[dns-operations] 答复: Curiousity, many all numeric sub-domains of .cn?

[张在峰]

In my experience , these domains are used for blackhat SEO.

According our database and my experience:
1.	All of these domain names are registered by the same individual or a few individuals.
2.	Most of these domains are resolving at 142.111.192.2/24.
3.	These domains are wildcards DNS, their sub-domains are generated by machine 
4.	If you know Chinese, the listed domains are porn related. Their contents are also generated by machine.
5.	So many (sub) domains construct a very complex web, which search engine’s bots are stuck in it. This blackhat SEO named “spider pool”

there is a excellent paper describe "spider pool":
https://www.usenix.org/system/files/conference/usenixsecurity16/sec16_paper_du.pdf


--------
Zhang Zaifeng

Network Security Research Lab, QIHOO 360
Email: zhangzaifeng at 360.cn
Phone: +86 13520348533


-----邮件原件-----
发件人: dns-operations [mailto:dns-operations-bounces at dns-oarc.net] 代表 Viktor Dukhovni
发送时间: 2018年3月4日 12:59
收件人: dns-operations at dns-oarc.net
主题: [dns-operations] Curiousity, many all numeric sub-domains of .cn?

Anyone know why there are so many subdomains of ".cn" that are just lots of digits.  I see around 70,000 such domains.  There are probably many more.  Sample:

550924988.cn
550928460.cn
550933999.cn
551747442.cn
552218526.cn
552220853.cn
552227094.cn
552229698.cn
552231253.cn
552240774.cn
552246105.cn
553363880.cn
553372226.cn
553383486.cn
553384139.cn
553384147.cn
553391865.cn
553397060.cn
553438133.cn
553700082.cn
553951797.cn
553952941.cn
553956731.cn
553959924.cn

-- 
	Viktor.

_______________________________________________
dns-operations mailing list
dns-operations at lists.dns-oarc.net
https://lists.dns-oarc.net/mailman/listinfo/dns-operations
dns-operations mailing list
https://lists.dns-oarc.net/mailman/listinfo/dns-operations