Fergie's Tech Blog

Danchev: More Russian Criminal Activity in The Usual Places

Dancho Danchev:

Apparently, a little more in-depth research acts as public pressure, especially when they're lazy enough to have a great deal of malware variants "phone back home" to their promotional domain.

However, the current one responding to 67.228.69.191 is hosted by SoftLayer, and is using ns1.4wap.org as DNS server provided by Layered Technologies again confirming the Russian Business Network connection since, both, Layered Technologies and SoftLayer are known to have been and continue providing services to the RBN, knowingly or unknowingly. Moreover, the malware infected counter at the stats section continues reporting new additions.

More here.

Note: I have repeatedly notified both Layered Technologies and SoftLayer on malicious (and criminal) activities occurring in their IP address space (their hosting facilities), but it continues to happen on a regular basis (for over a year). Apparently, they don't seem to police their own backyards, so it might be worthwhile to consider blocking these IP blocks until they clean up their act.

See also here.

- ferg

posted by Fergie @ 3/11/2008 08:32:00 PM