Home / News

Gary Warner: We Are Well Past Time to Declare a Spam Crisis in China

Gary Warner: We Are Well Past Time to Declare a Spam Crisis in China

In a blog post last week, Gary Warner, director of research in computer forensics at the University of Alabama's (UAB) computer and information sciences department, wrote that it is well past time for someone to declare a "Spam Crisis in China". The warning comes along with UAB's reports that most of the spam they receive has ties to China.

"It is very normal that more than one-third of the domain names we see each day in spam messages come from China," Warner wrote. "When one also considers the many '.com' and '.ru' domain names which are also hosted in China, the problem is much worse. More than half of all spam either uses domain names registered in China, is sent from computers in China, or uses computer in China to host their web pages."

Related Links:
Spam Crisis in China Gary Warner, Jun.20.2009
Chinese Registrars Need Rap on Knuckles, Expert Says PC World, Jun.29.2009

Related topics: Cybercrime, Malware, Security, Spam

WEEKLY WRAP — Get CircleID's Weekly Summary Report by Email:

Comments

I can confirm this Suresh Ramasubramanian  –  Jun 29, 2009 8:23 PM PST

Our statistics indicate that a huge majority of this originates from at the most three or four registrars based in China

Xiamen Ename - which is the registrar for over 50% of domains we find in unsolicited bulk email every week - quite often fastflux

Xinnet is another one that has several such domains (a few hundred compared to over a thousand a week on ename)

Also others like Onlinenic and Paycenter.com.cn

The above statistics are from analyzing domains listed on the SURBL blocklist - http://www.surbl.org Suresh Ramasubramanian  –  Jun 29, 2009 8:24 PM PST

Just to clarify the above data point.

We should clean up our own house first Edward Falk  –  Jun 30, 2009 10:49 AM PST

The spam may be coming through Chinese servers, but if you track it back to its source, half the time you'll find it actually originated here in the U.S.

Remember last November when McColo in San Jose, California was finally disconnected?  Spam dropped 60-70% worldwide over night.  The shutdown of rogue site 3fn, also in San Jose, earlier this month led to another significant drop in spam.

And frankly, if you dropped a nuke on Boca Raton, you'd probably see a huge reduction in worldwide spam.

If the U.S. were to take spam seriously, it would be the single most effective thing that could be done to combat the problem.

Granted / point taken about chinese IP space Suresh Ramasubramanian  –  Jun 30, 2009 5:07 PM PST

The point Gary's making though is a bit different. Domains registered in spam, through registrars (in fact just two or three registrars for the most part) based in China.

As for origins, you'd be closer if you looked at eastern europe than at boca raton.

To post comments, please login or create an account.

Related Blogs

Related News

Topics

Industry Updates – Sponsored Posts

MarkMonitor to Exhibit at Internet Tech Policy Exhibition and Reception to be Held on Capitol Hill

Verisign to Award New Infrastructure Research Grants

Nixu SNS 2.5 Series Gives Fresh Views on DNS

Neustar Names Joe Pasqua to Head Neustar Labs

Q3 2011 Fraud Intelligence Report

The Spookiest DDoS Attacks in History

Protecting Your Business from DDoS Attacks: Advice from Neustar

A Different Kettle of Phish

Introduction to Nixu Software: End-to-End Software-Based DNS, DHCP, IPAM Solutions for Your Network

MarkMonitor Fraud Intelligence Report Released for Q2 2011

President Obama Names Neustar President and CEO Lisa Hook to NSTAC

Verisign's Matt Larson Wins 2011 InfoWorld Technology Leadership Award

Internet Adds 4.5 Million Domain Names in First Quarter of 2011

Businesses Lack Safeguards Against DDoS Attacks and DNS Failures, New Research Shows

Q1 2011 Fraud Intelligence Report

Neustar Launches SiteProtect for DDoS Protection

The Botnet-Counterfeit Drugs Connection

Verisign Enhances Its Managed DNS Service With Full Support for DNSSEC Compliance and Geo Location

Verisign Achieves Critical DNSSEC Milestone by Deploying Security Extensions in .com TLD

New Verisign Uptime Bundle Combines DDoS Protection, Managed DNS and Threat Intelligence Services

Hot Topics

dotMobi

Mobile

Sponsored by
dotMobi
Afilias

DNSSEC

Sponsored by
Afilias
Neustar UltraDNS

DNS

Sponsored by
Neustar UltraDNS
Verisign

Security

Sponsored by
Verisign
Minds + Machines

Top-Level Domains

Sponsored by
Minds + Machines