RBN – 76 Service Team, Loads cc, and cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365ir location

Although most report cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 Russian Business Network (RBN) has disappeared, this RBN watch-blog still follows its active domains, its “retail division”. In a follow up to an earlier article on 76 Service, Gozi, hang Up Team and US Hosting, same business just different location and an added common thread.



Fig 1. Common thread – cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 RBN’s slogan?


76 Service is now 76 Team.com (click on pic to see detail)

Fig2. Current 76 Service user landing page

As we can see although using a new domain it still displays cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 familiar RBN “76 Service” branding. Just to remind ourselves subscribers to 76 service can log in, pull down cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 latest drops, i.e. data deposits from cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 Gozi-infected machines cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365y subscribed to, e.g. 3.3 GB one containing more than 10,000 online credentials (ID cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365ft) taken from 5,200 PCs.




Loads.cc (click on pic to see detail)

Fig3. Loads.cc – Order page


As reported Loads.cc allows less technically proficient cyber-criminal affiliates to "cash in”, cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 site provides information on cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 availability and size of cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 botnet in real-time. Although it has been seen this method is different from that of ocá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365r similar schemes, such as 76service whereas Loads.cc allows you to pay to infect computers.







Common Thread?

  • 76 Team (back1.76team. com or bavk1.76team.com) – IP = 208.72.170.189 = AS 26780 MCCOLO - USA
  • Loads.cc – IP = 212.24.53.4 AS 15756 CARAVAN ISP "CARAVAN" Moscow, RU
Although cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 two sites appear dissimilar we have to dig a little deeper , examine cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 next two figures


Fig 4 (a) 76 Service / Team Name servers (click on pic to see detail above)



Fig 4 (b) Loads cc Name servers (click on pic to see detail above)



The common thread is in two parts:

  • Loads.cc infects cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 PCs, 76 Service / Team sells cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 IDs from those same infected PCs.
  • Also as figs 3 & 4 show cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 common name servers i.e. orderbox-dns and optical jungle with corresponding IP ranges, both within AS30315 and AS31898. These two domain ranges are part of Resellerclub and Logic boxes, which in turn is owned by Directi.com.


Directi is a very fast growing web hosting and reseller based in India. From its own literature it places a value of $300 million. The slogan in Fig1 is from Directi, and we hope does not reflect cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 RBN’s constant aim.

Infrastructure:
  • Directi has offices in India and UAE
  • The new Directiplex, being designed by Hafeez Contractor, a $25 million facility with a capacity of 1700 people, will be ready by December 2007
  • Directi has also opening two offices in China - Beijing and Xiamen
  • Directi has partnerships with several datacenters worldwide and operates hundreds of servers worldwide for its various businesses

This blog is not suggesting anything more (at this time) than Directi have joined cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 ranks of cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 RBN host / name server “stooges”. Hopefully Directi will respond to cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 related abuse communications promptly.



Fig5 Directi Ops




It is reasonable to draw cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 following quantitative conclusions from cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 above and related:

  1. 76 Service / Team and Loads.cc are synonymous RBN retail operations, working both sides of botnet operations and exploiting personal IDs.
  2. They are both now operational via Indian web space and elsewhere via Directi
  3. The community and this blog as a whole have helped to force cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 RBN from cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365ir own servers, cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 original 76 Service base within Noc4 Hosts, The Planet, and elsewhere, due to publicity and improved CYBERINT and blocking. This not cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 time to belive in cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 demise of cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 RBN, for historians cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 first time was in 2004.

References:

Original disclosure on 76 Service Recent article on Loads.cc