US RBN ...Atrivo-Intercage

FYI…

- http://voices.washingtonpost.com/securityf…t_as_major.html
August 28, 2008 - "…Several noted security researchers are releasing a report* today that stems from many months of investigating malicious activity emanating from Atrivo's customers. Security experts say that Atrivo, also known as Intercage, has long been a major source of spyware, adware, viruses and fake anti-virus products… Looking back several years, Atrivo's various networks were used heavily by the Russian Business Network, an ISP formerly based in St. Petersburg, Russia. RBN had gained notoriety for providing Web hosting services catering exclusively to cyber criminals. But after increased media attention, RBN dispersed its operations to other, less conspicuous corners of the Internet. The portions of Atrivo most heavily used by RBN were Hostfresh - which provides routing for Atrivo through Hong Kong and China - and UkrTeleGroup (also known as Inhoster) out of Ukraine. These two networks remain core components of Atrivo's operation, and recent data suggests the company's reputation for supporting online criminals hasn't diminished since the disappearance of the RBN last year…"

- http://asert.arbornetworks.com/2008/08/atr…-out-as-us-rbn/
Aug. 30, 2008 - "A report* from a trio of known open source security analysts is out and covers the US-based Atrivo, aka Intercage. Dubbed the “US RBN” by some, Atrivo has been, to quote someone in the business:
"At almost every Internet security conference, or law enforcement seminar on cyber-crime, a presentation will detail some attack, exploit, phish or financial crime that has some nexus at Atrivo/Intercage.” Source: Vincent Hanna, Spamhaus.org**…
we’ve been seeing a lot of Atrivo over the years: rogue DNS servers that will send the user to a malicious website if they should typo, configured through DnsChanger malware; lots of fake AV product hosting lately; malcode drops and pickups. Our database is full of these droppings of information. The fact that this network is supposedly hosted in the US – in the bay area, in fact – is especially surprising. It is unclear to me why they were permitted to operate without any significant investigation by law enforcement…"

* http://hostexploit.com/index.php?option=co…2&Itemid=15

** http://www.spamhaus.org/news.lasso?article=636
2008-08-29 - "…Spamhaus has dealt with over 350 incidents of cyber-crime hosting on Atrivo/Intercage and its related networks in the last 3 years alone, all of which involved criminal operations such as malware, virus spreaders and botnet command and control servers…"

<_<

FYI…

Atrivo/InterCage - Malware Haven
- http://www.shadowserver.org/wiki/pmwiki.ph…lendar.20080906
6 September 2008 - "… we decided to do a little digging from our own data to see what we could come up with. Given that we have been familiar with Atrivo for some time, what we found was not a huge surprise. However, we thought we would provide some more information for anyone that was interested or that was still skeptical. The following information comes right from our own databases and is based upon searches for the ASN 27595 which belongs to Atrivo.
Atrivo/InterCage - ASN 27595:
—————————–
Unique MD5 samples making HTTP connections: 22,626
Number of HTTP DDoS botnets (by unique IP) we have observed: 3
Number of DDoS attacks (by unique IP) from it we have observed: 10
Number of DDoS attacks (by unique IP) against it that we have observed: 26
In plain English this means that we have 22,626 different binaries that made some sort of HTTP-based connection to Atrivo's ASN. The vast majority of our binaries are quite malicious. At least three HTTP-based DDoS botnets we monitored were housed on Atrivo's ASN. From these three different HTTP-based DDos botnets we saw at least ten different attacks issued… As you can see, they have quite a bit of malware talking to them, which in turns mean it has a lot of malware and control centers on it as well. Atrivo ranks #12 on our unique MD5 list by ASN. There are only 11 other ASNs that have more malware making HTTP connections to it than Atrivo. It would appear we still have some work to do, but since one of the top 20 is the center of attention right now, we thought we would throw in our two cents. Finally, we are not saying that all systems or activity on Atrivo's ASN are malicious. However, our data along with the data of others clearly indicate that there is a significant amount of malicious activity going on there that is certainly of concern."

FYI…

- http://voices.washingtonpost.com/securityf…history_an.html
September 8, 2008 - "…for years EstDomains appeared to be the registrar of choice for the infamous Russian Business Network. You could hardly look up malicious Web site hosting nasties like -CoolWebSearch- and other spyware programs without finding records that traced back to EstDomains. That is, until the RBN's disappearing act late last year, when this publication and others began exposing RBN's ties to child pornography and financial fraud Web sites. While the RBN may have faded into the background, experts say EstDomains still remains among the top registrars for spam and scam Web sites, as well as child pornography. Working with several security experts who help law enforcement officials track down child porn sites, Security Fix identified at least two Web sites registered through EstDomains that are currently selling access to child porn… In a blog post* last month about the relationship between EstDomains and Atrivo, anti-spam organization Spamhaus.org suggested law enforcement action against the two entities was long overdue…"
* http://www.spamhaus.org/news.lasso?article=636

FYI…

Intercage gone dark…
- http://www.theregister.co.uk/2008/09/22/intercage_goes_dark/
22 September 2008 - "California-based network provider Intercage has gone completely offline following weeks of scathing criticism that it hosts an inordinate number of sites engaged in phishing, malware propagation, and other illegal activities. Pacific Internet Exchange, which only began providing upstream service to Intercage in the last week or so, pulled the plug on Saturday night… It's a safe bet that PIE's move was in response to recent efforts to isolate Intercage following a report that it enables a rogue's gallery of customers to punt spam, malware, and online (illegal) pharmaceuticals… "This is an excellent example of community effort involving a wide cross section of anti-spammers, malware, and botnet researchers, journalists, and Internet network operators," an entry on the Russian Business Network blog* stated…"
* http://rbnexploit.blogspot.com/2008/09/rbn…-goes-dark.html

More…

- http://blog.trendmicro.com/rogue-dns-netwo…host-goes-dark/
Sep. 23, 2008 - "…We checked what happened with the rogue DNS network of ZLOB after Intercage went offline. Last week we counted 1178 live rogue DNS servers related to ZLOB. These rogue DNS servers resolved more than 14,000 domain names (including high profile sites and major search engines) to 200+ malicious IP addresses. After Intercage disappeared from the Internet we looked again: since last Sunday 655 rogue DNS servers are down. Many spoofed sites related to ZLOB disappeared too because they were all hosted by Intercage.

On Monday we noticed a very slow recovering of the rogue DNS network. Some of the spoofed search engine web sites became live again, but now in a different data center on the East coast of the US operated by Cernel.net. We expect that in the coming days more of the rogue DNS network of ZLOB will move elsewhere, simply because the bad guys do not want to miss their ill gained revenues."

FYI…

Intercage back online…
- http://www.theregister.co.uk/2008/09/24/in…ge_back_online/
24 September 2008 - "…IP transit provider UnitedLayer agreed to provide upstream service to Intercage about 36 hours after its last transit provider pulled the plug. UnitedLayer's move, which is sure to prove unpopular in some circles, came after Intercage agreed to completely sever ties with Esthost, the Eastern European web host believed by many to be responsible for the lion's share of abusive traffic carried by Intercage. The dumping of Esthost, if true, would mark a major turning point for Intercage. Esthost, which according to many researchers hosts a large number of sites engaged in phishing, malware propagation, and other illegal activities, has relied on Intercage since 2004 and is responsible for 25 percent to 50 percent of its revenue… Over the past few weeks, the Intercage saga has at times resembled the wild west, where justice is meted out by an informal network of power brokers rather than duly appointed officials. Given the frequent inability of today's law enforcement in overcoming a rat's nest of extra-territorial and technical issues, this form of frontier justice is probably unavoidable. And in any case, the vast majority of the white hats manning the system are honest and have netizens' best interests at heart. Still, the arrangement has sometimes made us uncomfortable, because it seems fraught with the potential for abuse by copyright holders, repressive governments and others…"

FYI…

Intercage goes dark again
- http://www.networkworld.com/news/2008/0926…rk.html?hpg1=bn
09/26/2008 - "…After being notified of more problems on the network this week, UnitedLayer pulled the plug on Intercage late Thursday afternoon, said UnitedLayer Chief Operating Officer Richard Donaldson. "We decided that, given the stuff that was going on and with a couple of infractions that we were made aware of, that they needed to purge themselves of any [malicious] stuff that remained," he said. Even though UnitedLayer had been peering with Intercage and providing it with Internet connectivity since Monday, computers on the Intercage network were largely out of reach to most Internet users. That's because UnitedLayer's own upstream provider, Global Crossing, had been blocking traffic from Intercage's address space…"

<_<

FYI…

- http://asert.arbornetworks.com/2008/10/tim…ng-dissolution/
October 1, 2008 - "…no one is behind bars for what appears to have been blatantly criminal software that was hosted on this network; no one knows who was behind the operation’s malicious “customers”; no one has investigated this, it seems. And now the badness is popping up elsewhere. We’ll have to continue to monitor this one and map the badness. We now know more rogue networks that are welcoming the hosting, and so this cycle will start again. This is not a long-term victory."