Farm domains and mail servers, cut off at the source.
Credit farms need inboxes: throwaway domains with catch-all forwarding to receive your verification codes, and sometimes their own mail server. Esuba finds the domains behind the signups and reports them to the provider, registrar, mail service and host until they stop working.
Why domains matter to a farm
Your signup flow sends a code to an email address. A farm needs thousands of addresses that all reach one inbox, so it uses catch-all domains, where mail to any address is forwarded to the operator. Free subdomain services and mail forwarding make this cheap.
In Case 001 the operator used eight subdomains of one free domain service, then set up its own mail server once those were wiped.
Who to report to
| Who | What they control | How we find them |
|---|---|---|
| Subdomain or domain provider | Whether the domain exists | The parent domain's site or RDAP record |
| Registrar | The domain registration | The domain's RDAP record, which lists an abuse contact |
| Mail forwarding service | Catch-all forwarding to the operator | The domain's MX records |
| Hosting provider | A self-hosted mail server | The server's IP address and its network's abuse contact |
ICANN-accredited registrars must publish an abuse contact and investigate reports. Country-code domains follow their own registry's rules.
What happened in Case 001
We reported the farm's domains to the free domain service, the registrars and the mail forwarding service on 21 October. All eight domains were wiped around 24 October, about three days later. The operator moved its mail to a self-hosted server, which we reported to its host on 2 November.
What you can do at signup
Block farm domains by parent domain, not subdomain, so one rule covers every subdomain a service hands out. More in how to stop free credit farming.
Questions
What is a catch-all domain?
A domain where mail to any address is delivered to one inbox. Farms use them to receive verification codes for thousands of accounts.
What is RDAP?
The Registration Data Access Protocol. It has replaced WHOIS as the official way to look up who registered a domain or IP address, and where to report abuse.