No-ip was DEFINITELY aware of it. OpenDNS published an article in April 2013 identifying no-ip as the top used provider for malicious use [1] and a representative from no-ip posted a comment on that article which proves that no-ip was aware of it.
Cisco published a similar article on February 11, 2014 [2]. We know that no-ip was aware of this because they posted a comment in response, and posted a blog entry about it at their site [3].
[1] http://labs.opendns.com/2013/04/15/on-the-trail-of-malicious...
[2] http://blogs.cisco.com/security/dynamic-detection-of-malicio...
[3] http://www.noip.com/blog/2014/02/12/cisco-malware-report/
They (noip.com) had zero pre-warning of a domain seizure. Regardless of any literature you dig up from years ago that states some botnets use Dynamic DNS services such as noip.com, it does not mean they had warning they were about to be seized. Others have commented that the court order forbid anyone, including Microsoft, from informing noip.com prior to the seizure.
It should be noted, that most/all "cloud" services likely have some sort of illicit behavior being conducted through them... Ec2, Azure even, etc. Botnet's use the same services me and you do... that does not for even a second make noip.com responsible for the botnet's actions.
The links I cited show that this is incorrect. No-ip was aware.
No-ip was aware of the potential and had an abuse team to deal with such cases. They were also aware of other experts finding their abuse team wanting. But that doesn't seem to be enough evidence to suggest they were partly culpable in any particular case. Perhaps there were examples of particularly galling incompetence in their abuse team, or the abuse team tipping off fraudsters but otherwise informing them seems to be the most reasonable and responsible action.
Every domain provider must have an abuse team or at least an address to send abuse notices too [http://who.is/whois/cloudapp.net/], that PR statement from No-IP states no facts or figures of many abuse notices they combat - which I would cite if my abuse team actually did stuff "look how amazing our team is - we had x,000's requests and took down x00 of malicious hosts just last month."
It seems odd that people aren't reporting this there, or if they are reporting it there, are not documenting that.
How is that possible in a state of justice? How anyone dares to run a company in a state where you are not allowed to defend yourself in court escapes me.
I can not believe this is the normal legal process. There must have been some extraordinary circumstances that I am not aware of. I would be very interested to hear what they are.
(Given that Microsoft probably hasn't got more legal rights than anyone else, could No-IP do the same to Microsoft? Surely Azure is the host of a few of them C&C servers.)
It's not.
> There must have been some extraordinary circumstances that I am not aware of.
Possible, but so far, the case is mostly sealed (refer to the above statement). From what we know, Microsoft identified some botnet(s) using noip's service as part of their infrastructure. Nothing points to noip knowing about the botnet, so we must assume until we know otherwise that they had no knowledge. This leaves us with a US company waking up one day to find their property seized by another US company, supposedly with the backing of a US court.
> Given that Microsoft probably hasn't got more legal rights than anyone else, could No-IP do the same to Microsoft?
Probably not -- Microsoft has a history of helping Law Enforcement track down botnets -- in the past they have literally marched into data centers and seized all the servers from a company without their knowledge (they even did this overseas outside of the US once). It's unlikely if noip were to bring suit against Microsoft, that it would go anywhere.
(It's as scary as it sounds when a private company is leading Law Enforcement, instead of the other way around).
"Microsoft’s request for this emergency ex parte relief is not the result of any lack of diligence on Microsoft’s part, but instead based upon the nature of Defendants’ unlawful conduct. Therefore, in accordance with Federal Rule of Civil Procedure 65(b) and Civil Local Rule 7-5, good cause and the interest of justice require that this Order be Granted without prior notice to Defendants, and accordingly, Microsoft is relieved of the duty to provide Defendants with prior notice of Microsoft’s motion." (Microsoft's motion in question being their attempt to seize the domains.)
The basis for this was "unlawful and/or negligent conduct". Basically, Microsoft managed to convince the courts that because in their eyes No-IP weren't policing their services well enough, Microsoft had the right to seize all their domains and shut them down without giving them the opportunity to challenge this in court first.
However, given the tone of noip's public statement regarding this issue -- there seems to be no indication they had any forewarning, be it refused court order or not.
Since we know very little at the moment -- it has to remain a possibility that the other happened -- we are left in the dark on purpose due to the nature of the event... and possibly some favorism from the court (citing Microsoft's past aid to law enforcement)
And there was no prior warning to noip.com -- they woke up one day and their domains were seized. They only found out why after the fact -- and, given the nature of free Dynamic DNS services, it's very unlikely noip.com was even aware that a botnet was using their services (the justification for the seizure).
And, I can't help but feel Microsoft could have obtained the same data by politely asking noip.com -- nobody likes to harbor botnets (and we have no reason to suspect noip.com of trying to do so). Seems domain seizure was heavy-handed at best.