Russian Business Network study - bizeul.org

Version 1.0.1
RBN study – before and after
David Bizeul
SBT-Tel (using AS41173) may be the most dangerous part of RBN because it’s this entity which is the instigator of
peering settlements. Basically, as-rbncus is only a zone where part of RBN customers are listed but the peering
relations available in as-sbtel are the real key point to conclude that networks are linked together.
Networks being reported as RBN customers and having peering relationship with SBTel are:
• RBN – AS40989 (leading to Akimon – AS28866)
• Nevacon – AS41731
• Credolink – AS20807
• Deltasys – AS39848
• Oinvest – AS41108
All RBN customers have been spread to SBT-Tel through as-rbncus where they found a bouncer to reach largest ISPs
because of the SBT-Tel peering settlements.
The two most dangerous networks have been RBN and Nevacon as both of them have been regularly listed in cyber
crime schemes analysis.
The last part of this peering network study is the location where SBT-Tel is physically plugged. Indeed, even if SBT-Tel
has established peering relations with large ISP, it has to be plugged to something real such as an IXP or another ISP.
This last part is interesting because it tends to show that there are social connections between illegal networks such as
SBT-Tel, RBN, Nevacon and legal networks who can pretend to be “white” in order to be physically connected to an
IXP. As we can see on the following figure, Silvernet seems to be this purgatory zone used to get connection to the
Saint Petersburg IXP.
15