EstDomains clearing up the shit

[JohnC]

Any domains registered through EstDomains which are on the MDL they are contacting customers telling them they need to clean their sites or they will cancel the domain. In the last two days I have had various requests to remove domains. Whether or not these domains are only being cleaned temporarily to be removed from the MDL and will then go back to hosting/directing users to malware I am unaware.

[sowhat-x]

Ehmm...not really sure if I understood the above correctly...
you mean that EstDomains itself told it's clients to start clean up the crap,
and their now trying to convince you to do so?   
Or just that malware authors/estdomains clients do it by themselves,
as a temporary defensive mechanism?

[JohnC]

I normally only get requests to remove domains which are RFIs and that kind of thing which have been cleaned.

The last couple of days I have gotten a lot of other requests, one said that his registrar gave him seven days to clean it up. Another guy asked me if I could CC the email back to notify@estdomains.com

[SysAdMini]

I'm really confused. I thought that Estdomains is related to Atrivo and a source of evil.

[JohnC]

This is what I don't understand. Why are they contacting their customers and asking them to clean their sites?

[sowhat-x]

Guys,check this out now...seems they're in the process of somehow starting a 'new round'...
at the moment (temporarily?) removing at least some of the already spotted 'in the wild' domains:
http://www.malwaredomainlist.com/forums/index.php?topic=2149.msg5221#msg5221
At least that's what I understand myself,it can't be a complete coincidence...
Few well-known members/friends have already replied in the WashingtonPost article from what I see...

[sowhat-x]

Personal opinion,maybe I'm wrong on this,maybe not...
Do NOT remove anything hosted in RBN netblocks for the time being,
no matter if domains get temporarily cleaned/shut down -> to HELL with all of them.

If they are indeed legitimate webmasters with no malicious intentions whatsoever,
well then,they should choose different web space providers -> simple as that,heh...
Hope to hear other people's opinion on this matter...

[JohnC]

I've still got stuff from 81.95.149 which I hadn't cleaned out, just incase the domains come back with new IPs

[sowhat-x]

Link taken from the (currently) last comment over at WashingtonPost's article...
http://msmvps.com/blogs/hostsnews/archive/2008/09/03/1646589.aspx

[MysteryFCM]

I've got a ton of Est related domains in hpHosts, including a few that were found within the last 48 hours.

I'm pretty sure there's a site monitoring Est NS's, but can't find the ref atm

[SysAdMini]

Maybe there is a relation between this activities and the astonishing high number of users from August 26,
what never happened before at this dimension.

 Most Online Ever: 320 (August 26, 2008, 09:07:15 PM)

[sowhat-x]

The WashingtonPost article is dated two days later,August 28,who knows...
Personally,I've came to the conclusion that the hit stats counter must been b0rked,ha-ha...
because it says 'Most Online Ever: 320'...but at the same moment...only 237 Members in total? 

[SysAdMini]

users online doesn't mean members online. users can be guests.

[JohnC]

I think a large amount were Yahoo search engine crawlers. They have a large amount on the site at a time, and with unique IPs mostly.

[sowhat-x]

Heh,that's funny...imagine that i didn't knew that...
until now,i thought it was tracking / displaying in public,
only the number of maximum logged-in members...