Russian Business Network study - bizeul.org

More documents

Recommendations

Info

Version 1.0.1 RBN study – before and after David Bizeul Just for fun, here are RBN and affiliates on a tourist map (the original picture can be downloaded on [ 48 ] and is not RBN related at all): 48 http://www.ed.spb.ru/spb/map/ 42
Version 1.0.1 RBN study – before and after David Bizeul RBN evolution As a service provider, RBN will evolve to provide better business opportunities to their customers. As many security teams keep a close eye on RBN activities, RBN might want to obfuscate its presence on the Internet. This chapter tries to consider different paths RBN could chose. UPDATE: This chapter comes to reality as RBN is now unavailable from main ISPs. 1. Changes in hosted domain names UPDATE: A recent anaysis (2007/11/15) of domain names collected on RBN (for Real stats chapter) showed that hosting sites has moved. Here are the most used network ranges used by RBN affiliates’ domain names: 81.0.250.0 1018 UPL TELECOM (Casablanca INT) CZ 81.95.147.0 49 RBN RU 194.146.207.0 23 RBN/Nevacon RU 81.95.149.0 21 RBN RU 81.95.150.0 17 RBN RU 58.65.239.0 13 HostFresh HK 193.33.129.0 11 Disk Limited TW 209.85.51.0 10 EVRY-318 (Direct Information FZC) AE 81.95.144.0 9 RBN RU 85.249.143.0 7 DATAPOINT RU 88.255.90.0 7 AbdAllah Internet Hizmetleri TR 81.95.148.0 6 RBN RU 58.65.238.0 5 Hostfresh HK 74.52.55.0 5 ThePlanet.com US 203.121.67.0 3 TIME Telecommunications Sdn Bhd MY 81.95.145.0 3 RBN RU 81.95.146.0 2 RBN RU 88.255.94.0 2 AbdAllah Internet Hizmetleri TR 91.193.56.0 2 Disk Limited TW As an example, all domain names which were used to host malware are now all located on UPL Telecom network. This network is in Czech Republic. It’s very interesting to note that cybercrime customers are not RBN addicted: when RBN become unavailable, they move in order to fulfil their malicious activity somewhere else (unless these hosting provider are already relating to RBN) 2. Changes in locations UPDATE: RBN is reported to have registered 7 net blocks of Chinese IP address and have relinquished it the day after [ 49 ] either by themselves or because efficient Chinese controls. Spamhaus has reported associated AS [ 50 ] and organization (Some hosting company can be identified as the same as in the above description of new domain hosting location). RBN will likely stay physically in Saint Petersburg in Russia as they may be politically protected. But they will for sure build a complex internet fog so that people believe RBN is dead although network traffic is directed to the same premises in Saint Petersburg. 49 http://www.computerworld.com.au/index.php/id;1151051570;fp;16;fpid;1 50 http://www.spamhaus.org/rokso/evidence.lassorokso_id=ROK7829 43
Page 1 and 2: Russian Business Network study Vers
Page 3 and 4: Version 1.0.1 RBN study - before an
Page 33 and 34: Version 1.0.1 New York,NY,US 10019
Page 35 and 36: Version 1.0.1 New York, NY 10018,-,
Page 41: Version 1.0.1 City map RBN study -
Page 47 and 48: Version 1.0.1 Filtering bad network
Page 53 and 54: Version 1.0 David Bizeul RBN study

Russian Business Network study - bizeul.org

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?