[dns-operations] 答复: Curiousity, many all numeric sub-domains of .cn?

[Rodney Joffe]

Folks,

Please send me a sanitized email that I can forward to our .biz group with as much info as possible ASAP and we will crush this.

> On Jun 6, 2018, at 12:41 AM, Viktor Dukhovni <ietf-dane at dukhovni.org> wrote:
> 
> 
> 
>> On Mar 6, 2018, at 12:06 AM, John Levine <johnl at taugh.com> wrote:
>> 
>>> 5.	So many (sub) domains construct a very complex web, which search engineӮs bots are stuck in it. This blackhat SEO named ӡspider poolӱ
>>> 
>>> there is a excellent paper describe "spider pool":
>>> https://www.usenix.org/system/files/conference/usenixsecurity16/sec16_paper_du.pdf
>> 
>> Ah, that's what they're called.
>> 
>> I have a little sample one at http://www.web.sp.am
> 
> 75% of newish domains under .biz appear to be a new spider pool
> (or some sort of malware) at least ~170k domains strong.  Small sample:
> 
> azbekml.biz azbekml.biz SOA ns5.dnsdun.com ns5 at dnsdun.com
> fzlnpj.biz fzlnpj.biz SOA ns3.dnsdun.com ns3 at dnsdun.com
> nfbdjt.biz nfbdjt.biz SOA ns4.dnsdun.com ns4 at dnsdun.com
> mukhbnq.biz mukhbnq.biz SOA ns4.dnsdun.com ns4 at dnsdun.com
> ffptdn.biz ffptdn.biz SOA ns6.dnsdun.com ns6 at dnsdun.com
> ftdttb.biz ftdttb.biz SOA ns6.dnsdun.com ns6 at dnsdun.com
> wjthlzq.biz wjthlzq.biz SOA ns5.dnsdun.com ns5 at dnsdun.com
> jrxbtp.biz jrxbtp.biz SOA ns3.dnsdun.com ns3 at dnsdun.com
> blxjrv.biz blxjrv.biz SOA ns3.dnsdun.com ns3 at dnsdun.com
> fptxdl.biz fptxdl.biz SOA ns6.dnsdun.com ns6 at dnsdun.com
> fhdpllv.biz fhdpllv.biz SOA ns4.dnsdun.com ns4 at dnsdun.com
> brjfpz.biz brjfpz.biz SOA ns5.dnsdun.com ns5 at dnsdun.com
> ejxekgm.biz ejxekgm.biz SOA ns4.dnsdun.com ns4 at dnsdun.com
> mhtnf.biz mhtnf.biz SOA ns2.dnsdun.com ns2 at dnsdun.com
> ptycwyz.biz ptycwyz.biz SOA ns4.dnsdun.com ns4 at dnsdun.com
> sekau.biz sekau.biz SOA ns1.dnsdun.com ns1 at dnsdun.com
> dpbftn.biz dpbftn.biz SOA ns5.dnsdun.com ns5 at dnsdun.com
> wgzhllz.biz wgzhllz.biz SOA ns4.dnsdun.com ns4 at dnsdun.com
> aaxebtx.biz aaxebtx.biz SOA ns5.dnsdun.com ns5 at dnsdun.com
> gbvoedg.biz gbvoedg.biz SOA ns4.dnsdun.com ns4 at dnsdun.com
> hpthdj.biz hpthdj.biz SOA ns5.dnsdun.com ns5 at dnsdun.com
> tgojnfy.biz tgojnfy.biz SOA ns5.dnsdun.com ns5 at dnsdun.com
> xvxptf.biz xvxptf.biz SOA ns4.dnsdun.com ns4 at dnsdun.com
> liydbwn.biz liydbwn.biz SOA ns5.dnsdun.com ns5 at dnsdun.com
> utxgc.biz utxgc.biz SOA ns6.dnsdun.com ns6 at dnsdun.com
> qeyfa.biz qeyfa.biz SOA ns6.dnsdun.com ns6 at dnsdun.com
> etofjmh.biz etofjmh.biz SOA ns5.dnsdun.com ns5 at dnsdun.com
> rfbxpl.biz rfbxpl.biz SOA ns6.dnsdun.com ns6 at dnsdun.com
> fxrrbb.biz fxrrbb.biz SOA ns5.dnsdun.com ns5 at dnsdun.com
> ltnrfz.biz ltnrfz.biz SOA ns6.dnsdun.com ns6 at dnsdun.com
> mgtysxj.biz mgtysxj.biz SOA ns4.dnsdun.com ns4 at dnsdun.com
> kqvdhnj.biz kqvdhnj.biz SOA ns4.dnsdun.com ns4 at dnsdun.com
> 
> 
> -- 
> 	Viktor.
> 
> 
> _______________________________________________
> dns-operations mailing list
> dns-operations at lists.dns-oarc.net
> https://lists.dns-oarc.net/mailman/listinfo/dns-operations
> dns-operations mailing list
> https://lists.dns-oarc.net/mailman/listinfo/dns-operations