Russian Business Network study - bizeul.org
Russian Business Network study - bizeul.org
Russian Business Network study - bizeul.org
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
Version 1.0.1<br />
RBN <strong>study</strong> – before and after<br />
David Bizeul<br />
There is a complete exchange of routes between SBT-Tel and Silvernet. This is not common for a transit AS (what<br />
Silvernet is supposed to be). On the opposite, it makes sense if Silvernet is dedicated to be the white face of the evil.<br />
Most entities inside as-silvernet seem to be legitimate but we can highly suspect that there are some malicious activities<br />
different from RBN or complementary.<br />
Anyway, we can see that Silvernet sends as-silvernet zone to three other ISP:<br />
• Linkey – AS13302<br />
• Datapoint – AS30968<br />
• SPB Teleport – AS31501<br />
As Silvernet, these ISPs are members of SPB-IX and such peering relation allow them to exchange data directly.<br />
Datapoint interactions with RBN will be detailed later in this document.<br />
It’s also interesting to observe that Silvernet has a peering relation with ReTN. This will also be detailed later in this<br />
document; it may allow the diffusion of as-sbtel everywhere in the world.<br />
On SPB-IX member list page [ 21 ], it’s interesting to observe that such entities such as Silvernet or Obit are not fully<br />
qualified. Is there a link with the fact that those entities may be implicated in cybercrime<br />
Other networks interact with RBN for special purposes. Those networks are as-joy and as-cub.<br />
• The first zone is as-joy :<br />
as-joy has been used extensively for iframecash scheme [ 22 ]. Iframecash is an affiliation program quite simple: the<br />
affiliate adds a special code to his website (an iframe) leading to advertisement banners or malware diffusion. Then the<br />
affiliate is supposed to be paid depending on the traffic brought to iframecash servers. Affiliates are not even<br />
guaranteed to get paid with iframecash[ 23 ]…<br />
Eltel2 does not broadcast any IP address at the moment of the <strong>study</strong> but there are several evidences that can be<br />
aggregated to show that this zone is used on demand [ 24 ].<br />
21<br />
http://www.ripn.net:8082/ix/spb/en/networks.html<br />
22<br />
http://sunbeltblog.blogspot.com/2006/06/those-nice-dear-boys-at-iframecash.html<br />
23 http://www.pay-per-install.com/IframeCash.html<br />
24<br />
http://www.pianetapc.it/file/Blockpost/blockpost.txt<br />
16
Change language