Just recently, the China Internet Network Information Center (CNNIC) announced that parties who plan on applying for .CN domain names will now be required to submit hard copies of documents, in addition to their online application, to prove the legitimacy of their request. The said documents (original application form with business seal, and photocopies of both company business license and registrant ID) have to be submitted within 5 days after the online application. The said documents must also meet certain requirements before being approved. If the applicant refuses to submit the necessary documents or fails to meet the set requirements, the domain applied for will be removed. This new policy is set to develop the domain name registration process, as well as enhance the accuracy of the information associated with the domains.

We at Trend Micro are certainly pleased with this move by CNNIC, as it clearly goes into the right direction of monitoring .CN domains. Domains associated with China had been infamous for serving malicious files and involved as landing pages of sites compromised with exploits. However, based on our experience in deep monitoring modern threats, the five-day delay will still give cybercriminals a big enough window of opportunity to continue their criminal business.

Malicious URLs can infect as many users that are led to them in as little as a few minutes. Cybercriminals thus already benefit even if a URL is up for only a few hours. Giving the cybercriminals a total of 120 hours before a domain gets withdrawn will do very little in stopping their crimes.

The new policy is indeed a good start; it is however rather unfortunate that it is not enough to stop modern threats.