No Nameservers for the Storm Worm
Posted by jeremy on March 19th, 2008
"ibank-halifax.com" the domain name in which the Storm Worm has been utilizing since early January looks like it is now having some technical difficulties/issues or nic.ru has finally taken action against the Storm Worm domain. Here is a snippet from my whois request:
Domain Name: IBANK-HALIFAX.COM
Registrar: ANO REGIONAL NETWORK INFORMATION CENTER DBA RU
Whois Server: whois.nic.ru
Referral URL: http://www.nic.ru
Name Server: No nameserver
Status: clientHold
Status: clientTransferProhibited
Updated Date: 18-mar-2008
Creation Date: 08-jan-2008
Expiration Date: 08-jan-2009
Notice the "No nameserver" and Status entries. Here is another whois record from whois.domaintools.com:
Domain name: IBANK-HALIFAX.COM
Creation Date: 2008.01.09
Updated Date: 2008.01.09
Expiration Date: 2009.01.09Status: NOT DELEGATED
Registrant ID: A4DDYNG-RU
Registrant Name: Nelly B Smith
Registrant Organization: Nelly B Smith
Registrant Street1: TRINITY ROAD, GB
Registrant City: London
Registrant State: UK
Registrant Postal Code: 65412
Registrant Country: GBAdministrative, Technical Contact
Contact ID: A4DDYNG-RU
Contact Name: Nelly B Smith
Contact Organization: Nelly B Smith
Contact Street1: TRINITY ROAD, GB
Contact City: London
Contact State: UK
Contact Postal Code: 65412
Contact Country: GB
Contact Phone: +1 800 3121812
Contact E-mail:
Status: NOT DELEGATED, so again it looks like we may have a few hours of peace and quiet from the Storm Worm... My bet is we will see an Easter Themed domain name next along with hundreds of "happyeaster.exe" cards in our email very soon! Maybe even the first three images returned from a simple Google search for"happy easter" will decorate the web sites. 
Who knows?