From Spamwiki
(Redirected from NAUNET-REG-RIPN)
Jump to: navigation, search

NAUNET is a registrar in Russia.

Description of the Registrar

It was established in 2005 to provide services in the field of information and communication technologies. The main specialization of "Naunet SP" is the production and delivery of integrated services to both end users and operators. The main objective of the company - is to ensure customers and partners effective tools for the management and development of their own business on the basis of modern information and communication technologies.

"Naunet SP" is a company that provides a full range of provision of services necessary for the improvement and development of our clients' businesses using Internet technologies. We do our best to provide high stability, reliability and good quality of service.

"Naunet JV" develops partnership programs . Thus, from November 2006 to actively develop partnerships in the registration of domain names offered by hosting reseller program, there is a regional program of the project SIPNAME. "Coordination Center for TLD"

The establishment of the Coordination Center for TLD in 2001 was a new milestone in the development of domain RU. In 2002, the Coordinating Center transferred the authority to develop rules for registration of domain names in RU, accreditation of registrars and the development of future projects related to the development of the Russian national domain. In order to preserve the stability of the domain RU to RIPN entrusted with the functions of the Technical Center for TLD RU.

Anti-Spam Position

Official Position

9. Cancellation of registration

9.1. Cancellation of registration of a domain name before the end of the registration period:

  • if rules of registration are violated;
  • on the basis of an enforceable court decision;
  • upon written request by the User.

Actual Behavior

NAUNET has been widely abused by the Russian EvaPharmacy fraud operation.

Until August 2014 NAUNET ignored all requests to suspend illegal domains. In late August, most of the live domains were put on NOT DELEGATED status, suspending them.

Registrar responsiveness

Click to enlarge

Click to enlarge

The comparison between this registrar and others can be seen on the graphs (click to enlarge).

It shows how many domains have not been suspended by various registrars over the past year.

The higher the column, the more domains are sponsored by the registrar.

Currently the most abused registrar is Russia's

This registrar sponsors the vast majority (over 95%) of the fraud domains used within the Eva Pharmacy group.

Other registrars have been quick to terminate the service contracts with these cyber-criminals upon seeing the obvious evidence of fraud.

Click on the graph to enlarge it.

Examples of domains used for fraud

These were all failing when tested on December 24, 2014.

Click on any heading for evidence of fraud.


Canadian Health&Care Mall (suspended) (suspended)

A quick way to verify these sites is to examine the hosting addresses. Many compromised hosts used for this operation are located at

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Snapshot: Pie chart showing the highest used IP addresses.
(Nov 16, 2014) IP which was swapped out for
(Nov 18, 2014) or
(Nov 22, 2014) or
(Nov 30, 2014) or
(Jan 13, 2015) or
(February 2015) or
(April/May, 2015)

Where to send abuse complaints

Additional Contact Information

Postal address

125040, Moscow, 1st Yamskogo fields, 19, p.1., LLC "Naunet joint venture."

Registration Information

Telephone and FAX

  • General +7 (495) 745-20-36
  • Technical +7 (495) 745-20-34
  • Billing +7 (495) 745-20-36
  • Domain registrations +7 (495) 745-20-36

Related information

Pharmacy fraud operations

Affiliate program coordinator employing spammers

Sources for this article


InBoxRevenge Eva Pharmacy campaign

Rogues and Champions report