Kelihos botnet domain provider promises to make amends

dotFree Group has settled the lawsuit brought against it by Microsoft in the Kelihos takedown case by suspending all abusive hosts registered through the Czech-based domain provider's service and promising better collaboration in the future.

Microsoft announced the takedown at the end of September of a relatively small botnet called Kelihos with the help of several partners, including antivirus vendor Kaspersky Lab and security firm Kyrus Tech.

However, according to the Redmond giant, this case was noteworthy because it was the first time when the company managed to actually name defendants in a botnet-related legal action, these being Dominique Alexander Piatti and his company, dotFree Group SRO, which provides free second-level domain (SLD) registration services in the .cz.cc namespace.

No dotFree involvement

Piatti and dotFree were named as defendants because the people behind Kelihos used .cz.cc subdomains for command and control purposes. Microsoft believed the domain provider was involved in the illegal operation because a high number of its hosts were being used for questionable purposes, but that's no longer the case.

"Since the Kelihos takedown, we have been in talks with Mr Piatti and dotFREE Group SRO and, after reviewing the evidence voluntarily provided by Mr Piatti, we believe that neither he nor his business were involved in controlling the subdomains used to host the Kelihos botnet," Richard Domingues Boscovich, a senior attorney with Microsoft's Digital Crimes Unit, said. "Rather, the controllers of the Kelihos botnet leveraged the subdomain services offered by Mr Piatti’s cz.cc domain," he added.

Microsoft is in the process of dismissing the lawsuit after the Czech company agreed to suspend or hand over all hosts used for illegal activities. In addition, dotFREE also agreed to collaborate with the software vendor on domain abuse matters going forward.

'Security should not be underestimated'

"As a provider of free service we were always concerned by the potential for abuse, and learned (sometimes the hard way) that security should never be underestimated. No one wants to be handed a thick binder by a stranger at your nearby coffee shop saying 'Microsoft is suing you!'," the company said in a statement.

"Moving forward, we are pleased that Microsoft will continue working with dotFree and help us develop best practices for free domains and our .free Top Level Domain," it added.

dotFree is not the first SLD provider forced to clean up its act. Earlier this year, Google removed all .co.cc and .co.tv results from its search engine, a decision that resulted in the latter terminating its free registration service, probably in an attempt to limit the number of abuse reports going forward.

The company behind .co.cc also tried to revert Google's decision by promising to improve its abuse response practices, but the search giant has remained unmoved in both cases so far.