RBN Foiled again

[Merlyn]

http://www.theregister.co.uk/2007/11/13/rbn_quits_china/

snippet:

Infamous cybercrime hosting outfit Russian Business Network (RBN) has disappeared again, days after quitting Russia and setting up shop in China.

RBN obtained seven net blocks of Chinese IP addresses. Last Wednesday (8 November), some of RBN's clients began popping up on some of the 5,120 IP addresses it had acquired. But a day later China cut the connection to six of the seven net blocks controlled by RBN, once again forcing it offline.

------------------------------------------------------------------------------------------------------------------------

This is getting fun to watch

[GraemeL]

RBN obtained seven net blocks of Chinese IP addresses. Last Wednesday (8 November), some of RBN's clients began popping up on some of the 5,120 IP addresses it had acquired. But a day later China cut the connection to six of the seven net blocks controlled by RBN, once again forcing it offline.

They blocks are actually in RIPE address space (not APNIC as claimed by the article) and still seem to be allocated to RBN front companies. They all have registration addresses in China/Hong Kong/Taiwan and were being advertised via Chinese ASs (Spamhaus list).

Strange that the Chinese seem to be willing to host so many scams, but stopped advertising the RBN space so quickly.

If only somebody at RIPE would look into the companies behind the allocations and ask them to prove that they actually have legal business addresses (not PO boxes) in the RIPE area. If they don't, the allocations violate RIPEs own rules.

On the bright side, Yambo Financials may still be pumping out the spam, but their domains all resolve to RBN space that's not currently routable.

Edit to add:

Oops, forgot to mention that there is a blog dedicated to tracking the activities of the RBN.

[Merlyn]

Edit to add:

Oops, forgot to mention that there is a blog dedicated to tracking the activities of the RBN.

Thanks!