nanog mailing list archives
Re: Tracking the bad guys
From: Eric Brunner-Williams <brunner () nic-naa net>
Date: Mon, 31 May 2004 16:39:32 +0000
Sean, I'm looking at a different problem, spam-over-http. Here's one event, 406 inserts of the URL paxil-medication.info from a single attack node in a weblog. The insert times and numbers of inserts/minute are below. 07:17 1 09:22 4 09:23 45 09:24 30 09:25 32 09:26 38 09:27 22 09:28 24 09:29 8 09:30 20 09:31 14 09:32 32 09:33 31 09:34 32 09:35 22 09:36 34 09:37 17 The targeted site (my wife's political weblog) is provisioned at 128kb/s, on a dual-processor 1GHz PIII running Freebsd 5.2.1, so the rate limiting factor is b/w, and the upper-bound on the number of writes is the number of posts with "open" comments. The attack node is 151.42.235.185 (IUnet, Italy dhcp-spam-swamp). The Afilias whois data for paxil-medication.info is redily available, the salient points are: a. the registrant Jerry Buckheimer claims domicile in American Samoa, and is the tech-c and admin-c, b. the registrar is Wild West Domains [R213-LRMS], c. the nameservers are ns{1,2}.dataextend.com, [67.15.0.{62,191}] The registrant Tunahan Korkmaz claims domicile in Turkey. These servers are in the address block [CIDR: 67.15.0.0/18] allocated by ARIN to Everyones Internet of Houston TX, and the registrar is NameSecure.com (also tech-c). As a class (I've got more, I'm sure everyone who hosts blogs has too), the attack node(s) are not interesting. Some blogware vendors offer the bandaide of ip address (/32) blocking, and "wait" times between comments to foil robo insertion engines, and so on. More interesting is the benefitting URL, and the NS and registration providers that provide the persistant infrastructure for this form of theft-of-advertizing. The economics of the registration and ns/webhosting business are not so different from the access-isp market, leading to the abuse-desk-vacant syndrome, or worse -- I've got three complaints of this size or larger out to my competitors and they are taking the fill-in-the-web-form approach to this. Other folks with data, or insight, drop me a line. I'll summarize. Eric
Current thread:
- Tracking the bad guys Sean Donelan (May 30)
- Re: Tracking the bad guys J.D. Falk (May 30)
- Re: Tracking the bad guys Mike Tancsa (May 31)
- Re: Tracking the bad guys Petri Helenius (May 31)
- Re: Tracking the bad guys Eric Brunner-Williams (May 31)