The Financial Sector Computer Emergency Response Team (FinCERT), a competent organization that cooperates with the Coordination Center for TLD .RU/.РФ and a subdivision of the Directorate General for Security and Information Protection of the Bank of Russia, has published its report for the second half of 2016 and the first half of 2017.
FinCERT, among other matters, is engaged in notifying domain name registrars about domains that send out malware and are used for bank card fraud. FinCERT also cooperates with the Foundation for Internet Development (.SU), MSK-IX (.PP.RU, .NET.RU, ORG.RU) and the Foundation for Assistance for Internet Technologies and Infrastructure Development (COM.RU, EXNET.SU, RU.NET and several geodomains).
Between January 1, 2017 and September 1, 2017, FinCERT sent information about 481 domains used for various fraud activities to registrars. Following registrars’ review, 367 domains were blocked. According to FinCERT, about 50 domains in various zones are removed from delegation per month. The average time of removing a domain from delegation is from 1 to 3 days.
The majority of removed domains are related to fraud in P2P transfers (23%, 84 domains), followed by domains engaged in insurance fraud (12.2%, 45 domains), and fake banks (12.1%, 44 domains). Eleven percent of fraud domains are those featuring financial pyramid websites.
The practice of interacting with organizations competent in determining internet violations was introduced by the Coordination Center for TLD .RU/.РФ in 2012. These are companies that provide the Coordination Center and accredited domain name registrars with information about resources with illegal content, cases of phishing, unauthorized access to information systems and the spread of malicious programs using domain names in the .РФ and .RU zones. Registrars have the right to stop the delegation of domain names for such resources.
Today, eight competent organizations – Safe Internet League, Group-IB, Kaspersky Lab, RU-CERT, ROCIT, Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor), Bizon LLC, and the Bank of Russia – cooperate with the Coordination Center. Any internet user can report the inappropriate use of a domain name to the hotline of one of these organizations, and measures will be taken immediately.
