If you’re a hacker wanting to register a domain for nefarious purposes, EstDomains is your go-to guy. They registered tens of thousands of malicious domains during their existence, providing an integral piece of the malware lifecycle. The Russian Business Network (RBN) used them extensively for their “bullet proof” hosting (web hosting designed to make takedowns extremely difficult if not impossible). Back in February of this year Vladimir Tsastsin, EstDomains founder, was sentenced to three years in prison for forgery, money laundering and credit card fraud. This conviction caused EstDomains to break section 5.3 of ICANN’s Registrar Accreditation Agreement. This section states:

Any officer or director of [a] Registrar is convicted or a felony or of a misdemeanor related to financial activities, or is adjudged by a court to have committed fraud or breach of fiduciary duty, or is the subject of judicial determination that ICANN deems as the substantive equivalent of any of these; provided such officer or director is not removed in such circumstances.

On October 28th, ICANN notified EstDomains that on November 12th, 2008, it would no longer be an accredited registrar. ICANN has posted this notice here: http://www.icann.org/correspondence/burnette-to-tsastsin-28oct08-en.pdf

EstDomains is currently attempting to distance themselves from Tsastsin in an attempt to stay in business. They responded to ICANN claiming Tsastsin was removed from his position in January one month before his conviction on the 29th: http://www.icann.org/correspondence/poltev-to-burnette-29oct08-en.pdf

Due to this response October 29th ICANN stayed the termination process:
http://www.icann.org/en/announcements/announcement-2-29oct08-en.htm

Hopefully ICANN will make the right decision and shutdown these criminals for good.

This entry was posted on Monday, November 3rd, 2008 at 2:44 pm.

Share This Information | Beginning of the end for EstDomains SlashDot | del.ico.us | Digg it | Technorati | Reddit

Other SecureWorks Blog Categories: General (24) Links (7) Phishing (3) Research (61) Spam (1) Trojans (4)