While I always loved that show, like any teen geek growing up, I mean what teen age male would not like to build a perfect g/f, however today’s blog is about the abuse of .science domains. Like many of the new top level domains, the reason they are so attractive for spamming is that they are so cheap to buy, use once, and then throw away.
However, it also means hosting companies must be turning a blind eye to such obvious spammers, and when you see many different ranges all start spamming on the same day, it also makes you suspicious that it might all be part of the same group.
And now that the holidays are over, they are back hard at work at this.
18.104.22.168 9 tested.jiygxba.science 22.214.171.124 11 proof.kxaolpo.science 126.96.36.199 10 tandem.tianmian.science 188.8.131.52 10 traces.bozhongzhi.science 184.108.40.206 8 shawl.hongzhijian.science 220.127.116.11 11 brawny.hongzhi.science 18.104.22.168 7 tangerine.xingjiangjiu.science 22.214.171.124 7 spoon.bitmulti.science 126.96.36.199 75 material.basarabu.science 188.8.131.52 75 julian.plastico.science 184.108.40.206 76 distance.vwabu.science 220.127.116.11 4 origin.abutian.science 18.104.22.168 7 gratuity.zhiling.science 22.214.171.124 (M) 35 change.400aicom.science 126.96.36.199 (M) 3 header.as9521tk.science 188.8.131.52 (M) 2 jump.pybsmto.science 184.108.40.206 (M) 3 tears.vyat.science 220.127.116.11 (M) 2 lover.uwbuwhgj.science 18.104.22.168 (M) 2 minutes.hdjvg.science 22.214.171.124 (M) 2 friend.doxkt.science 126.96.36.199 (M) 2 confirm.777nacom.science 188.8.131.52 (M) 3 child.ctpdqjf.science 184.108.40.206 (M) 3 spring.iqnfekdo.science 220.127.116.11 (M) 27 hosting.ggsyi.science 18.104.22.168 (M) 28 swine.xqdfye.science 22.214.171.124 (M,RN) 24 scout.vkzonckt.science 126.96.36.199 (M) 28 police.yoywi.science 188.8.131.52 (M,RN) 27 prospect.700iicom.science 184.108.40.206 (M) 21 imagine.111kfccom.science
Now you would think this would raise alarm bells with the hosting provider, and the obvious throwaway domains should be something that the registrar is also looking at, however lets quickly look at who registered those domains.
Registrant Name: Boyles Sermons Registrant Name: Amina Korhonen
The first block is owned by one ‘person’ and the second two by another ‘person’, however interestingly enough, all registered on the same day.
Yet, they seem to be on IP(s) registered to different people. Unfortunately, ‘Rapid Switch’ does not appear to operate an ‘rwhois’ server for their range.. However, ServerYou upholds better best practices in this regard.
Customer: TanQiong (C03386035) 220.127.116.11/27 Customer: LangBang (C04453655) 18.104.22.168/26
Still, the behavior is exactly the same, so something is fishy.. Either it is several individuals colluding, or some of the registration information may not be correct. Just to give an idea how harmful this can be in just a few hours….
22.214.171.124 74 tested.jiygxba.science 126.96.36.199 72 proof.kxaolpo.science 188.8.131.52 74 tandem.tianmian.science 184.108.40.206 73 traces.bozhongzhi.science 220.127.116.11 74 shawl.hongzhijian.science 18.104.22.168 74 brawny.hongzhi.science 22.214.171.124 73 tangerine.xingjiangjiu.science 126.96.36.199 74 spoon.bitmulti.science 188.8.131.52 102 material.basarabu.science 184.108.40.206 100 julian.plastico.science 220.127.116.11 102 distance.vwabu.science 18.104.22.168 57 origin.abutian.science 22.214.171.124 60 gratuity.zhiling.science
The number in the second column is how many ISP’s and Telco’s reported this over the same few hour time span. That kind of volume should be detectable at the source as well, it would be interesting to know how these individuals get away with this, without the registrar or the hosting companies appearing to notice.