Discuss mailing list

[Jeff Taylor <shdwdrgn AT sourpuss.net>]

I was alerted this week to a number of opennic domains which have been 
spreading malware.  This isn't the first time this has occurred but most 
of the previous troubles were from when we peered with the .bit TLD.

After checking a number of IP addresses these domains were being pointed 
at (and finding at least a couple sources that agreed on the status of 
those addresses) I decided to block those domains.  For now that means I 
took over ownership and disabled each of them, so they can't be 
re-registered and used again.  I don't want to specifically list each 
domain because they all have very spiteful names referring to racial 
slurs and child porn, but I saved copies of each of the original 
records.  There are currently 86 disabled domains..

There are also a handful of registered accounts that go with these 
domains names.  I think it would probably be a good idea to just disable 
everything associated with those users but I haven't gotten that far yet.

Anyway, I thought I should let the community know what's going on, and 
alert other TLD admins that this is happening.  We haven't been paying 
much attention to Opennic for awhile now, and this is what happens.