In mid-May, the Federal Bureau of Investigations lost control over seized domains, including Megaupload.com, when the agency failed to renew a key domain name of its own. That domain, which hosted the name servers that redirected requests for seized sites to an FBI Web page, was purchased at auction—and then used to redirect traffic from Megaupload.com and other sites to a malicious site serving porn ads and malware. Weeks later, those sites are still in limbo because somehow, despite a law enforcement freeze on the domain name, the name servers associated with Megaupload.com and those other seized sites were changed to point at hosts associated with a domain registered in China.
As Ars reported on May 28, the domain CIRFU.NET had been registered by the FBI through GoDaddy to provide domain name servers and Web servers for the FBI's Cyber Initiative and Resources Fusion Unit (part of FBI's Cyber Division). The FBI failed to renew the domain on April 1, however, and on May 13 the domain was acquired at an auction by "Syndk8 Media Limited"—a front company registered at a Gibraltar mail and call forwarding service by a "black-hat SEO" Web marketer who calls himself Earl Grey.
That created some problems, because up until at least May 27, the name servers listed in Whois data for Megaupload.com and several other seized sites were still hosts on CIRFU.NET—meaning that whoever controlled CIRFU.NET essentially controlled the FBI's seized domains. And for a number of days up until May 28, the new owner of CIRFU.NET apparently gave control over to an individual who had registered CIRFU.BIZ—a domain that in turn served up a stream of "zero-click" advertisements for porn, advertisements that were really Web exploit malware, and other malicious or otherwise undesirable ads.
Read 4 remaining paragraphs | Comments