. 7. On several prior instances, we have attempted to explain to your organization the motives and mechanism behind Privacy Protection as a service. Privacy Protect isn’t intended to harbor miscreants, but to protect genuine domain owners from them. This service, provided through a network of registrars, is essentially free and has no affiliation with any domain names that use it. 8. Also, as a Registrar, we must categorically state that we have no association with the domain names registered through us. The insinuation that we as a registrar benefit in any form through abusive domain names is grossly incorrect; on the contrary, we invest considerable resources toward mitigating such abuse of our services. 9. During the Prescription Addiction Radioshow, you claimed that the registrar community is unable to effectively police illegal activities and hence most registrars are in violation of the ICANN RAA. This is factually incorrect since the job of policing the internet cannot be the sole responsibility of registrars, and the Registrar Accreditation Agreement doesnt state any such obligation either. Most registrars, purely out of moral reasons, build AUPs to ensure that they proactively prevent their services from being used for any illegal activity. Based on all of these false assumptions, misrepresentations and factual inaccuracies, you have referred to our organization as beastly, rogue, irresponsible, immoral and a supporter of the illegal narcotics industry. I hope you understand that this sort of frivolous victimization and public abuse is intolerable for our organization, and always tackled with utmost severity. However, since we believe that your intentions are not wrong, we would like to resolve this amicably by requesting all necessary corrections to the information published. We would also need a public clarification which explicitly states that the Directi Group is in NO WAY harboring or, being in any way involved, in any form of illicit activity. > On another note, I request you to understand the limitations registrars face in tackling these issues. Despite having a dedicated abuse complaints processing team, it is impossible for us to deploy the necessary resources and expertise to manually authenticate the legal status of each of the 4 million + sponsored domain names. A false positive could lead to a significant loss for an innocent customer, for which we will be squarely responsible. Things get even more difficult when other registrars that use our platform, are less sensitive towards their moral responsibilities. Sure wed like to pull the plug and permanently close our business with them, but how does one protect the several thousand innocent website owners that also happen to use their services? I believe you understand as well as we do that a true cleanup process requires the concerted involvement of several industry participants including ICANN, registries, brand owners, law enforcement agencies and registrars. You can be assured that from a registrar standpoint we continue to extend our full cooperation to the community at all points in time. We have always taken this issue seriously and will always continue to do so. Well also be glad to clarify your doubts on the above mentioned facts, over a conference call which can include the relevant people from our side. Were open to a constructive dialogue with you, and are all ears to any specific suggestion that you may have for us. If youd like that, do provide us with an appropriate time and number on which you can be reached. Considering the defamatory nature of the content in your posts and the inaccuracy of several accusations, we hope that the requested corrective measures will receive utmost priority and reflect immediately on your website. Best Regards, Sandeep Ramchandani Strategic Partner Manager The Directi Group

1 0

ICANN cast as online scam enabler
by Danny Younger Sept. 3, 2008

Sept. 3, 2008

[excerpt] "Two recently issued reports portray the Internet Corporation for Assigned Names and Numbers (ICANN) as a bureaucracy that enables cyber criminals. In one report researchers Jart Armin, James McQuaid and Matt Jonkman detail how a one of ICANN's prized sponsors has ties to one of the net's more prolific sources of malware and illegal online pharmacies. It's called LogicBoxes, and over the past two years, ICANN has listed it as a sponsor for meetings that took place in Los Angeles and Delhi, India. It turns out LogicBoxes has an association with Atrivo, a network provider that also goes by the name of Intercage. According to the study, a random sampling of 2,600 addresses hosted by Atrivo revealed 7,340 malicious web links, 910 infected websites, 310 malicious binaries, and 113 botnet command and control servers. As an autonomous systems (AS) provider, the Concord, California-based company controls a large number of IP addresses. The report details how Atrivo works with a rogue's gallery of other companies to enable anonymous sites that punt scareware, malware and online sites pushing Viagra and other sites. Other companies include Hostfresh, EstHost, EstDomains and PrivacyProtect. A second report issued by an outfit known as Knujon (that's "no junk" spelled backwards) details 48 phantom domain name registrars whose sole purpose seems to be the registration of addresses used in spam and malware campaigns. All of them can be linked back to the Directi Group, which has long been a prolific provider of URLs to scammers." full article here: http://www.theregister.co.uk/2008/09/03/cyber_crime_reports/ Anyone that's interested in working on an enforceable Registrar Code of Conduct is invited to join the RAA Working Group. Please subscribe to the list at: http://atlarge-lists.icann.org/mailman/listinfo/raa-wg_atlarge-lists.icann.… and send an email introducing yourself to that list.

3 2

Re: [At-Large] Re-engineering the Internet
by Evan Leibovitch Sept. 3, 2008

Sept. 3, 2008

JFC Morfin wrote: > http://www.google.com/googlebooks/chrome/index.html > > This may be an important day as Google (Vint Cerf is the Internet > Executive there?) seems to be really innovating, and talking > seriously, bout things of real interest to @larges. May be, but discussions of the HTTP browser experience is well beyond the mandate of ICANN. Please consider discussing this issue in a different forum. While I am not belittling the significance of Google's actions, this is not the place to debate them. - Evan

2 1

Re: [At-Large] [AfrICANN-discuss] Conférence ICANN : se protéger du phishing - Briefing session on Registrar Impersonation in Phishing Attacks
by Khaled KOUBAA Sept. 2, 2008

Sept. 2, 2008

It's really a nice initiative that ICANN is doing here. It's an interesting and very important subject. I recommend that ICANN repeat such capacity building actions for other issues related to our work. Khaled Anne-Rachel Inné a écrit : > Conférence ICANN : se protéger du phishing > > > Demain 26 août, l'ICANN organise une web conférence d'information sur > les cas d'usurpation d'identité des bureaux d'enregistrement lors > d'attaques de phishing. > > > De quoi s'agit-il ? Un pirate usurpe l'identité d'un registrar et > envoie à un client de ce dernier un faux message au sujet de ses noms > de domaine. Un avis d'expiration par exemple. > > C'est ni plus, ni moins du phishing. Le pirate a créé un site > frauduleux, similaire à celui du bureau d'enregistrement, pour inciter > le client à accéder à son compte de gestion du domaine concerné et à > révéler involontairement ses informations d'identification. > > Cette technique surtout connue dans le milieu bancaire sera expliquée > de manière préventive par Dave Piscitello de la division Sécurité et > Stabilité du Comité Consultatif de l'ICANN, lors d'une web conférence > (en français et en anglais) dont vous trouverez ici tous les détails. > > https://st.icann.org/alac/index.cgi?registrar_impersonation_in_phishing_att… > ENGLISH VERSION -- > > As announced at the last policy unit call on Monday, At-Large is going > to have a briefing session with Dave Piscitello this coming week on > Registrar Impersonation in Phishing Attacks and other stakeholder > communities are most welcome to join. > > The SSAC Advisory on Registrar Impersonation has recently been > translated into French and Spanish. They have not been uploaded to the > SSAC website yet but we have it linked to the meeting page for the > briefing session: > > https://st.icann.org/alac/index.cgi?registrar_impersonation_in_phishing_att… > > You can find the English, French and Spanish versions of the briefing > invitations attached to this email for your use. If you have questions > regarding this Briefing, please get in contact with somebody from the > At-Large staff. > https://st.icann.org/alac/index.cgi?registrar_impersonation_in_phishing_att… > _______________________________________________ > AfrICANN mailing list > AfrICANN(a)afrinic.net > https://lists.afrinic.net/mailman/listinfo.cgi/africann > >

15 22

KnuJohn: Phantom Registrars, Fake Pharmacies, and the Secret Infrastructure
by Derek Smythe Sept. 1, 2008

Sept. 1, 2008

Hi all A very interesting read and very topical: http://www.knujon.com/news.html Derek

1 0