Fast Flux Service Networks: Dynamics and Roles in Hosting Online Scams∗

نویسندگان

  • Maria Konte
  • Nick Feamster
  • Georgia Tech
  • Jaeyeon Jung
چکیده

This paper studies the dynamics of fast flux service networks and their role in online scam hosting infrastructures. By monitoring changes in DNS records of over 350 distinct fast flux domains collected from URLs in 115,000 spam emails at a large spam sinkhole, we measure the rate of change of DNS records, accumulation of new distinct IPs in the hosting infrastructure, and location of change both for individual domains and across 21 different scam campaigns. We find that fast flux networks redirect clients at much different rates—and at different locations in the DNS hierarchy—than conventional load-balanced Web sites. We also find that the IP addresses in the fast flux infrastructure itself change rapidly, and that this infrastructure is shared extensively across scam campaigns, and some of these IP addresses are also used to send spam. Finally, we compared IP addresses in fast-flux infrastructure and flux domains with various blacklists (i.e., SBL, XBL/PBL, and URIBL) and found that nearly one-third of scam sites were not listed in the URL blacklist at the time they were hosting scams. We also observed many hosting sites and nameservers that were listed in both the SBL and XBL both before and after we observed fast-flux activity; these observations lend insight into both the responsiveness of existing blacklists and the life cycles of fast-flux nodes.

برای دانلود متن کامل این مقاله و بیش از 32 میلیون مقاله دیگر ابتدا ثبت نام کنید

ثبت نام

اگر عضو سایت هستید لطفا وارد حساب کاربری خود شوید

منابع مشابه

Dynamics of Online Scam Hosting Infrastructure

This paper studies the dynamics of scam hosting infrastructure, with an emphasis on the role of fast-flux service networks. By monitoring changes in DNS records of over 350 distinct spam-advertised domains collected from URLs in 115,000 spam emails received at a large spam sinkhole, we measure the rates and locations of remapping DNS records, and the rates at which “fresh” IP addresses are used...

متن کامل

Measuring and Detecting Fast-Flux Service Networks

We present the first empirical study of fast-flux service networks (FFSNs), a newly emerging and still not widelyknown phenomenon in the Internet. FFSNs employ DNS to establish a proxy network on compromised machines through which illegal online services can be hosted with very high availability. Through our measurements we show that the threat which FFSNs pose is significant: FFSNs occur on a ...

متن کامل

FluXOR: Detecting and Monitoring Fast-Flux Service Networks

Botnets are large groups of compromised machines (bots) used bymiscreants for themost illegal activities (e.g., sending spam emails, denial-of-service attacks, phishing and other web scams). To protect the identity and to maximise the availability of the core components of their business, miscreants have recently started to use fast-flux service networks, large groups of bots acting as front-en...

متن کامل

The Role of Online Social Networks in Users' Everyday-Life Information Seeking

Background and Aim: Considering the increasing number of users who interact with online social networks, it can be inferred that these networks have become an essential part of users' lives and play different roles in their everyday life. Therefore, the present study aims to explore the role of these networks in users' everyday-life information seeking. Method: This research is an applied resea...

متن کامل

A New Fast and Accurate Fault Location and Classification Method on MTDC Microgrids Using Current Injection Technique, Traveling-Waves, Online Wavelet, and Mathematical Morphology

In this paper, a new fast and accurate method for fault detection, location, and classification on multi-terminal DC (MTDC) distribution networks connected to renewable energy and energy storages presented. MTDC networks develop due to some issues such as DC resources and loads expanding, and try to the power quality increasing. It is important to recognize the fault type and location in order ...

متن کامل

ذخیره در منابع من


  با ذخیره ی این منبع در منابع من، دسترسی به آن را برای استفاده های بعدی آسان تر کنید

برای دانلود متن کامل این مقاله و بیش از 32 میلیون مقاله دیگر ابتدا ثبت نام کنید

ثبت نام

اگر عضو سایت هستید لطفا وارد حساب کاربری خود شوید

عنوان ژورنال:

دوره   شماره 

صفحات  -

تاریخ انتشار 2008