Russian registrar NAUNET knowingly harbours Cybercriminals

Spamhaus reports an active Feodo banking-Trojan campaign using DGA-generated .ru domains registered via the NAUNET registrar and supported by a fast-flux network of hijacked servers and rotating IPs. The report includes sample C2 HTTP traffic, DNS/NS anomalies, a table of associated IPs (many on blocklists) and a long list of malicious domains, and documents NAUNET's refusal to suspend these domains while recommending networks block or blacklist NAUNET's address space.