Recently I found out that there are malicious websites that do not have a domain name on its own. For example, as in http://googleonlinesecurity.blogspot.hk/2009/06/top-10-malware-sites.html

Other malware domain list site also shows that there are multiple malicious url that do not have a domain name, e.g.

I would like to ask why do malicious website would try to post their website without domain name? I understand that without a domain name, a hacker can save more money. However, isn't the attacker more easy to be be found by Internet Police? Since the IP is already listed in the url and you do not even need to go for a DNS look up.

So why would this be? Can anyone tell me the reason? Thanks.

  • 3
    What's this Internet Police you are referring to? – Deer Hunter Apr 15 '15 at 18:52
  • 1
    Finding an IP address from a domain name is trivial -- something any experienced computer user can do in a second or less. Using a domain name rather than an IP address in a URL provides absolutely no protection. – Mark Apr 15 '15 at 19:44

The concern is less to do with money, and more to do with the number of points of failure, and the potential for being identified.

Getting hold of an IP to abuse is easy - just compromise an internet connected system. Setting up a domain name requires money to change hands, which means they need a real way of paying, allowing the authorities to track who bought the domain. Obviously they could just use stolen credit card details, but that's more difficult and potentially risky.

Another concern for them is keeping their pages up for long enough to catch victims. If a domain name is used, then either the system can be cleared of malware (or otherwise blocked), or the domain can be blackholed or shut down. This means two points of failure rather than one. It's also harder for people to get a generic system on the internet turned off (because attribution and ownership is difficult to discover) whereas you just need to send an abuse email to the domain provider to get a domain investigated.

  • But couldn't I block the malicious IP? So is the second concern a real concern here? – CHANist Apr 15 '15 at 14:20
  • @CHANist You can, but it can't be blanket blocked for everyone easily if it's just an IP. With a domain it can be killed by the domain provider (e.g. 1and1, Nominet, etc.) based on an abuse report, which means nobody can reach it via that domain any more. – Polynomial Apr 15 '15 at 16:34

Not the answer you're looking for? Browse other questions tagged or ask your own question.