Home / News

Gary Warner: We Are Well Past Time to Declare a Spam Crisis in China

In a blog post last week, Gary Warner, director of research in computer forensics at the University of Alabama's (UAB) computer and information sciences department, wrote that it is well past time for someone to declare a "Spam Crisis in China". The warning comes along with UAB's reports that most of the spam they receive has ties to China.

"It is very normal that more than one-third of the domain names we see each day in spam messages come from China," Warner wrote. "When one also considers the many '.com' and '.ru' domain names which are also hosted in China, the problem is much worse. More than half of all spam either uses domain names registered in China, is sent from computers in China, or uses computer in China to host their web pages."

Related Links:
Spam Crisis in China Gary Warner, Jun.20.2009
Chinese Registrars Need Rap on Knuckles, Expert Says PC World, Jun.29.2009

Related topics: Cybercrime, Malware, Security, Spam

WEEKLY WRAP — Get CircleID's Weekly Summary Report by Email:

Comments

I can confirm this Suresh Ramasubramanian  –  Jun 29, 2009 8:23 PM PST

Our statistics indicate that a huge majority of this originates from at the most three or four registrars based in China

Xiamen Ename - which is the registrar for over 50% of domains we find in unsolicited bulk email every week - quite often fastflux

Xinnet is another one that has several such domains (a few hundred compared to over a thousand a week on ename)

Also others like Onlinenic and Paycenter.com.cn

The above statistics are from analyzing domains listed on the SURBL blocklist - http://www.surbl.org Suresh Ramasubramanian  –  Jun 29, 2009 8:24 PM PST

Just to clarify the above data point.

We should clean up our own house first Edward Falk  –  Jun 30, 2009 10:49 AM PST

The spam may be coming through Chinese servers, but if you track it back to its source, half the time you'll find it actually originated here in the U.S.

Remember last November when McColo in San Jose, California was finally disconnected?  Spam dropped 60-70% worldwide over night.  The shutdown of rogue site 3fn, also in San Jose, earlier this month led to another significant drop in spam.

And frankly, if you dropped a nuke on Boca Raton, you'd probably see a huge reduction in worldwide spam.

If the U.S. were to take spam seriously, it would be the single most effective thing that could be done to combat the problem.

Granted / point taken about chinese IP space Suresh Ramasubramanian  –  Jun 30, 2009 5:07 PM PST

The point Gary's making though is a bit different. Domains registered in spam, through registrars (in fact just two or three registrars for the most part) based in China.

As for origins, you'd be closer if you looked at eastern europe than at boca raton.

To post comments, please login or create an account.

Related Blogs

Related News

Topics

Industry Updates – Sponsored Posts

Q3 2014 DDoS Trends: Attacks Exceeding 10 Gbps on the Rise

3 Questions to Ask Your DNS Host About DDoS

Afilias Partners With Internet Society to Sponsor Deploy360 ION Conference Series Through 2016

Neustar to Build Multiple Tbps DDoS Mitigation Platform

The Latest Internet Plague: Random Subdomain Attacks

Digging Deep Into DNS Data Discloses Damaging Domains

New gTLDs and Best Practices for Domain Management Policies (Video)

Nominum Announces Future Ready DNS

New from Verisign Labs - Measuring Privacy Disclosures in URL Query Strings

DotConnectAfrica Delegates Attend the Kenya Internet Governance Forum

3 Questions to Ask Your DNS Host about Lowering DDoS Risks

Continuing to Work in the Public Interest

Verisign Named to the OTA's 2014 Online Trust Honor Roll

4 Minutes Vs. 4 Hours: A Responder Explains Emergency DDoS Mitigation

Dyn Acquires Internet Intelligence Company, Renesys

Tips to Address New FFIEC DDoS Requirements

Smokescreening: Data Theft Makes DDoS More Dangerous

dotStrategy Selects Neustar's Registry Threat Mitigation Services for .BUZZ Registry

24 Million Home Routers Expose ISPs to Massive DNS-Based DDoS Attacks

What Does a DDoS Attack Look Like? (Watch First 3 Minutes of an Actual Attack)

Sponsored Topics

Verisign

Security

Sponsored by
Verisign
Minds + Machines

Top-Level Domains

Sponsored by
Minds + Machines
Afilias

DNSSEC

Sponsored by
Afilias
dotMobi

Mobile

Sponsored by
dotMobi