My guess is since .in is one of the cheapest (if not THE cheapest) ccTLD the malwares/botnets are exploiting them. I received an email couple of years back from a top domain registrar based in India that the govt. requires actual Registrant contact address and not that of any privacy protection service (to protect from WHOIS); I don't remember whether it was only for .in or for any TLD's registered from India.

Anyways I've since then stopped buying .in and sticked with .com. I'm glad OP got his domain back, but I'm quite sure it wouldn't have been simple (or even possible) if he had chosen some registrar based in India (due to their incompetence and general nature to not contend with higher authorities) instead of Namecheap; especially since Namecheap's .in domain costs more than that of any registrar based in India.

This was a really good write up, thank you. And congratulations on getting your domain back.

This is something that can absolutely be decentralized. Problems aside namecoin shows that it can be done. The entire domain name system needs to be overhauled, central certificate authorities need to be avoided.

The internet in general is infrastructure, and protocols that are increasingly controlled by governments and organizations in bed with governments.

That also has its downsides though. For starters, it would no longer be possible to take down domains used for controlling botnets.

That's a similar nonsense as is the broad-scale surveilence to prevent terrorism. Botnets can already build a decentralized store of IP addresses, bypassing public DNS completely. Centralization makes some people, organizations or state just too much powerful.

Intelligent botnet authors will switch to the decentralized options once they are widely available and stable. While I think there's limited benefit to decentralization for any use case I care about, I don't think centralization is going to stop this trend in the medium term.

The GNU Name System https://gnunet.org/en/use.html already has a distributed DNS-like system built out.

This does not look like something my grandma would use.

I don't think she has to. As long as your ISPs run GNS themselves, and offer you DNS via DHCP, then you can just forego the ISP DNS server and drop in your own local GNS. Mount .com and the other TLDs you want from direct from ISP off their pubkey, and overwrite the TLDs you don't care much for.

This is great news!

Have you consulted a lawyer?

It seems that the Shadowsecurity Foundation did act recklessly. But you'd need to prove monetary damages.

But perhaps they'd settle to avoid the hassle.

Edit: This is an admission of guilt:

> He explained in his email that my domain name was sinkholed accidentally as part of their Avalanche operation.

Thank you for this comment. I have not consulted a lawyer. I have not suffered any monetary loss due to this yet. I use this domain name only to run a small personal blog (the one linked to in this post) and an Exim4 MTA. The fact that the MTA became unreachable via the domain name did mean that some emails sent to it must have bounced back. The primary loss I suffered was in terms of time.

In fact, I appreciate the efforts of the Shadowserver Foundation in depriving Avalanche malware families of their command and control infrastructure by sinkholing the domain names generated by the malware domain generation algorithms. I understand false-positives like this can happen. It comes with the territory. It just sucks that the domain name I was using happened to be a false positive. In this case, it ended well because the Shadowserver Foundation (along with Namecheap) acted quickly on my issue and asked NIXI to have the domain transfer undone.

Having said that, I do believe that you make a very good point. Actions like this should be taken with a lot more care. What if it were not a personal blog but a small business? Depending on the nature of the business, an inadvertent domain transfer like this could have affected the business seriously. The Shadowsecurity Foundation did say that they are improving their processes.

I am not very concerned about this particular foundation when I talk about this. But I am concerned about the systemic issue in the domain name management system that allowed a mistake like this to occur. There could be some type of peer review before a domain transfer like this is executed. I don't think there is a general and popular solution for this problem in the near future. I am hoping that the recent work that is going on in consensus protocols based on cryptography might pave the way to a more decentralized network and more decentralized name management that also become popular and mainstream.

Yes, I get that the Shadowserver Foundation does good work. And that they acted quickly, after being pointed to your tweet.

However, if your tweet hadn't gotten traction, and if Namecheap hadn't been proactive, you'd likely have never gotten the domain back. I mean, you had the Namecheap CEO on the case! And for a business losing a domain like that, it'd probably be fatal.

I get that many think that Americans are hugely too litigious. But there is the argument that there ought to be compensation for damages.

You say that "[t]he primary loss I suffered was in terms of time". But arguably your time is worth something. Such as your customary billing rate, times three.

Edit: Or just send them an invoice. At perhaps 50% over your customary billing rate, given that it was a rush job.

> I get that many think that Americans are hugely too litigious. But there is the argument that there ought to be compensation for damages.

That point of view is rather unfortunate. Why does it have to be about damages? GP even ends his comment on a very postitive note about things that would help. Not every mistake needs to be punished. It was a false positive, and it was heartening to see that all the parties acted fast enough. Why not just move on instead of outraging over hypothetical concerns?

EDIT: I have no idea how to quote parent comments here.

I was kind heartened by how quick they reacted. However it is quite true that Americans are very litigious; however, austria, germany, israel are worse than us, and England isn't far behind.

I don’t think I hear anybody from those countries talk about sueing nearly as much as any US citizen.

What is your source for that?

> Why does it have to be about damages?

If someone attacks you, and causes physical or even mental damage, they typically face criminal and/or civil penalties.

That's common, throughout the world.

> Not every mistake needs to be punished.

Maybe so. But the people responsible for the damage could proactively offer compensation. That'd arguably be the honorable and compassionate thing to do.

> It was a false positive, and it was heartening to see that all the parties acted fast enough.

It's clear that they acted recklessly. So it's not just a "false positive". And what's "fast enough"? A few days after a totally implausible attack isn't that fast. It should have been fixed within the day. After at most a few emails.

>But arguably your time is worth something. Such as your customary billing rate, times three.

Wouldn't the legal fees and time spent litigating exceed the winnings?

In a lawsuit, the fees can be added to the damages.

Generally no, they can't. In the US. Other countries have different rules.

https://en.wikipedia.org/wiki/American_rule_(attorney%27s_fe...

Yes, that's a good point.

But maybe some attorney might do it pro bono.

You know, for the exposure.

Or just on contingency, if it's an open-and-shut case.

> I get that many think that Americans are hugely too litigious

No, really they aren't. There are a lot of lawyers in America, but most never set foot in a courtroom. They mostly just do "important" paperwork and give advice on following rules.

I know a lawyer who last month wanted to sue someone in federal court, only to discover that Joe Random lawyer is not allowed to file lawsuits in federal court; he had no idea that there was such a thing as a federal trial bar and that membership requires significant experience in federal court under the supervision of a member. He spent a week trying to find anyone that would be willing to file his lawsuit but none would. So he hired a law firm to sue in state court - that is much easier I guess. Anyway, the point is that he is a good lawyer with years of experience doing the lawyer thing, but no experience with litigation. That's normal.

Average Americans are not litigious, because the overwhelming majority of Americans would not actually be able to afford a lawyer if it came to it. Lawyers are expensive.

The scariest part is that it looks like this got resolved quickly only because your tweet got noticed and retweeted. I wonder how long it would have taken otherwise.

Props to you by reacting suitably: worried, but calm and measured and not jumping on some Twitter outrage bandwagon.

> The fact that the MTA became unreachable via the domain name did mean that some emails sent to it must have bounced back.

MTAs should queue undeliverable addresses for more than four days, so you may not miss much unless someone’s DNS resolver had a poor caching strategy or Shadowserver used a long TTL. At least the name still resolved (else the mail would have been dropped immediately). Some mass mail senders may go to less effort to get their messages through.

The fact that people responded so “quickly” helped here. I put “quickly” in quotes as it was quick enough to possibly cause no message to be lost — I’m sure it was super stressful and didn’t feel quick at all!

Glad you got your name back.

> so you may not miss much unless someone’s DNS resolver had a poor caching strategy

Microsoft Exchange used to (hope it doesn't still?) cache MX records until the service restarted. :( There's a long tail of braindead software in the DNS space

Yes, sue them, and incentivize a worse, slower (because lawyers involved) and less transparent resolution of errors.

Thank you for this. We are definitely seeing the declining use of centralized domain-resolution. It has advantages only when it is not _itself_ being gamed, and increasingly companies and governmental orgs have found ways to do just that. At the very least every domain should have dual central + decentral resolutions, and browsers should give you options when the resolutions conflict.

the server is down it seems

https://github.com/susam/susam.in/commit/91405150ff3f44fd094...

The server is up. However, it is possible that at your end "susam.in" is still resolving to a sinkhole address.

I have created a mirror of the blog on GitHub Pages for you. Visit https://susam.github.io/blog/sinkholed/ to read the mirrored blog post.