[nsp-sec] enom security POC?

[Chris Morrow]

On Thu, 30 Oct 2008, Chris Morrow wrote:

> ----------- nsp-security Confidential --------
>
> and now it's NetworkSolution's turn in the barrel:
>
> <spam-snip>
> Renew your domain now - http://www.networksolutions.com.sys62.biz
> </spam-snip>
>
> I'll troll my spamtrap for other domains of this vein.

so far from yesterday and today:
   count  domain
    1306 www.networksolutions.com.com21.asia
    1292 www.networksolutions.com.com55.asia
    1251 www.networksolutions.com.com42.asia
     736 www.networksolutions.com.sys49.mobi
     736 www.networksolutions.com.sys42.mobi
     357 www.networksolutions.com.sys44.mobi
     105 www.networksolutions.com.sys42.biz
     104 www.networksolutions.com.sys62.biz
      94 www.networksolutions.com.sys72.biz

Perhaps Afilias can squish *.asia, Ultra can squish *.biz and *.mobi? Are 
these being signed up (as far as Ultra can tell) by some common user of 
your system(s)? or common src ips? or??

-Chris