[history update record]
- 2017-01-10 original version
- 2017-01-16 added the analysis of server IP address homology. The analysis here is weak and only for completeness
Summary
At the Qihu Network Security Research Institute (NetLab @ 360. CN), we have established a DNS based abnormal traffic monitoring system, which will detect a number of abnormal traffic and the corresponding domain name / IP every day. Usually these detected domain names / IPS belong to the underground industry chain.
However, we noticed that some strings representing well-known companies also appeared in these checked out domain names, including 360, Ali, Baidu, cloudflare, DNSPod, Google and Microsoft. Through analysis, we think that this is someone who pretends to use the name of big station to provide network infrastructure services for underground industries such as gambling, pornography, private service, etc.
The infrastructure structure is complex, the operation time is long, the support ability is strong, the actual support of tens of thousands of black gray stations, has formed a mature underground industrial ecosystem.
Domain name and counterfeit brands
The domain names we detected are as follows.
If you only look at domain names, these domain names look like CDN services provided by big stations. But the analysis shows that these domain names are actually some kind of infrastructure, serving for gambling, pornography, private services and other underground industries.
Complex network infrastructure based on the above domain name
Through passviedns, we can see the DNS resolution records of such domain names. In addition to providing services directly to end users, they also provide CNAME to other domain names, forming a complex infrastructure network. This network has real underground industry users. Some nodes have long operation time, large user visits, clear business types, and mature support the black and gray industry chain.
The list of these fake CDN sites and some pre / post sites observed is as follows:
The relationships behind these infrastructure networks are complex, such as:
- In the above domain names, yunfangyu1 / 2 / 5 / 7.com appears in front of and behind the phishing site respectively, and this group of yunfangyu1 / 2 / 5 / 7.com shares the same whois registration information;
- Cdn88.net and cdn11 / 22 / 33.net (not shown in the table) registered email address of whois information is [email protected], which is a node of this network.
- The whole infrastructure is still continuously updated, including google-yun.com and google-cdn-all.com registered in the week before this writing (2017.01.03).
Evaluation of the infrastructure network and its users
Based on these domain names, we extract relevant records from passivedns, summarize the following data, and evaluate the network from the stability of the domain name, the diversity of subdomain names and the number of visits.
!
- In terms of stability, it can be seen from the above table that in addition to Google cdn.win and Microsoft cdn.com being inactive on 2016-02-06 and 2016-08-03 respectively, other domain names remain active until the time of writing this article, and we think it will continue to be active. It should be said that the active time of the whole scale is very stable. It is worth mentioning that [email protected] has registered cdn88.net, and has been active in the above network after changing its face.
- In terms of the diversity of subdomains, as a whole, there are not many subdomains, and the largest alicdn-kr.com only has 284 subdomains. This feature is significantly different from the regular CDN server.
- In terms of the number of DNS access, there is a large deviation between domain names. The total number of visits to alicdn-kr.com, the busiest, reached 1.3 billion, a huge number. In order to better understand this number, we use tv.cctv.com as the benchmark for comparison. As shown in the figure below, the black line is alicdn-kr.com, and the blue line is tv.cctv.com. It can be seen that the DNS request volume of alicdn-kr.com is about twice that of tv.cctv.com.
In addition, observe the daily peak of business, the daily peak of alicdn-kr.com is about 23 to 0 every night. This time point is also consistent with the type of business it carries (gambling, porn sites are more active in the early morning).
As mentioned before, the main users of the network are gambling, pornography and private service websites. The user base of the whole network is very large, some numbers:
- Users include 24033 domain names
- And its subordinate 53699 subdomains
- The earliest user is vip1000.cdn88.net, which started on November 22, 2015
- The single largest user is 7966.ym009.com, and the cumulative number of DNS visits is 93192746
IP infrastructure
The IP addresses of these domain names are mainly distributed in the United States, Hong Kong, China and India. Among them, the business distribution in the United States, Hong Kong and the abuse of Pan analytic construction site group (DWA) we have seen before is very similar. In China, IP is mainly concentrated in data centers, which often claim to provide so-called high defense services. Based on these data centers, some anti DDoS capabilities can be obtained.
Compared with the regional distribution, the as distribution of these IPS is more scattered. The specific distribution is shown in the figure below:
It is worth noting that the top ranked as8075 Microsoft Corporation and as45090 Shenzhen Tencent Computer Systems Company Limited belong to Microsoft Corporation and Tencent Corporation respectively. The domain names using these two as are mainly Google yuncdn.com and Microsoft cloudcdn.com. The two domains also use the services of as58593 Microsoft (China) Co., Ltd., as15169 Google Inc. and as45102 Alibaba (China) Technology Co., Ltd. in different periods.
If not carefully analyzed, at first glance, does Microsoft cloudcdn.com seem to use Microsoft's as harmoniously? However, they do belong to different organizations, and their business scope is one sunshine road and one single wooden bridge. A very interesting phenomenon.
The team behind it
From the whois information of these domain names, they should belong to several groups.
In the above figure, the same colored cell indicates the domain name registered by the same group of people. It cannot be determined that the domain name belongs to is not colored. Considering the complexity of the network mentioned above, it is possible that some of the small groups in the above table can be attributed to a large group.
The earliest Microsoft cdn.com can be traced back to May 4, 2015, and the latest google-cdn-all.com was registered on December 29, 2016. In terms of the validity period of domain name registration, most domain names are valid for one year, but cdn-cloudflare.com and jiascucdn360.com are 5 and 7 years respectively. It can be seen that these people are ready to do this work for a long time.
Of the 21 domain names mentioned above, 5 use privacy protection. Using 360netlab's whoisdb database (for more data, please refer to Appendix 1), we conducted a reverse check on registrants who did not take privacy protection measures, basically excluding the possibility of focusing on domain name trading business "rice farmers", and noted that different registrants tend to focus on their respective business segments:
- For example, "good good" and "Jie Ke" have registered a large number of gambling business domain names
- "Qi Yang" focuses on registering the domain name of pornographic business.
- There are also some special registration sites, such as "Jack Tom", "Google CDN" and so on. In addition to the domain names mentioned above, there are also some domain names with strong identification, such as "advanced anti DDoS", "anti DDoS", "anti CC", etc.
Update on January 16, 2017: after the original version of the article was released, some readers mentioned that they hope to analyze the IP address sharing of these servers. For completeness, we have supplemented the following parts, as shown in the figure below, with the following conclusions:
- Most of the domain name servers have few IP addresses and small overlaps. The conclusion of this link is weak and can only be used as an auxiliary enhancement of the existing strong evidence, and can not form the conclusion of directivity independently;
- There are two groups of domain names (cdn-baidu-google.com: cdm-google-baidu.com, Google yuncdn.com: microsoftcloudcdn. Com) with an overlap of about 25%. Among them, the first group of domain name analysis results enhanced the determination of homology of corresponding domain names in whois data; the second group did not group it with Microsoft cloudcdn.com because Google yuncdn.com used privacy protection.
epilogue
With Chinese characteristics, it is not uncommon for special sites of gambling, pornography and other businesses to use anti-D services or even special network infrastructure for black ash production. But domain names with "big station" strings are more interesting. This paper analyzes these domain names including "big station" strings from the perspectives of whois information, active time in passive DNS, and using IP. Several clear conclusions can be drawn:
- These domain names provide stable services, and they can basically provide relatively stable services for a long time. This is also quite different from phishing domain names.
- Because they want to provide more stable services, the infrastructure they use is more formal and stable, which is not difficult to explain why they use the IP address of large companies.
- Exclude the possibility that these domain names are used for phishing;
- Exclude the possibility that these domain names come from Minoan (domain name dealer) who specializes in domain name business. It is speculated that it is likely to be the self built network of grey business or other suppliers that provide services for grey business.
Through this paper, I hope to have a new understanding of gray business and its infrastructure. For these domain names that provide basic services for gray business in the name of "big station", we will continue to track and observe their subsequent development.