Russian Business Network study - bizeul.org

Version 1.0.1
RBN study – before and after
David Bizeul
10. Affiliates presentation through networks
This part of the study offers a brief introduction to each RBN affiliate whenever it’s possible.
Too Coin Software
This name has not been presented at yet. It’s the global name used to register the whole IP netblock owned by RBN.
Too Coin Software has registered the netblock 81.95.144.0/20. This means that IP addresses from 81.95.144.1 to
81.95.159.255 belong to TCS.
We can already say that RBN and SBTel are part of TCS because their IP netblocks are included in TCS netblock.
SpamHaus has released a SBL for TCS [ 28 ]
It may seem odd that RBN and SBTel are part of another subsidiary but actually TCS/RBN has succeeded to become a
LIR (Local Internet Registry) and is now able to sub-divide its own netblock. Because of this, TCS/RBN has acquired the
privilege to manage a PA (Provider Aggregatable) address space and to delegate one part of this space to whomever
(for instance SBTel or Akimon).
SBT
SBT is the ISP of all RBN affiliates.
SBT owns the netblock 81.95.156.0/22 and is connected to all RBN ISPs in order to bounce them across the Internet.
SpamHaus has a case on SBT [ 29 ]
RBN
RBN is nothing and RBN is everything. RBN is the name of the whole cybercrime scheme described in this study. RBN
is also the name of the small network zone where many malicious ISP are attached to.
RBN owns the netblocks 81.95.144.0/22, 81.95.148.0/22, 81.95.154.0/24 and 81.95.155.0/24
RBN offers bullet-proof hosting services. It is used for phishing, malware diffusion, child pornography and many other
malicious activities. Bullet-proof hosting can guarantee that server won’t be shut down even when there is a complaint
against it. RBN has an available abuse team (used to give a respectable image) and this abuse team will ask you to
provide a Russian judicial indictment in order to process. Of course, this indictment is very difficult to obtain. Isn’t it a
paradise for fraudsters
Even the RBN homepage (when it was available) was used to spread malware [ 30 ] through an ActiveX object.
SpamHaus offers further information on RBN [ 31 ]
AkiMon
Akimon is a direct subsidiary from RBN because it’s only a part of its IP address range that has been delegated to
Akimon.
Akimon owns the netblocks 81.95.152.0/22 and it spreads a network topology in which there is Micronnet and Deltasys
Akimon is mostly used for hosting malware.
27 http://www.retn.net/en/network/plan/
28
http://www.spamhaus.org/sbl/sbl.lassoquery=SBL43489
29
http://www.spamhaus.org/sbl/sbl.lassoquery=SBL55398
30 http://web.archive.org/web/20060829111633/http://www.rbnnetwork.com/
31
http://www.spamhaus.org/rokso/listing.lasso-op=cn&spammer=Russian%20Business%20Network
21