Slashdot Mirror

← Back to Stories (view on slashdot.org)

Uncooperative Russian ISP Prevents Cisco From Shutting Down Cybercriminal Gang

Posted by ryuzaki0 on from the money-is-involved dept.

An anonymous reader writes: Cisco's Talos research team has managed to identify and partially shut down a cyber-criminal group that is using the RIG exploit kit to infect users with spambots via a malvertising campaign. Their investigation led them back to Russian ISP Eurobyte, who didn't bother answering critical emails and allowed the campaign to go on even today. In October 2015, Cisco's researchers also thwarted the activity of another group of cyber-criminals that made around $30 million from distributing ransomware.

66 of 122 comments (clear)

  1. Block all traffic to/from Russia and China. by Anonymous Coward · · Score: 5, Insightful

    I'm pretty sure I would never even notice, and the internet would be a safer place.

    1. Re:Block all traffic to/from Russia and China. by MouseTheLuckyDog · · Score: 2, Funny

      Where is Donald Trump when you need him?

    2. Re:Block all traffic to/from Russia and China. by FatdogHaiku · · Score: 2, Funny

      Where is Donald Trump when you need him?

      Building a wall around the internet... it's gonna be Huuuuuge!

      --
      You have the right to remain sentient. If you give up the right to remain sentient, you will be elected to public office
    3. Re:Block all traffic to/from Russia and China. by Anonymous Coward · · Score: 5, Interesting

      I run my own firewall and I actually did block, among some other areas, everything East from my country, including Russia. Whole of Asia, Africa, South America and Australia. The average attack attempts to my web servers dropped from hundreds per week to a couple per week. It's also really nice how you can block inbound and outbound or just inbound traffic.

    4. Re:Block all traffic to/from Russia and China. by qeveren · · Score: 2

      I'd miss all the insane dashcam and drunk Russian videos, though. :(

      --
      Don't just stand there, get that other dog!
    5. Re:Block all traffic to/from Russia and China. by Dahamma · · Score: 2

      I'd add: he's good at telling other people to build things with other people's money, so if the first other people screw up, the second other people are the ones losing their shirts, not him.

      That's the key to getting ultra-rich these days, especially in Wall Street - take a profit/bonus when things are good, let someone else take the loss when they are bad. Building something tangible along the way is incidental, and in fact usually just a distraction.

    6. Re:Block all traffic to/from Russia and China. by Dahamma · · Score: 1

      Eh, they are all hosted on Youtube, anyway. Let Google be your proxy...

    7. Re:Block all traffic to/from Russia and China. by myowntrueself · · Score: 4, Interesting

      I run my own firewall and I actually did block, among some other areas, everything East from my country, including Russia. Whole of Asia, Africa, South America and Australia. The average attack attempts to my web servers dropped from hundreds per week to a couple per week. It's also really nice how you can block inbound and outbound or just inbound traffic.

      And yet you let through traffic from the USA? The number one source of internet attacks?

      http://www.statista.com/statis...

      --
      In the free world the media isn't government run; the government is media run.
    8. Re:Block all traffic to/from Russia and China. by bloodhawk · · Score: 1

      yep, After all how could isolating yourself from one of the largest and fastest growing economies in the world with deep economic ties possibly affect you!

    9. Re:Block all traffic to/from Russia and China. by myowntrueself · · Score: 2

      Irrelevant when his stats proved that his measures are what were needed.

      which the actual stats call into question

      --
      In the free world the media isn't government run; the government is media run.
    10. Re:Block all traffic to/from Russia and China. by bloodhawk · · Score: 1

      stats from an AC, defended by an AC. Personally I will take the stats that actually have some evidence/proof behind them. We definitely see the most attacks coming out of Europe and the US for us (though we do see a lot from china, Russia and other eastern block countries too they pale in volume to what is coming from the cloud providers), the vast majority coming from cloud providers, for this reason we actually block most of the large cloud providers IP ranges like AWS, Azure, Rackspace etc.

  2. It's not their job to police their customers by Anonymous Coward · · Score: 1

    "This particular group used a series of security vulnerabilities, but most of the time, it was using the CVE-2015-5119 flaw in Flash, which allowed the group to compromise computers and later infect them with spambots. Cisco reports that, in most cases, the main payload was the Tofsee spambot variant, which infected Windows machines via Internet Explorer."

    That would make the ISP responsible for investigating Cisco's claim (which may be false), which means they'd have to hire techs and so on. If they shut the site down, and Cisco are wrong, they would face liability.

    Cisco would be better suing the ISP for the sites details, and then suing the site owners in the court.

    *However*, this is a flash exploit and an Internet Explorer exploit, and the fix is for Adobe and Microsoft to fix their shit, because even if the ISP does shut this down, it will be like playing wack-a-mole. As long as the vulnerability exists, it will be exploited, not just by spammers but by malicious governments like UK and US, China, Russia the lot.

    1. Re:It's not their job to police their customers by Dahamma · · Score: 3

      Cisco would be better suing the ISP for the sites details, and then suing the site owners in the court.

      In Russian courts. Good luck with that. The hackers are probably protected and/or financed by the Russian mafia, which means they are effectively protected by the Russian government.

      They are better off convincing US or EU organizations the ISP is refusing to shut down known criminals, and getting the ISP blocked from Western countries/ISPs. Like most things of this nature, morality and politics are useless, it's only going to be fixed when it affects their wallet...

    2. Re: It's not their job to police their customers by grfrkr · · Score: 1

      In Russian courts. Good luck with that.

      Have those researchers ever tried to contact Roscompozor?

  3. who made cisco police, judge, and jury? by sittingnut · · Score: 2, Insightful

    cisco is not responsible for policing the net, nor is it legally able to interpret law, and has no power whatsoever to enforce it. this seems to be pure vigilantism at best , and no different from actions of a criminal gang at worst.
    let legitimate law enforcement do their job following due process. if they are behind the times that a function of freedom and speed of progress.

    should any one trust cisco? same that allows and cooperates with the illegal surveillance by nsa etc?

     

    1. Re:who made cisco police, judge, and jury? by turbidostato · · Score: 1

      "cisco is not responsible for policing the net, nor is it legally able to interpret law, and has no power whatsoever to enforce it."

      And even if it had, it would be in USA. Russia, you know, is a different country, with different authorities and different laws. What would your average USA company do if it recieved a requirement from a private company from another country but exactly the same?

    2. Re:who made cisco police, judge, and jury? by FilatovEV · · Score: 1

      The difference is the Russian government doesn't even bother hiding its support for the Russian oligarchy aka mafia.

      But the real question is, why that did not concern you in 1990s, when Russia resembled the oligarchy/mafia-run state the most? Some sort of a 15-years lag in perception? I remember talking to Americans in early 2000s and they believed Russia was about the Communism. Now it's 2016 and you believe Russia is about the Oligarchy/Mafia. Hopefully you learn something in the next 15 years. ;-)

    3. Re:who made cisco police, judge, and jury? by KGIII · · Score: 1

      I can only suggest that you not take your limited exposure and extrapolate it to make assumptions based on everyone. That's not a very good method for drawing reasonable conclusions.

      --
      "So long and thanks for all the fish."
    4. Re:who made cisco police, judge, and jury? by FilatovEV · · Score: 1

      I can only suggest that you not take your limited exposure and extrapolate it to make assumptions based on everyone. That's not a very good method for drawing reasonable conclusions.

      Surely. And I can only humbly suggest that you more better appreciate sarcasm.

  4. Web developers and website owners: by Anonymous Coward · · Score: 2

    Remember this when I leave your website or refuse to turn off my ad blockers.

  5. Holidays by Anonymous Coward · · Score: 4, Informative

    You won't find any Russian business that would respond to inquiries this week (with the exception of employees working from home even though they shouldn't). Reason: all Russians have official holidays that started on January 1 and will end on January 11.

    1. Re:Holidays by Vadim+Makarov · · Score: 1

      Mod the parent up. It's the same as trying to get a response from China during the Spring Festival. Russians are fully at work all the way up to mid-day 31 Dec (so to say everybody is available through Western Christmas time), then everything is dead for 10 or so days till mid-January.

      --
      17779 eligible voters in a district, 17779 'vote' as one. This is Russia.
    2. Re:Holidays by Jiro · · Score: 3, Informative

      TFA shows that researching the malware was done during the months of September and October 2015. It seems unlikely they would wait until New Years to contact the ISP.

  6. Adblock folks by Billly+Gates · · Score: 5, Insightful

    I tell everyone I know to use them.

    Advertisers either fix your shit or loose out? If you can't regulate yourselves in regards to 3rd party networks and ethical ads then you will be out of business.

    Fact of the matter is it is too dangerous to run without one. That should go right up there with browsing the net as administrator or root and using IE 6 these days.

    Also for those who say they are safe as long as they don't click or run anything, all I can say is told you so! Open a page with flash and your 0wned. Simple

    --
    http://saveie6.com/
  7. Come on by Hognoxious · · Score: 4, Funny

    Russia needs the money. Even the president can't afford a shirt.

    --
    Confucius say, "Find worm in apple - bad. Find half a worm - worse."
    1. Re:Come on by Hognoxious · · Score: 1

      Does USA have enough gold and other valuables to exchange for all dollars it has ever issued?

      Why are you even asking? It's the 21st century, not the 19th.

      One other thing: whooooosh!

      --
      Confucius say, "Find worm in apple - bad. Find half a worm - worse."
    2. Re:Come on by KGIII · · Score: 1

      How can you be sure? Well, you could try measuring it and then weighing it. 'Snot really complicated. Tungsten, by volume, has a different weight than gold. That's why you're not in charge.

      --
      "So long and thanks for all the fish."
  8. Good luck with that by mrsam · · Score: 4, Insightful

    Bet a hundred quatloos that this so-called "ISP" are the malware peddlers themselves. Either that, or they know fully well who their customers are, and they interpret Cisco's communications as nothing more than a request to shut down a well paying customer.

    This is not a unique phenomenon. This is a fairly common reaction to abuse and spam complaints. You want us to shut down a paying customer? Why would we want to do that?

    The key to effectively deal with network abuse is to make the responsible party understand that it's in their best interest to do that. Otherwise they stand to lose more than they are profiting from network abuse. As long as effective public email blacklist exist, network providers will have to reluctantly terminate their spambags, else their entire network gets blacklisted and they lose more, as their other, non-spamming pissed off customers flee to other providers, in order to be able to send mail.

    The same thing here. Presuming that this is a bone-fide provider, and not a sock puppet for the malware peddlers, the appropriate step of action is to escalate to their upstream, and attempt to get their cooperation, and have them agree to terminate the circuit to their rogue downstream provider, unless they get rid of the spamware peddlers. And keep escalating upstream, as far as necessary. Now, we're talking Cisco here, right? Well, it shouldn't take long before Cisco ends up talking to someone that uses their hardware in their core business. At this point, it's now going to be up to Cisco to put up and shut up, and inform their customer that unless this is dealt with, they will respectfully decline to renew their own customer's support contracts.

    Could this sequence of events actually come to fruition? Extremely unlikely, but this is the only way to effectively deal with network abuse.

    1. Re:Good luck with that by JustAnotherOldGuy · · Score: 1

      Bet a hundred quatloos that this so-called "ISP" are the malware peddlers themselves. Either that, or they know fully well who their customers are

      Yep, that would be my guess. It's by far the most likely explanation- they're either the peddlers themselves or they're partners with them.

      --
      Just cruising through this digital world at 33 1/3 rpm...
    2. Re:Good luck with that by Da+w00t · · Score: 2

      Actually, a lot of them aren't paying customers. Well, they do pay, but with fraudulent credit cards, so the ISPs a lot of times are out a wad of cash.

      --

      da w00t. mtfnpy?
    3. Re:Good luck with that by turbidostato · · Score: 1, Insightful

      "This is not a unique phenomenon. This is a fairly common reaction to abuse and spam complaints. You want us to shut down a paying customer? Why would we want to do that?"

      Why should it be any other way? Note the requestor is another company, not a legal authority, and it comes from a different country.

      We should, in fact, be very much worried if it happened any different.

      "As long as effective public email blacklist exist, network providers will have to reluctantly terminate their spambags"

      Of course yes, why the hell go throw the worries of having a legal system and legal forces to enact it when we can have some random vigilante telling apart what can and cannot be done.

    4. Re:Good luck with that by N1AK · · Score: 2

      Of course yes, why the hell go throw the worries of having a legal system and legal forces to enact it when we can have some random vigilante telling apart what can and cannot be done.

      I let people into my house based on who I trust, recommendations from trusted sources etc. You might see that as random vigilantism but the government doesn't offer it, nor do I desire it to, provide recommendations on every individual. You don't have a legal right for your emails to reach me etc so why the hell would the legal system be the right place to decide whose emails I should accept.

    5. Re:Good luck with that by sjames · · Score: 1

      We're missing a lot of information here. Did Cisco email them in Russian? Did they ask nicely or post demands? Did they provide any evidence in the email?

      Depending on the nature of the bad guys, we also have to consider that there could be consequences well beyond loss of a few accounts if they shut them down.

    6. Re:Good luck with that by quantaman · · Score: 1

      The key to effectively deal with network abuse is to make the responsible party understand that it's in their best interest to do that. Otherwise they stand to lose more than they are profiting from network abuse. As long as effective public email blacklist exist, network providers will have to reluctantly terminate their spambags, else their entire network gets blacklisted and they lose more, as their other, non-spamming pissed off customers flee to other providers, in order to be able to send mail.

      The problem is that punishment is so severe that other ISPs will be very reluctant to use it so it's basically an empty threat.

      Traffic degradation, reducing the bandwidth for packets directed towards misbehaving ISPs, now that's a little easier to sell and could again be very effective.

      Of course this is running right into the net neutrality debate and goes under the heading of "be careful what you wish for". We want to shut down the cybercriminals, others want to shut down the torrent servers, and some even want to shut down wikileaks.

      --
      I stole this Sig
    7. Re:Good luck with that by mrsam · · Score: 2

      Of course yes, why the hell go throw the worries of having a legal system and legal forces to enact it when we can have some random vigilante telling apart what can and cannot be done.

      This phenomenon is called "free speech", perhaps you've heard of it. Anyone is free to say, on their web site, whether a particular sender's email should be accepted or rejected, and why. And it goes without saying that everyone else is free to either agree, or disagree and continue to use their own internal policy for email acceptance or rejectance.

      I have found that these cries of vigilantism tend to come from those who have a peculiar belief that these so-called vigilantes have somehow hacked into million of email servers worldwide, hijacked them, and reconfigured them to reject email from the targets of those vigilantes' wrath. This is, of course, utter horseshit. The individual owners and operators of all those millions of email servers have specifically and intentionally configured their mail servers to follow the recommended mail acceptance policy of their chosen third-party blacklist. Nobody held a gun to their head, and forced them to do so. They own their email servers. They pay their electricity and bandwidth bills, and they have every right to configure them in whatever way makes them happy.

      And the so-called "legal system" is 100% behind them. Fortunately, at least in the Western world, private property rights still enjoy 100% backing of the legal system. I have never read of any legal decision, that survived an appeal, which forced the owner of the email server to accept or reject email from anyone they wish, for whatever reason pleases them, and on whatever it was based on. Quite the opposite -- there's actually established case law that determined that privately-owned Internet providers are free to blacklist anyone, and for any reason, which includes third-party blacklists, which I'll be happy to cite.

      That is the cold, hard truth: nobody has a civil right to email anyone, and every other privately-owned email server operator is free to refuse to accept email from anyone, for any reason. Whether it was due to their own decision, or by delegating this decision to a third-party blacklist. That delegation, after all, is still their own decision to make. Like I said, it is their email server, and they have full control of it. And it they decide to delegate some control over their email server to a third party, they are 100% within their rights to do so. And neither you, nor any other spamming parasite, can do anything about it.

    8. Re:Good luck with that by turbidostato · · Score: 1

      "This phenomenon is called "free speech", perhaps you've heard of it."

      I certainly do.

      "Anyone is free to say, on their web site, whether a particular sender's email should be accepted or rejected, and why. And it goes without saying that everyone else is free to either agree, or disagree and continue to use their own internal policy for email acceptance or rejectance."

      Yes. And that's vigilantism, and it usually ends the way it usually ends.

      My (strong) bet is that, if you are using any kind of blacklisting software you don't really know who are you blocking and why.

    9. Re:Good luck with that by mrsam · · Score: 1

      You call it "vigilantism", I call it free speech.

      My (strong) bet is that, if you are using any kind of blacklisting software you don't really know who are you blocking and why.

      So, you think you know more about someone who employs blacklisting, then they themselves. There's a word for that too. Actually two words: "arrogant elitism". You think you're smarter than everyone else, and that you know more about blacklists then the individual organizations who use them. That is, of course, a height of arrogance.

      No, I'm afraid you're not smarter than everyone else. Sorry to be the bearer of bad news.

    10. Re:Good luck with that by turbidostato · · Score: 1

      "So, you think you know more about someone who employs blacklisting, then they themselves."

      Yes, I do. You see, I said "my (strong) bet": I'm pretty confident, not sure.

      "There's a word for that too. Actually two words: "arrogant elitism"."

      No, a single word is good enough: "experience". I usually work on email exchange platforms (not Microsoft Exchange, but SMTP hubs and smarthosts) and since my experience has been most postmasters using blacklists don't exactly know what emails are denying and why, betting the same case here is quite safe.

    11. Re:Good luck with that by mrsam · · Score: 1

      And how exactly did you determine the state of their mind, and what they do or do not know?

      "Gee, all of a sudden my mail server acquires this mysterious configuration setting that rejects mail from all IP addresses on this particular blacklist. I have absolutely no idea where it came from..."

    12. Re:Good luck with that by turbidostato · · Score: 1

      "And how exactly did you determine the state of their mind, and what they do or do not know?"

      Just like any other would do: interacting with them and paying attention both at their discourse and their facts.

      "Gee, all of a sudden my mail server acquires this mysterious configuration setting that rejects mail from all IP addresses on this particular blacklist. I have absolutely no idea where it came from..."

      That's basically the case more times than not. Long story short, too many times it goes more or less like this: "So, why is this IP-block exactly blocked? Uhhh... Because it is in the list from the service I use?"

  9. There is a saying in Russia by Trachman · · Score: 1

    There is a saying in Russia, which says that Russians do not give away Russians.

    This is a cliche statement, which reflects the mentality of how some of the Russians are taught and trained themselves to believe of anyting non Russian related. Here is the caricature of Russian mentality which summarizes how they want to view you: https://www.facebook.com/photo...

    Jokes aside, in United States if somebody would want some law enforcement to give away their informers, we would say: screw you.

    1. Re:There is a saying in Russia by Opportunist · · Score: 1

      You might have to provide subtitles to that illustration to let non-Russians understand it.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    2. Re:There is a saying in Russia by Teun · · Score: 1

      The picture speaks for itself :)
      The sign points to the grey side as 'Abroad' and the colourful side as 'Homeland'.
      That's where the Russian bears live...

      --
      "The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."
    3. Re:There is a saying in Russia by Indigo · · Score: 1

      That's just beautiful. Naturally, every country in the world has their own version of this :-)

    4. Re:There is a saying in Russia by Opportunist · · Score: 2

      It's heartwarming to see that Russia and the US share some traits at least.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    5. Re:There is a saying in Russia by wisnoskij · · Score: 1

      Is that father bear pointing to some sort of globe shaped Russian space ship? Or WTF is that supposed to be?

      --
      Troll is not a replacement for I disagree.
    6. Re:There is a saying in Russia by Teun · · Score: 1

      Looks like the original Sputnik.

      --
      "The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."
    7. Re:There is a saying in Russia by Opportunist · · Score: 1

      You know that this is asking for a "your mom" joke, right?

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
  10. Re:Block their asses by Opportunist · · Score: 2

    What did Canada do to end up on that list?

    The only thing I can see in common in those three is that they consistently whoop the US's ass in ice hockey.

    --
    We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
  11. Re:Corruptionstan... by Thor+Ablestar · · Score: 3, Funny

    If you cannot contact an ISP, you can contact Roskomnadzor. If you cannot contact Roskomnadzor you always can contact a FSB (KGB) because it's FSB that ultimately manages our information security and is basically somehow immune to bribes. Especially if you are Cisco.

  12. No problem by PPH · · Score: 1

    Just push a mod to the BGP tables. Problem goes away.

    --
    Have gnu, will travel.
    1. Re:No problem by dstrupl · · Score: 1

      Yup, that is what they actually did (as figured after RTFA). They have blacklisted both the IPs and domains served by that provider for all Cisco and their customers. So no big deal at the end of the day.

  13. Re:Bulletproof hosting by Thor+Ablestar · · Score: 2

    It does not matter what does it host, be it CP, Mein Kampf or just a botnet. It either cooperates with Roskomnadzor, FSB and Department R (Or maybe K, I cannot remember) in catching or at least suppression of criminals, or loses it's license.

  14. Email - or spam? by petes_PoV · · Score: 3, Insightful

    who didn't bother answering critical emails

    I don't answer critical emails either. However, if you send me nice ones, or polite ones I might even read them.

    You'd think that if this was something SERIOUS for Cisco, they'd at least bother to pick up the phone - maybe even go to the effort of finding someone who spoke russian. As it is, this outfit, like everyone else on the planet probably gets spammed senseless. Especially through public email addresses. Who can blame someone for ignoring emails from unsolicited sources?

    To sum up, this sounds like the lazy excuse of an indolent individual: Why haven't you done X? asks the boss. "Well I sent them an email, but they never replied" whines the guy who just wants to get back to playing Facebook.

    --
    politicians are like babies' nappies: they should both be changed regularly and for the same reasons
    1. Re:Email - or spam? by thoughtlover · · Score: 1

      Cisco's researchers also thwarted the activity of another group of cyber-criminals that made around $30 million from distributing ransomware.

      When stupid amounts of untraceable money is involved, the inside-job becomes more of a reality.

      --
      No sig for you! Come back one year!
  15. Uncooperative? by jbmartin6 · · Score: 1

    Sounds like the ISP is very cooperative, just not with who the submitter would like.

    --
    This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
  16. What autority is cisco operationg from by Revek · · Score: 1

    Seriously, if cisco approached me about a criminal matter I would ignore them to. They have no legal authority to demand anything from anyone.

    1. Re:What autority is cisco operationg from by feenberg · · Score: 1

      No one is obliged to accept their packets, and anyone is entitled to take Cisco's advice if they so choose.

      The point isn't that they should obey Cisco, but that they should not want to host criminal activity, and if informed of it they should investigate and take action if warranted. Furthermore, it is in their interest to do so, since otherwise other networks will stop exchanging packets with them, and their non-criminal clients will be disadvantaged and leave. Of course, that assumes they have non-criminal clients.

      daniel feenberg

  17. Re:Block their asses by Revek · · Score: 1, Informative

    No, blame Canada, blame Canada
    With all their beady little eyes
    And flappin' heads so full of lies

    Blame Canada, blame Canada
    We need to form a full assault
    It's Canada's fault

  18. It's still holidays in Russia by Shalcker · · Score: 1

    Entire 1-10 January is holiday due to weekends configuration this year. Almost noone works while it happens. So obviously noone is available to respond to Cisco complaints either.

  19. Is anyone surprised? by smooth+wombat · · Score: 1

    Who do you think hit the Ukrainian power network the other week? Who do you think regularly attacks Ukrainian government web sites? Who do you think allows the army of Russian trolls located in St. Petersburg to remain active to spew their nonsense?

    If anyone is surprised the Russians don't respond to close down hackers emanating from within their borders, they've been living under a rock for the last decade. This is what Russia is now known for, other than collapsing economy and a ruble not far behind. They have nothing else and the only way to take their minds off the problems Heir Putin has created is to blame someone, anyone, for their self-inflicted problems.

    After all, they need to do something to cover up the roughly 2,000 dead Russian soldiers who have died invading Ukraine, the money they're losing as Putin tries to prop up the dictator Assad, not to mention the terrorists in East Ukraine who have literally destroyed everything they touch. As Russia begins to run out of money towards the end of this year, be prepared for an even bigger onslaught of trolls as their desperation becomes frenetic.

    --
    We will bankrupt ourselves in the vain search for absolute security. -- Dwight D. Eisenhower
  20. 46.30.40.0/21 by Dynamoo · · Score: 2
    Curiously enough, I am just running an analysis of several thousand domains hosted by Eurobyte. My preliminary data on about 7500 domains currently or historically hosted by this block is that 35% of them are tagged by Google as being malicious in some way. I'm guessing that most of the others are also malicious, but they haven't been tagged.

    Eurobyte operate a fairly big block rented from Webazilla, which is 46.30.40.0/21.. and I recommend that you block traffic to that entire lot. But a lot of Webazilla's other customer are pretty shitty too. I don't think you miss much if you blocked traffic to the entire AS35415.

    --
    Never email donotemail@WeAreSpammers.com
  21. sounds like standard ISP behaviour by bloodhawk · · Score: 1

    We see the same behaviour regardless of country. In Australia the only way we were able to get anything more than a generic response was by reporting it through ASD, With the US we have never managed to get a response from ISP's there, we just forward to the US authorities now and hope they deal with it. Basically unless you are coming through the local government then you are fucked getting just about ANY ISP to do anything useful.

  22. Re:CC: Interpol by KGIII · · Score: 1

    Absolutely. You, and your business, should do exactly that.

    --
    "So long and thanks for all the fish."
  23. It's called bulletproof hosting by drolli · · Score: 2

    and nothing new. You pay a little premium not to be disconnected as soon as somebody sends a legal request. Not reacting to something like that is what their customer pays for.

  24. Re: It would collapse US company profits. by WaterWalkerTCF · · Score: 1

    No Russian criminals aren't smarter, they just don't have federal groups throwing them in jail so they can get away with more.