AUUSDEC.CC

This is a continuation of my first blog post. I ended by noting some interesting name servers that money mule recruiters and malware operators/deployers were using for their fake websites. In this blog post, I have decided to take a look at AUUSDEC.CC. The whois registrant information for this name server gives the following -

Domain name: auusdec.cc
Registrant Contact:
   Andrej Morov
   Andrej Morov gk@ppmail.ru
   +74956211281 fax: +74956211281
   Schelkovskij pr. d.11 k.1 kv.3
   Moscow Moscow 105425
   RU

Domain Name: AUUSDEC.CC
   Registrar: BIZCN.COM, INC.
   Whois Server: whois.bizcn.com
   Referral URL: http://www.bizcn.com
   Name Server: NS1.AUUSDEC.CC
   Name Server: NS2.AUUSDEC.CC
   Name Server: NS3.AUUSDEC.CC
   Status: CLIENT-XFER-PROHIBITED
   Status: CLIENT-DELETE-PROHIBITED
   Updated Date: 11-jan-2011
   Creation Date: 11-jan-2011
   Expiration Date: 11-jan-2012

Now, the only thing a registrar has to be concerned about is registrant information being falsified for illegal purposes. I will have no problem showing that this whois registrant has been involved in plenty of illegal online activity for some time now. Proving his registrant information has been falsified may take some time though. I'll say this much, the address cannot be found on google maps. Now, a quick google search of the phone number (+74956211281) shows some interesting stuff for quite a few  malware domains and fake pharmacies. Of total interest though is the following whois registrant discrepancy-

Domain name: pnc-demo.net
Registrant Contact:
   Nikolay Vukolov
   Nikolay Vukolov - prove@bigmailbox.ru
   +74956211281 fax: +74956211281
   ul. 1-aya Magistralnaya d.22 kv.53
   Moskva Moskva 123007
   RU
Created: 2010-03-31
Expires: 2011-03-31
Source: http://whois.domaintools.com/pnc-demo.net

Notice how this phone number (used to register both AUUSDEC.CC and pnc-demo.net) has differences in registrant name, address, and email? Also notice how close the site registration times were less than one year apart. This goes towards proving falsified whois. Lets put another nail in this coffin and prove falsified whois registrant information -

Domain name: asdeachreaz.com
Registrant Contact:
   Nikolay Vukolov
   Nikolay Vukolov - sued@cheapbox.ru
   +74956211281 fax: +74956211281
   ul.1-aya Magistralnaya d.22 kv.53
   Moscow Moscow 123007
   RU
Created: 2010-11-17
Expires: 2011-11-17
Source: http://whois.domaintools.com/asdeachreaz.com

Again, the mysterious Nikolay Vukolov, using the same phone/fax number as our Andrej Morov registers another the domain asdeachreaz.com with completely different registrant information. This time, asdeachreaz.com and AUUSDEC.CC were created some 2 months apart. Also of interest, googling the term "ul.1-aya Magistralnaya d.22 kv.53" brings up quite a few fake pharmacy websites and malware domains for good 'ol Nikolay.  I think it's safe to assume Nikolay and Andrej are in the same business.

From here, we can assume that the whois registrant information on AUUSDEC.CC has been falsified. Now what's left is showing how this server has had it's whois registrant information falsified for illegal purposes such as phishing, malware deployment, and other forms of fraud.

First off, lets google Andrej Morov's registrant information. First, we start with "Schelkovskij pr. d.11 k.1 kv.3" and see how many fraud hits we get there -

http://whois.domaintools.com/pillsprescriptionmarket.com  *fake online pharmacy*
http://whois.domaintools.com/pillstoretabletssite.com *fake online pharmacy*
http://whois.domaintools.com/pillfreetabletsworld.com *fake online pharmacy*
http://www.malwareurl.com/listing.php?domain=noiceanimakae.com  *malware*
etc etc (do a google search and you'll find tons of other fake sites and malware for this address)

So I think it's now safe to say you don't want to have anything to do with Andrej Morov/Nikolay Vukolov's sites. Now let's google AUUSDEC.CC and see how many fraud hits we get to finish this off -

Fraud:
http://scamfraudalert.wordpress.com/2011/02/03/
cached delphifaq.com thread (note: site is probably under DDoS like the site's I listed in my first post... also on the list of blocked sites these guys make their malware block by changing the hosts file)
scamfraudalert.com cached thread (again site blocked by these malware makers when they change the hosts file on any machine they infect, site also appears under DDoS see my first blog post)

Malware:
http://support.clean-mx.de/clean-mx/viruses.php?domain=paultonsgroup-ltd.info&submit=query
http://support.clean-mx.de/clean-mx/viruses.php?domain=worldofart-ltd.info&sort=id%20desc
http://amada.abuse.ch/?search=worldofart-ltd.info
http://amada.abuse.ch/?search=paultonsgroup-ltd.info

To be honest, there were quite a few google hit results for the fraud and malware offered on AUUSDEC.CC. I could go through them all, but I found one jewel that sums this up (plus I was getting tired of trying to do research on sites that are currently under DDoS by these malware operators). That site was the following -

http://doc.emergingthreats.net/pub/Main/RussianBusinessNetwork/RBN_IP_List_Update_2-6-2011.txt

Emerging Threats has been following one of the most infamous cyber crime organizations out there for a while now, the infamous Russian Business Network (wikipedia article here, Dancho Danchev break down here). The fact that AUUSDEC.CC is listed by Emerging Threats as part of the Russian Business Network (RBN) is not shocking due to the way this name server operates. What is scary here is the fact that these name servers have been online for so long with falsified registration, catering to the charred underbelly of the internet (fraud artists and cyber criminals). Then again, lets consider the registrar, bizcn.com. The McAfee site advisor notes that this company has run phishing and browser exploits in the past (link here). There has also been some interesting data on how this company's services has been used in spamming and the ZeuS botnet.

Needless to say, this name server needs to get trashed by the registrar. I doubt it will happen, but the knowledge will at least be out there.