Controversial Russian Business Network drops offline
'Bulletproof' host struck down. For now
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
Russian Business Network (RBN) - the Controversial hosting firm fingered by many as a nexus of malware exploits and cybercrime more generally - has suddenly dropped offline.
Trend Micro reports that the infamous network dropped off the net at around 0200 GMT on Wednesday, possibly after its upstream service providers pulled its connectivity. "Since then, IP addresses of RBN can no longer be reached because there is no routing for them any longer," Trend notes.
RBN is notorious for hosting multiple instances of malware and web browser exploits. More recently it was fingered as the source of exploits based on a vulnerability in Adobe's Acrobat Reader. Its so-called "bulletproof hosting" facilities are also suspected of harbouring child pornography and phishing sites.
The Washington Post ran a high-profile expose of RBN's business back in October, a factor that may well have prompted its upstream providers, including Tiscali and Russia’s C41, to act.
The disappearance of RBN makes the internet a safer place, at least for now. Trend cautions that the respite may be temporary. "RBN may find new upstream providers. In recent weeks, moreover, Trend Micro has seen equivalents of RBN pop up in Turkey and Taiwan," Trend Micro security researcher Feike Hacquebord notes. ®
COMMENTS
@Pascal Monett
Actually, I never thought of it so it's good to read it here :)
It downloads the "Spamhaus Don't Route Or Peer List" parses the IP addresses and adds them to the firewall.
@Double Dekkers
You know, the guy who can understand what you wrote and what to do with it probably doesn't need to read it here in the first place.
Could someone translate that into English ?
This isn't a real hit for RBN...
Lets face it, they have more assigned IP's than just this one AS which doesn't get peered anymore.
AS40989 is gone, true:
http://www.cidr-report.org/cgi-bin/as-report?as=AS40989
Which gets rid of AS28866 (AkiMon), another of there networks, but what about AS41731/AS41173? They have a loads of ASN's, and simply blocking one range isn't going to really help.
This really isn't the last we will hear!
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Steps to Take Before Choosing a Business Continuity Partner
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
