Silent noise - about spam, trojans and other nasty stuff

Sort of kicking myself in the ass. As a starter, to get something written.

I have thought about writing about this one for some time now.
A bit outdated, but at the same time maybe still a bit interesting.
The domain setx.in is gone now, but I think the rest of the chain of info is intact.

There will be a lot of the usual "maybes" and tiny connections. And some connections that are easy to verify. The value of it? I don't know.

For now, I settle with an old screenshot from Googles cache from November last year (thanks to robtex.com):

I ended up in Ukraine, as I often do nowadays.
Malware, spam, dos, antiddos and perhaps something remotely related to Russias cyberattack on Georgia.
Could be interesting figure(s), the Khrenov(s).

I wonder if I ever get around to get this one finished?
The only way I seem to get it done is by filling in some stuff now and then.

So here we go:

March 14:

This post from December last year is somewhat related if you compare the IPs ( 208.72.168.62) in the screenshot above with the one in the posting : Asprox - Bad Gateway
Not much in common, only one IP on the now gone McColo network with domains from the Asprox botnet and the subdomain mcs.setx.in. But hey, it is something.
Especially if this was an IP solely controlled by the same guy(s).

A couple of details from the whois info for setx.in (registered with Directi, as I mentioned earlier the domain has now expired):

• Registrant Name: DorbiK
• Registrant Email: info@antiddos.eu

That should be enough info if you are a bit impatient and don't have time to wait for me. So if you are curious, go ahead. I've probably overlooked something too.

Kind of acceleration, whois info for antiddos.eu led me to the email address setx.mail@gmail.com.
And the contact page at antiddos.eu gave "icq: 149953634" and "skype: D0rbik" as contact points.
I will probably come back to the icq later.

But I also found similar whois info as for setx.in lying around on my HD:
httpdoc.info:

• Registrant Name: DorbiK
• Registrant Email: info@antiddos.eu

One interesting read about httpdoc.info found on threatexpert's blog from July 20, 2008:
Hacker Attack Follows Military Fighter Jets

A few quotes from that blog:

Now, the political tension in South Ossetia region has spread into the cyber space with the new distributed denial of service attack against the website of the Georgian President Mikhail Saakashvili (www.president.gov.ge).
As indicated by Steven Adair from the Shadowserver Foundation, who was the first to report about this DoS attack, the C&C server used in it has the IP address 207.10.234.244.

...

Another C&C contacted by the same bot resides at httpdoc.info. Searching this domain at ThreatExpert returns reports on several threats.

March 15:

Good morning.
Not too systematic progress in this posting.

A small detail in this screenshot from googles cache some months ago:

(Click for a bigger one, note the email address setx.mail@gmail.com and icq 724834)

If you now check the whois info for antiddos.eu and antiddos.org, you will find:

• Registrant email: setx.mail@gmail.com for antiddos.eu
• Admin Email: setx.mail@gmail.com for antiddos.org

So this small little detail adds "blood leased spam bots system (bot mailer") to "setx.mail@gmail.com's" arsenal of services. And the icq # 724834 is of course interesting too.
In addition to the "antiddos".

The paradox is that he was offering ddos services back in 2007.
Here is a small screenshot from thebugs.ws back in 2007:


Note the icq # again: 724834.
Full link to the page where the screenshot is from:
http://www.thebugs.ws/forum/?a=open&fid=14&id=301768

Is this a kind of "pay for our antiddos service or else we'll ddos you"?
I don't know.

But anyway, so far we have spamming services, antiddos services and DDoS services.
Nice guys.

There is also a tiny little connection to an interesting email address in the whois info for another domain. I've got to find that one, I'm putting stuff all around and forgot where I put it.
I don't quite know how I should read an email address like "team@russia-vs-georgia.org".

But the Khrenov(s) are getting more and more interesting.

April 1

Alex/Olexij, same guy? I am not familiar with the language.
A profile of "sapsan" calling himself Alex gives a link to a CV on sapsan.org.ua. Which is Olexij.

Some very fresh SBL-listings regarding this guy:
http://www.spamhaus.org/sbl/listings.lasso?isp=gtcomm.net