Russian Business Network study - bizeul.org

More documents

Recommendations

Info

Version 1.0.1 RBN study – before and after David Bizeul There is a complete exchange of routes between SBT-Tel and Silvernet. This is not common for a transit AS (what Silvernet is supposed to be). On the opposite, it makes sense if Silvernet is dedicated to be the white face of the evil. Most entities inside as-silvernet seem to be legitimate but we can highly suspect that there are some malicious activities different from RBN or complementary. Anyway, we can see that Silvernet sends as-silvernet zone to three other ISP: • Linkey – AS13302 • Datapoint – AS30968 • SPB Teleport – AS31501 As Silvernet, these ISPs are members of SPB-IX and such peering relation allow them to exchange data directly. Datapoint interactions with RBN will be detailed later in this document. It’s also interesting to observe that Silvernet has a peering relation with ReTN. This will also be detailed later in this document; it may allow the diffusion of as-sbtel everywhere in the world. On SPB-IX member list page [ 21 ], it’s interesting to observe that such entities such as Silvernet or Obit are not fully qualified. Is there a link with the fact that those entities may be implicated in cybercrime Other networks interact with RBN for special purposes. Those networks are as-joy and as-cub. • The first zone is as-joy : as-joy has been used extensively for iframecash scheme [ 22 ]. Iframecash is an affiliation program quite simple: the affiliate adds a special code to his website (an iframe) leading to advertisement banners or malware diffusion. Then the affiliate is supposed to be paid depending on the traffic brought to iframecash servers. Affiliates are not even guaranteed to get paid with iframecash[ 23 ]… Eltel2 does not broadcast any IP address at the moment of the study but there are several evidences that can be aggregated to show that this zone is used on demand [ 24 ]. 21 http://www.ripn.net:8082/ix/spb/en/networks.html 22 http://sunbeltblog.blogspot.com/2006/06/those-nice-dear-boys-at-iframecash.html 23 http://www.pay-per-install.com/IframeCash.html 24 http://www.pianetapc.it/file/Blockpost/blockpost.txt 16
Version 1.0.1 RBN study – before and after David Bizeul • The second zone is as-cub : As-cub is quite simple. It’s composed with 4 networks. Connectcom, MicronNet and Deltasys are all members of asrbncus and ELTEL2 is also a strong RBN partner as shown in as-joy. Nevertheless, it’s not obvious to identify the goal of this zone. May be it could be used in a future usage. 17
Page 1 and 2: Russian Business Network study Vers
Page 3 and 4: Version 1.0.1 RBN study - before an
Page 15: Version 1.0.1 RBN study - before an
Page 33 and 34: Version 1.0.1 New York,NY,US 10019
Page 35 and 36: Version 1.0.1 New York, NY 10018,-,
Page 41 and 42: Version 1.0.1 City map RBN study -
Page 47 and 48: Version 1.0.1 Filtering bad network
Page 53 and 54: Version 1.0 David Bizeul RBN study
Page 67 and 68:
Version 1.0 David Bizeul RBN study
Page 69 and 70:
Version 1.0 David Bizeul RBN study
show all

Russian Business Network study - bizeul.org

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?