EstDomains

» see estdomains.com as it lived, on the wayback machine

~ the obit ~

estdomains.com was registered on 19 August 2004. The Internet Archive found it five days later. What sat behind it was an ICANN-accredited domain registrar, incorporated in Wilmington, Delaware at an address that was a legal department and a mailbox number, and operated from an office in Tartu, Estonia alongside a hosting business called EstHost.

Registrars are plumbing and nobody writes about plumbing, so EstDomains stayed invisible until Brian Krebs started counting. Writing for the Washington Post, he described it as the registrar of choice for the Russian Business Network, and the pattern he laid out was consistent enough to be boring: the malware hosts and the fake antivirus storefronts kept turning out to be registered in the same place. Nothing about that was illegal in itself, and selling names to bad customers was not a breach of anything EstDomains had signed.

What killed it was narrower and much drier. Vladimir Tsastsin, the company's president, was convicted in an Estonian court on 6 February 2008 of credit card fraud and document forgery. Section 5.3 of ICANN's Registrar Accreditation Agreement says ICANN may terminate the agreement when an officer or director of a registrar is convicted of a felony or a financial misdemeanor and is not removed. On 28 October 2008 ICANN's compliance director sent Tsastsin a two-page letter terminating the agreement, effective fifteen days later.

EstDomains appealed within a day and ICANN stayed the termination on 29 October, which looked briefly like a reprieve. The company's argument was that Tsastsin had resigned the presidency in June and that the conviction was being appealed to Estonia's Supreme Court anyway. ICANN looked at it for two weeks, was not persuaded, and announced on 12 November that the termination would go ahead on 24 November 2008. ResellerClub picked up the names the day after.

~ the rap sheet ~

~ what the letter said ~

The notice is still readable and it is a strange document to sit with. Two pages, sent by courier and by fax, addressed to Mr. Vladimir Tsastsin in Wilmington. It identifies the company by its file numbers, Customer No. 919 and IANA No. 832, and then says the agreement "is terminated" in the present tense before anything has actually happened.

There is no mention anywhere in it of malware, of the Russian Business Network, or of the hundreds of thousands of names about to change hands. ICANN did not have a clause for any of that. It had a clause about who is allowed to be an officer of an accredited registrar, and it used the one it had.

~ what happened to the names ~

Thirteen days before the EstDomains termination took effect, McColo was depeered by its upstream providers and global spam volume fell by a figure usually quoted somewhere above half. November 2008 was the month the internet's abuse infrastructure got hit twice in a fortnight, and both hits were landlords evicting a tenant rather than anyone being arrested. The spam came back within weeks.

Tsastsin did get arrested, three years later. On 9 November 2011 the FBI named him in Operation Ghost Click, the takedown of the DNSChanger botnet, which had been quietly rewriting the DNS settings of around four million machines.

From where I was sitting in 2008, none of this had a name. The Turkish internet of that decade ran through cafes and shared machines, and the thing you knew about was the symptom. A browser that opened somewhere you had not asked for. A cafe machine reimaged last week and already bad again. Those pages were all registered somewhere. For about a fortnight in November 2008 the somewhere had a name and a file number at ICANN.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »