Powered by Blogger.






Domain name reconnaissance:
troyak.org - (AS8560); (AS44310) - Email: staruy.rom@troyak.org; staruy.rom@inbox.ru
smallshopkz.org - (AS12570)

Name servers:
ns.troyak.org - - (AS44307) ALYANSHIMIYA
ns.bgpvpn.kz -

ns.smallshopkz.org ( is also known to have offered DNS services, to prombd.net (AS44107) PROMBUDDETAL (AS50215 Troyak-as at the time responding to ctlan.net) -, and vesteh.net (AS47560) VESTEH-NET

Domain name reconnaissance:
Organization Using Domain Name
Organization Name......: Mykola Tabakov

Administrative Contact/Agent
Email Address..........: tabanet@mail.ru

Nameserver in listed order:
Primary server.........: ns.bgpvpn.kz
Primary ip address.....:

Domain name reconnaissance:
Registrant ID:DI_10606443
Registrant Name:Vladimir Vladimirovich Stebluk
Registrant Organization:N/A
Registrant Street1:off. 306, Bulvar Mira, 16
Registrant Street2:
Registrant Street3:
Registrant City:Karaganda
Registrant State/Province:Qaraghandyoblysy
Registrant Postal Code:100008
Registrant Country:KZ
Registrant Phone:+7.7012032605
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:vladcrazy@smallshopkz.org

NetAssist LLC (netassist.ua) (AS29632) reconnaissance:
inetnum: -
netname:        UA-NETASSIST-20080201
descr:          NetAssist LLC
country:        UA
org:            ORG-NL64-RIPE
admin-c:        MT6561-RIPE
admin-c:        AVI27-RIPE
tech-c:         MT6561-RIPE
tech-c:         APP18-RIPE
status:         ALLOCATED PA
mnt-by:         RIPE-NCC-HM-MNT
mnt-lower:      MEREZHA-MNT
mnt-routes:     MEREZHA-MNT
mnt-domains:    MEREZHA-MNT
source:         RIPE # Filtered

organisation:  ORG-NL64-RIPE
org-name:      NetAssist LLC
org-type:       LIR
address:        NetAssist LLC
Max Tulyev
04213 Kiev
phone:          +380 44 5855265
fax-no:         +380 44 2721514
e-mail:         info@netassist.kiev.ua
admin-c:      AT4266-RIPE
admin-c:      KS3536-RIPE
admin-c:      MT6561-RIPE
mnt-ref:       RIPE-NCC-HM-MNT
mnt-ref:       MEREZHA-MNT
mnt-by:       RIPE-NCC-HM-MNT
source:        RIPE # Filtered

person:         Max Tulyev
address:        off. 32, 12 Artema str.,
address:        Kiev, Ukraine
remarks:        Office phones
phone:          +380 44 2398999
phone:          +7 495 7256396
phone:          +1 347 3414023
phone:          +420 226020344
remarks:        GSM mobile phones, SMS supported
phone:          +7 916 6929474
phone:          +380 50 7775633
remarks:        Fax is in auto-answer mode
fax-no:         +380 44 2726209
remarks:        The phone below is for emergency only
remarks:        You can also send SMS to this phone
phone:          +88216 583 00392
remarks:      Jabber ID mt6561@jabber.kiev.ua
remarks:      SIP 7002@
e-mail:         maxtul@netassist.ua
e-mail:         president@ukraine.su
nic-hdl:        MT6561-RIPE
mnt-by:        MEREZHA-MNT
source:         RIPE # Filtered

person:         Alexander V Ivanov
address:        14-28 Lazoreviy pr
address:        Moscow, Russia
address:        129323
phone:          +7 095 7251401
fax-no:         +7 095 7251401
e-mail:         ivanov077@gmail.com
nic-hdl:        AVI27-RIPE
mnt-by:         MEREZHA-MNT
source:         RIPE # Filtered

person:         Alexey P Panyushev
address:        8-142, Panferova street
address:        Moscow, Russia
address:        117261
phone:          +7 903 6101520
fax-no:         +7 903 6101520
e-mail:         panyushev@gmail.com
nic-hdl:        APP18-RIPE
mnt-by:         MEREZHA-MNT
source:         RIPE # Filtered



This post has been reproduced from Dancho Danchev's blog.

  • Digg
  • Del.icio.us
  • StumbleUpon
  • Reddit
  • RSS



In this post, I'll profile a money mule recruitment campaign, featuring a custom fake certificate, successfully blocking access to bobbear.co.uk as well as my personal blog, further exposing a malicious infrastructure, that I'll profile in this post.



Domain name reconnaissance for the malicious hosting provider:
alfa-host.net - (AS50793) - Email: alitalaghat@gmail.com; Name: Mohmmad Ali Talaghat (webalfa.net - also registered with the same email)
Name Server: NS1.ALFA-HOST.NET
Name Server: NS2.ALFA-HOST.NET

Alfa-host LLP - (AS50793)
person: Romanov Artem Alekseevich
phone: +75.332211183

Upstream provider reconnaissance:
LLC TC "Interzvyazok"
Hvoiki 15/15
04080 Kiev
phone: +380 44 238 6333
fax: +380 44 238 6333

The same upstream provider (Interzvyazok; intersv.com) is also known to have offered services to yet another bulletproof hosting provider in 2011.

Domain name reconnaissance:
sprottcareers.com -;
sprottcorporate.com -;
sprottcorporate.com -
sprottweb.com -;

Domain name reconnaissance:
allianceassetonline.com -
allianceassetweb.com -
uptusconsulting.net - Email: terrizziboris@googlemail.com -

Known to have responded to the same IP ( are also the following malicious domains:auditthere.ru


Related malicious domains known to have been active within (AS50793), ALFAHOSTNET:34real.ru

liramdelivery.com - Email: carlyle.jeffrey@gmail.com
ffgroupjobs.com - Email: FfGroupJobs@dnsname.info

Name servers:
ns2.uptusconsulting.net -
ns2.sprottweb.com -

allianceassetweb.com - Email: martins.allianceam@gmail.com

Surprise, surprise. We've also got the following fraudulent domains, responding to the same name server's IP (; ns1.oildns.net, ns2.oildns.net) back in 2009.

MD5: 8ee5435004ad523f4cbe754b3ecdb86e
MD5: 38f5e6a59716d651915a895c0955e3e6

We've also got ns1.oildns.net responding to (, with the actual name server, known to have hosted, the following malicious MD5s:
MD5: 5ae4b6235e7ad1bf1e3c173b907def17

Sample detection rate for the malicious certificate:

Sample detection rate for the HOSTS file modifying sample:

Once executed, the sample successfully modifies, the HOSTS file on the affected hosts, to block access to: google.com google.co.uk www.google.com www.google.co.uk suckerswanted.blogspot.com ideceive.blogspot.com www.bobbear.co.uk bobbear.co.uk reed.co.uk seek.com.au scam.com scambusters.org www.guardian.co.uk ddanchev.blogspot.com aic.gov.au google.com.au www.reed.co.uk www.sprott.com sprott.com

Sample confirmation email courtesy of Sprott Asset Management:





Go through related research regarding money mule recruitment:

    • Digg
    • Del.icio.us
    • StumbleUpon
    • Reddit
    • RSS


    Dear blog readers, I would like to let you know, of my latest, publicly released report, on the topic of "Assessing The Computer Network Operation (CNO) Capabilities of the Islamic Republic of Iran", a comprehensive, 45 pages, assessment, of Iran's cyber warfare scene, featuring exclusive, never-published before, assessments of the country's cyber warfare doctrine, analysis of the country's academic incubators of the next generation of cyber warriors, featuring, an exclusive, social network analysis (SNA), of Iran's hacking scene.

    The report, answers the following questions:
    • Who's who on Iran's Cyber Warfare Scene - the most comprehensive analysis of Iran's cyber warfare scene, ever performed
    • Where do they go to school? - in-depth analysis of Iran's academic incubators of the next generation of cyber warriors
    • Who's buying them books? - in-depth geopolitically relevant analysis of Iran's cyber warfare doctrine
    • How do they own and compromise? - complimentary copies of hacking tools, E-zines, academic papers, SNA (Social Network Analysis) of Iran's Hacking Scene
    An excerpt from the Executive Summary:
    "Today's growing cyber warfare arms race, prompts for systematic, structured, and multidisciplinary enriched processes to be utilized, in order to anticipate/neutralize and properly attribute an adversary's strategic, tactical and operational Computer Network Operation (CNO) capabilities, so that an adequate response can be formulated and executed on the basis of a factual research answering some of the most relevant questions in the 'fifth domain' of warfare - who are our adversaries, what are they up to, when are they going to launch an attack against us, how exactly are they going to launch it, and what are they going to target first?

    This qualitative analysis (45 pages) seeks to assess the Computer Network Operations (CNO) of Islamic Republic of Iran, through the prism of the adversary's understanding of Tactics, Techniques and Procedures (TTP), a structured and geopolitically relevant, enriched OSINT assessment of their operations, consisting of interpreted hacking literature, videos, and, custom made hacking tools, extensive SNA (Social Network Analysis) of the country's Hacking Ecosystem, real-life personalization of the key individuals behind the groups (personally identifiable photos, personal emails, phone numbers, Blogs, Web Sites, Social Networking accounts etc.). It's purpose is to ultimately empower decision/policy makers, as well as intelligence analysts, with recommendations for
    countering Islamic Republic of Iran's growing understanding and application of CNO tactics and strategies."

    Request, your, complimentary, copy, of, the, report, by, approaching, me, dancho.danchev@hush.com


    • Digg
    • Del.icio.us
    • StumbleUpon
    • Reddit
    • RSS