Spyware Warrior

olliver · Posted: Tue May 12, 2009 11:59 am Post subject: RBN block recycled by ThePlanet

Remember the darkest corner on the Internet run by an entity from in St Petersburg, Russia called Russian Business Network? They had a famous RIPE allocation, probably the most widely firewalled/null routed address range in the history of web:
81.95.144.0/20

In the meantime, the address range has been returned to RIPE, so that it is no longer a danger. But it might be a nuisance to unsuspicious ThePlanet customers who fell for the "rent a server in Europe" offer:

sotet · Posted: Fri Jul 17, 2009 9:44 am Post subject:

Interesting post, I was not aware of this netbock at ThePlanet but I know a few things about the RBN.

I know ThePlanet takes phishing sites down quickly as I report them, but as a very large dedicated hosting provider, they have attracted some bad apples just as some other large hosting companies like Softlayer or Rackspace.

I just hope these companies and others can be more vigilant in getting rid of very bad customers, even those that are paying substantially. I do realize that the larger customers are harder for them to get rid of because of what they spend, but it does not excuse allowing awful internet abuse to continue on their networks. Spamhaus puts the pressure on these ISPs in some extreme cases to get rid of the cybercriminals by implementing larger blocklistings on the SBL.

BTW: this blog entry about the RBN by Brian Krebs from October 2007 gives some background to your post:

http://voices.washingtonpost.com/securityfix/2007/10/mapping_the_russian_business_n.html

olliver · Posted: Sat Jul 18, 2009 1:14 pm Post subject:

Well, the outcome of your reports strongly depends on the customer's hosting plan. Things can become quite frustrating if the spammer rents his/her own SWIP from a reseller of The Planet. Then you can happily join the "chase down the customer's customer of a customer" game and be sure that any complaints will be intercepted by the spammer, perhaps claiming that the problem has been resolved - which means to swap the ip address of the mail-sending interface with an unused one. In situations like this, it's better to just add another firewall rule and move on - unless you are from the likes of Spamhaus, with established relationships to abuse desks.

O.
_________________
Petcord netlabel :: Synflict post-digital arts :: Leftob audio cast
Each click on any of the links above will save the life of a cute kitty somewhere in the universe.