In February 2017, accredited registrars received 274 requests from Group-IB to suspend delegation of domain names over alleged violations. As a result, 229 domain names were blocked, with 12 of them unblocked after their owners corrected their violations. The unblocking was requested by CERT-GIB. Forty-five domain names were not blocked by registrars due to the urgent measures they took, or the resources were blocked by the hosting provider.
At the moment 217 domain names have been blocked; 57 domain names are being delegated.
Most of the blocked domains were phishing resources (69%) with the fewest number of blocked domains belonging to botnet controllers (5%). Ninety-nine percent of domain names with violations belonged to .RU.
In accordance with an agreement with the Coordination Center for TLD .RU/.РФ on counteracting illegal use of .RU and .РФ domains, Group-IB is engaged in detecting domain names that violate regulations. Violations include, in part, phishing, unauthorized access to information systems, distribution of malware and the management of infected computer networks.
More information about the ways to report cyber threats and other illegal activities on the net can be found on the website of the Coordination Center.
