ROKSO Home  |  ROKSO FAQs & Policies  |  About Spamhaus  |  FAQs
The Register of Known Spam Operations
Quick Cart Pro

Evidence Menu:

Quick Cart Pro Index

Country: United States
American operation with Philippines, Russian and Canadian connections, this large spam operation mostly promotes fake pharmaceuticals using classic "snowshoe" methods with countless IP ranges and domains. Many fictitious identities and aliases. They own at least two ICANN registrars (!) and use them to obtain an unlimited stream of domains for spamming.

Quick Cart Pro SBL Listings History
Current SBL Listings
Archived SBL Listings

MEDIA: EnCirca suspends all domains from terminated ABSYSTEMS

Registrar suspends all domain names transferred from terminated registrar

BY Andrew Allemann - Mar 19, 2014
Domain Registrars

EnCirca finds that domains were used for nefarious purposes.

ICANN terminated the accreditation of domain name registrar ABSYSTEMS INC (dba in December for multiple contract breaches.

ICANN transferred the domain names to another registrar as ICANN does in cases of a de-accreditation. In this case, EnCirca was the (not so) lucky registrar.

EnCirca got more than it bargained for.

ICANN informed EnCirca that ABSYSTEMS had approximately 700-800 names, but some of the names had already been transferred away. It estimated that 30% of the names were registered to individuals and companies in the United States, and 70% of the names were registered through a privacy service in the Philippines. ICANN also said the latest escrow deposit information seemed to be okay.

When EnCirca received the data, even the US contacts looked suspicious, EnCirca President Thomas Barrett told Domain Name Wire.

Although not required for registrar transfers, Barrett decided to put all of the customers through email verification. 75% of the customer emails bounced and no customer verified their account.

So EnCirca compared the list of transferred domains to a list of unauthorized pharmacies listed at NABP.Net and there were over 110 matches.

Next, the registrar asked LegitScript to analyze the list of 750 domains. On its first pass, LegitScript flagged 96% of the domains as fraudulent. (LegistScript does this service free for registrars.)

As a result, EnCirca has suspended all of the domains that were migrated from ABSYSTEMS.

Some of the domains, including the registrar’s main domain, were transferred out to another ICANN registrar and are now under Whois privacy. The remaining domains will be allowed to expire and deleted per the normal schedule.

Although a bit of work for EnCirca, the net result is a rogue registrar has been put down and the internet is a little bit safer than before, Barrett noted.

Related URLs

The Register of Known Spam Operations (ROKSO) collates information and evidence on entities with a history of spamming or providing spam services, and entities affiliated or otherwise connected with them, for the purpose of assisting ISP Abuse Desks and Law Enforcement Agencies.
The address of this ROKSO record is:

The above consists of information in the public domain. The Spamhaus Project makes every effort to avoid errors in information in the ROKSO database, and will correct any errors as soon as it is able to verify the correction, but accepts no responsibility or liability for any errors or omissions, or liability for any loss or damage, consequential or otherwise, incurred in reliance on the material in these pages. The Spamhaus Project makes no warranties or representations as to the accuracy of the Information in ROKSO records. The information in the ROKSO database is for information purposes only and is not intended as legal advice of any kind.

For information on contacting the ROKSO Team regarding any factual errors in this record, see the ROKSO FAQs.
© 1998-2016 The Spamhaus Project Ltd. All rights reserved.
Legal  |  Privacy