FTC Shuts Down 3FN, a Rogue Internet Service Provider
Today the FTC announced via their web site that they have shut down 3FN (aka Pricewert), a major rogue internet service provider specializing in hosting botnets, phishing web sites, child pornography, and other illegal, malicious web content.
Unfortunately, however we are not seeing any volume drop offs as a result of this shut down. Back when McColo, another rogue hosting provider, was shut down back in November 2008, we observed an immediate drop in spam volumes of about 60%. No such luck this time. In fact, spam volumes haven't been affected at all according to our Threat Operations Center.
This begs the question "Why not?" How come spam was so significantly affected by the McColo shutdown, but the termination of 3FN doesn't appear to have had any effect thus far? The reason is that botnets, particularly those that were affected by the McColo shutdown but who serve as a lesson to all botnet owners, have gone to great lengths to ensure that they have built redundancy into their networks to prevent the disruption caused by McColo from ever happening again. It is suspected that some of the larger spam sending botnets like Cutwail had command and control servers hosted at 3FN, but because they now work in a multi-homed model where they have command and control centers interdispersed amongst many different providers on many different networks, the shutdown of a single hosting provider will require nothing more than a minor update to be distributed from the other command and control servers to point the members of that botnet away from 3FN allowing business to run as usual.
Government intervention and the veritable whack-a-mole game that goes on with upstream bandwidth providers can only go so far to get these illegal web hosts shut down. We need more cooperation from the domain registrars in order to completely take these rogue domains offline. Unfortunately, with the decentralization of domain registration that has allowed domain registrars to setup shop who are more than happy to allow these rogue domains to come online and stay online, cyber criminals will continue to flock to these services until high authorities step in to get them shut down; a concept much easier said than done.
Categories: Hackers
Posted by smasiello at 3:59 PM | Link | 0 comments
Comments
No comments found.
Commenting has been disabled for this entry.