Domain Tasting used by criminals - .org spam example

["Mark Samson" <tromso@xxxxxxxxxx>]

(Resent from another mail account as there seemed to be problems submitting 
mail from fastmail.fm)

Domain Tasting used by criminals
================================

Domain Tasting is a polite way of referring to this abuse, that can involve 
mass spamvertising of domain names involved in criminal activity such as 
phishing, credit card fraud and selling fake software and illegal sale of 
medicine that normally requires prescriptions. Do we even know whether the 
grace period abuse is used mainly for tasting or for generating free spam 
domains for criminals ? Just noting numbers of deletions doesn't mean that they 
are used just for "tasting". 

 From the ICANN report on  "GNSO Issues Report on Domain Tasting" 14 June 2007
http://gnso.icann.org/issues/domain-tasting/gnso-domain-tasting-report-14jun07.pdf
 

'The .ORG monthly report for January, 2007 shows that five registrars deleted 
1,773,910 (99.4%) of domain names within the AGP, retaining only 10,862 domain 
names following the AGP.'

I've recently reported  .org domains and looking at the list wonder if the 
spammer was making use of "domain tasting" or the tools registrars provide for 
this. I find similar  references to "domain kiting" where it appears the grace 
period may be repeatedly abused to hold onto and make free use of the domain. 

The following .org domains were reported to Beijing Innovative Linkage 
Technology Ltd registry in my 8th report on 18th August concerning the same 
registrant since 8th July, with no action being taken. They just keep 
registering new spam domains for this same registrant. I've since found an even 
longer list which I append. It just makes nonsense of the Registrar 
Accreditation agreement:

http://www.icann.org/registrars/ra-agreement-17may01.htm#3
3.7.7.9 The Registered Name Holder shall represent that, to the best of the 
Registered Name Holder's knowledge and belief, neither the registration of the 
Registered Name nor the manner in which it is directly or indirectly used 
infringes the legal rights of any third party.


The spammer is documented at this wiki:
http://spamtrackers.eu/wiki/index.php?title=Discount_Pharmacy

topsaverparty.org  Registrar:Beijing Innovative Linkage Technology Ltd. 
(R1292-LROR)

Spam domains using topsaverparty.org nameserver:

rxification.org Bill Phelan Chuyi ZHU Registrar:Beijing Innovative Linkage 
Technology Ltd. (R1292-LROR)
#1      rxand99.org     Thu, 16 Aug 2007 08:22:15 +0000 Bill Phelan Chuyi ZHU 
Registrar:Beijing Innovative Linkage Technology Ltd. (R1292-LROR)
#2      rxgram.org      Thu, 16 Aug 2007 06:33:57 +0000 Bill Phelan Chuyi ZHU 
Registrar:Beijing Innovative Linkage Technology Ltd. (R1292-LROR)
#3      rx99.org        Thu, 16 Aug 2007 02:43:24 +0000 Bill Phelan Chuyi ZHU 
Registrar:Beijing Innovative Linkage Technology Ltd. (R1292-LROR)
#4      99rx.org        Thu, 16 Aug 2007 01:38:39 +0000 Bill Phelan Chuyi ZHU 
Registrar:Beijing Innovative Linkage Technology Ltd. (R1292-LROR)
#5      theanswersfree.org      Wed, 15 Aug 2007 12:27:39 +0000 Bill Phelan 
Chuyi ZHU Registrar:Beijing Innovative Linkage Technology Ltd. (R1292-LROR)
#6      medicalanswerssite.org  Wed, 15 Aug 2007 08:21:29 +0000 Bill Phelan 
Chuyi ZHU Registrar:Beijing Innovative Linkage Technology Ltd. (R1292-LROR)
#7      rxlounge.org    Tue, 14 Aug 2007 16:39:06 +0000 Bill Phelan Chuyi ZHU 
Registrar:Beijing Innovative Linkage Technology Ltd. (R1292-LROR)
#8      virturx.org     Tue, 14 Aug 2007 16:01:24 +0000 Bill Phelan Chuyi ZHU 
Registrar:Beijing Innovative Linkage Technology Ltd. (R1292-LROR)
#9      123alist.org    Tue, 14 Aug 2007 15:54:55 +0000 Bill Phelan Chuyi ZHU 
Registrar:Beijing Innovative Linkage Technology Ltd. (R1292-LROR)
#10     rxstorm.org     Tue, 14 Aug 2007 14:28:56 +0000 Bill Phelan Chuyi ZHU 
Registrar:Beijing Innovative Linkage Technology Ltd. (R1292-LROR)
#11     remediaabc.org  Tue, 14 Aug 2007 10:59:56 +0000 Bill Phelan Chuyi ZHU 
Registrar:Beijing Innovative Linkage Technology Ltd. (R1292-LROR)
#12     top6rx.org      Tue, 14 Aug 2007 10:27:03 +0000 Bill Phelan Chuyi ZHU 
Registrar:Beijing Innovative Linkage Technology Ltd. (R1292-LROR)
#13     theremedyabc.org        Tue, 14 Aug 2007 08:33:38 +0000 Bill Phelan 
Chuyi ZHU Registrar:Beijing Innovative Linkage Technology Ltd. (R1292-LROR)
#14     correctionabc.org       Tue, 14 Aug 2007 07:54:26 +0000 Bill Phelan 
Chuyi ZHU Registrar:Beijing Innovative Linkage Technology Ltd. (R1292-LROR)
#15     correctingabc.org       Tue, 14 Aug 2007 07:17:54 +0000 Bill Phelan 
Chuyi ZHU Registrar:Beijing Innovative Linkage Technology Ltd. (R1292-LROR)
#16     remedytoday.org Tue, 14 Aug 2007 06:40:32 +0000 Bill Phelan Chuyi ZHU 
Registrar:Beijing Innovative Linkage Technology Ltd. (R1292-LROR)
#17     remedyroom.org  Tue, 14 Aug 2007 06:11:58 +0000 Bill Phelan Chuyi ZHU 
Registrar:Beijing Innovative Linkage Technology Ltd. (R1292-LROR)

Previous spam reports concerning same Bill Phelan Chuyi ZHU registrant:
11th August topsaverparty.org nameserver using 21 spam domains by same 
registrant
  rxvice.org, medsnote.org, rxfan.org, rxelf.org, medszap.org, rxrudiments.org, 
rxbid.org, rxace.org, medsu.org,
  rxfact.org, rxabcs.org, medrudimentz.org, pharmacyinstitute.org, 
medssuperstore.org, pharmacymeeting.org, medscoalition.org, chemistsshopaaa.org,
  medsclubhouse.org, pharmacyjockey.org, pharmacyhammer.org, medsvelocity.org, 
pharmacychance.org
10th August 2007 medssalon.org nameserver
9th August 2007 rxzine.org nameserver
19th July 2007 dearmeds.org nameserver
18th July 2007 touchrx.org nameserver
17th July medscare4.org nameserver
8th July 2007 basicrx.org 

I've since seen a longer list of 202 domains from a 15th August post by another 
spam reporter:

123alist.org, 123genius.org, 123meds.org, 123room.org, 411meds.org, aaarx2.org, 
abcremedy.org, allied123.org, antipaindrugs.org, b2meds.org, 
benefitsforothers.org,
best5rx.org, bidonrx.org, byteremedy.org, cablerx.org, chemistsshopaaa.org, 
correctingabc.org, correctionabc.org, cureabc.org, cureabcs.org, 
curebasics.org, 
curefact.org, curerudiments.org, directremedy.org, directrx.org, doseabc.org, 
drugedbasics.org, drugedfact.org, drugerfact.org, drugingabcs.org, 
drugingfact.org,
drugproducts.org, drugsbasics.org, enteremagicland.org, escmeds.org, 
feelfarbetter.org, feelwoderful.org, futeropharmacy.org, gothealthanswers.org, 
hightechmeds.org, iremedy.org,
lightningmeds.org, lovelydealsforus.org, lowpricesmeds.org, magicremedy.org, 
mastersdegreeabc.org, med123.org, medabc.org, medicalanswersdirect.org, 
medicalanswerssite.org, medicalanswersworld.org,
medrudimentz.org, meds123.org, medsabc.org, medsalon.org, medsbazaar.org, 
medsbistro.org, medsbroadcast.org, medsbuzz.org, medscell.org, medscensus.org, 
medsclubhouse.org, medscoalition.org, medsdeals.org, medselectron.org, 
medsfire.org, medsgoblin.org, medshack.org, medshead.org, medshideout.org,
medshistory.org, medshouse.org, medsinsider.org, medsjockey.org, medslodge.org, 
medsmountain.org, medsnote.org, medspanel.org, medspark.org, medspeak.org, 
medspire.org, medsplosion.org, medspull.org, medsquadron.org, medsquick.org, 
medsrapid.org, medsroom.org, medssalon.org, medsshack.org, medsspire.org, 
medssquadron.org, medsstar.org, medsstream.org, medssuperstore.org, 
medsswift.org, medsu.org, medsvelocity.org, medswift.org, medswing.org, 
medswizard.org, 
medszap.org, microremedy.org, monstermeds.org, onedoortoenter.org, 
painfreedrugs.org, pharmaceuticsaaa.org, pharmacychance.org, 
pharmacyhammer.org, pharmacyinette.org, pharmacyinsider.org,
pharmacyinstitute.org, pharmacyjockey.org, pharmacymeeting.org, 
pharmacysleuth.org, pharmacystrong.org, pharmacyutopia.org, pharmacyvalley.org, 
pharmacyvendor.org, pixiemeds.org, poweremedy.org, 
powerremedy.org, prescmedsonline.org, quickpharmacy.org, redressabc.org, 
redressbasics.org, redressfact.org, remedabc.org, remediaabc.org, 
remediationabc.org, remediesabc.org, 
remediesbasics.org, remediesfact.org, remedyabc.org, remedyabcs.org, 
remedybasics.org, remedycast.org, remedydepot.org, remedyfact.org, 
remedymagic.org, remedymetro.org, 
remedyorder.org, remedypage.org, remedyphone.org, remedypixie.org, 
remedyroom.org, remedyrudiments.org, remedytoday.org, remedyweb.org, 
rxabcs.org, rxaccelerator.org, 
rxaccount.org, rxace.org, rxape.org, rxbid.org, rxcastle.org, rxcellar.org, 
rxchance.org, rxcreek.org, rxdaily.org, rxdale.org,
rxelf.org, rxengine.org, rxetal.org, rxfact.org, rxfan.org, rxframe.org, 
rxhacker.org, rxhead.org, rxhelpdesk.org, 
rxinternational.org, rxkick.org, rxleague.org, rxlounge.org, rxmeeting.org, 
rxrally.org, rxretort.org, rxrocket.org, rxrudiments.org, rxstorm.org,
rxstruct.org, rxtower.org, rxutopia.org, rxvice.org, rxviewer.org, rxwire.org, 
rxzine.org, rxzing.org, safepainpills.org, salvebasics.org,
shoprx.org, startquicksearch.org, theanswersfree.org, themedsabc.org, 
thenows.org, thepainmeds.org, theremedyabc.org, top6rx.org, topdealsandus.org, 
topsaverparty.org, 
velomeds.org, virturx.org 


-- 
We've Got Your Name at http://www.mail.com !
Get a FREE E-mail Account Today - Choose From 100+ Domains