Jump to content

RBN Foiled again


Merlyn
 Share

Recommended Posts

http://www.theregister.co.uk/2007/11/13/rbn_quits_china/

snippet:

Infamous cybercrime hosting outfit Russian Business Network (RBN) has disappeared again, days after quitting Russia and setting up shop in China.

RBN obtained seven net blocks of Chinese IP addresses. Last Wednesday (8 November), some of RBN's clients began popping up on some of the 5,120 IP addresses it had acquired. But a day later China cut the connection to six of the seven net blocks controlled by RBN, once again forcing it offline.

------------------------------------------------------------------------------------------------------------------------

This is getting fun to watch :lol:

Link to comment
Share on other sites

RBN obtained seven net blocks of Chinese IP addresses. Last Wednesday (8 November), some of RBN's clients began popping up on some of the 5,120 IP addresses it had acquired. But a day later China cut the connection to six of the seven net blocks controlled by RBN, once again forcing it offline.

They blocks are actually in RIPE address space (not APNIC as claimed by the article) and still seem to be allocated to RBN front companies. They all have registration addresses in China/Hong Kong/Taiwan and were being advertised via Chinese ASs (Spamhaus list).

Strange that the Chinese seem to be willing to host so many scams, but stopped advertising the RBN space so quickly.

If only somebody at RIPE would look into the companies behind the allocations and ask them to prove that they actually have legal business addresses (not PO boxes) in the RIPE area. If they don't, the allocations violate RIPEs own rules.

On the bright side, Yambo Financials may still be pumping out the spam, but their domains all resolve to RBN space that's not currently routable.

Edit to add:

Oops, forgot to mention that there is a blog dedicated to tracking the activities of the RBN.

Edited by GraemeL
Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

×
×
  • Create New...