Russian Business Network study - bizeul.org

More documents

Recommendations

Info

Version 1.0.1 RBN study – before and after David Bizeul function I(mK,G){ if(!G){ G='Ba,%7(r_)`mdPSn=3J/@TUc0f:6uMhk;wyHZEs-^O1N{W#XtKq4F&xV+jbRAi9g'; } var R; var TB=''; for(var e=0;e
Version 1.0.1 RBN study – before and after David Bizeul Investigation and analysis A lot of information is available when you spend enough time to check public data. That’s precisely what can offer Whois services, DNS databases, forums, groups…. 1. Lookup, IP history, NS history and, registrar history This investigation has used a collection of basic tools: Lookup has allowed resolving the IP address associated with a domain name. Hosting history has been used to note the evolution of the domain. NS history and registrar history have been useful to add some useful information regarding a domain evolution. Some web services (such as Domaintools [ 36 ]) can provide such information to their clients. The following chart gives essential information: Domain IP history NS history Registrar history rbnnetwork.com 2006-06-08: 85.249.135.118 2006-09-16:127.0.0.1 2006-06-08: infobox.org 2006-09-06: rbnnetwork.com 2006-06-07 eNom.com 2006-08-16 China-Channel.com Akimon.com 2006-06-08: 85.249.135.118 2007-03-17: None 2006-06-09: infobox.org 2007-03-10: akimon.com 2006-06-07 eNom.com 2006-09-08 China-Channel.com Sbttel.com 2006-06-08: 85.249.135.118 2006-09-16: 85.249.135.14 2006-06-09: infobox.org 2006-12-08: sbttel.com 2006-06-07 eNom.com 2006-09-08 China-Channel.com Nevacon.net 2006-09-22: 85.249.135.37 2006-11-10:127.0.0.1 2007-09-30: 209.85.84.167 2006-09-22: infobox.org 2006-11-10: nevacon.net 2007-09-26:onlinenic.net 2006-11-09 China-Channel.com Infobox.org 2006-07-22: 85.249.134.34 2007-10-21: None 2003-11-16: Infobox.org 2007-09-15:nameservices.com There are similarities on these domains: • They have been using 85.249.134.0/23 extensively to host their websites. This IP address range is owned by Datapoint which is the global hosting service for RBN affiliates front websites. As we’ll see in the next part, Datapoint also relates to Infobox. • Some domains have made a recent change; they now prefer to resolve on nothing instead of having many security researchers looking for information on them. • eNom has been used as a registrar for a long time but RBN now prefer to use China-Channel services. As we’ll see later, this service offer anonym records for registrants. This part only can bring enough evidence that all these entities are closely tied since the data are similar too much to be managed by different persons. 36 www.domaintools.com 27
Page 1 and 2: Russian Business Network study Vers
Page 3 and 4: Version 1.0.1 RBN study - before an
Page 25: Version 1.0.1 RBN study - before an
Page 33 and 34: Version 1.0.1 New York,NY,US 10019
Page 35 and 36: Version 1.0.1 New York, NY 10018,-,
Page 41 and 42: Version 1.0.1 City map RBN study -
Page 47 and 48: Version 1.0.1 Filtering bad network
Page 53 and 54: Version 1.0 David Bizeul RBN study

Russian Business Network study - bizeul.org

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?