IP Hijacking For Dummies

Ronald_F_Guilmette1 · June 5, 2017, 11:46pm

Late last night, I put together the following simple annotated listing of
the routes being announced by AS34991.

Beyond the quite apparent fact that this "Bulgarian" network is announcing
a bunch of routes for blocks of IPv4 space allocated to various parties
within the nation of Columbia (including the National University thereof)
the other thing that struck me about this was the apparent relevance of
a company called "host-offshore.com".

Looking at the web site for that, it provides only a single contact
phone number which is unambiguously a -Pakistani- phone number. But
of course, that makes perfect sense, because Pakistan is just down the
street from Bulgaria (NOT!)

It did also strike me as passing strange that this company has apparently
elected to not actually put its own web server, name servers, or mail
server anywhere within its own duly allocated IPv4 blocks.

Things got even a bit more interesting when I tried to actually order a
server from this company. Apparently, all of their virtual servers
are "sold out". However... and please, somebody check me on this...
I guess that all of the browsers on all of the platforms I have ready
access to are broken or something, because try as I might, I could never
quite succeed at reaching any page on this company's web site where I
could order up -any- kind of server, virtual, dedicated, or otherwise.

So, you know, this hosting company appears somewhat unique and unusual,
at least from where I am sitting, in the sense that it is perhaps the
only such "hosting" company that I've ever run across in my travels that
doesn't actually have -anything- for sale.

Personally, I don't really give a rat's ass if this site is just a cover
for some inept criminals, or for Panstani ISI, or for the FSB, or for
some of Putin's patriots, or even if it belongs to the NSA. But I cannot
help but bemoan the fact that here we are, and it is 2017 already, and
yet, whichever bunch of lame-ass jerks are in fact behind this thing,
apparently aren't even capable of slapping together a cover web site
that is more than just some entirely shallow and not very effective false
front.

As a researcher and student of such things, I just think that by now,
in 2017, we should have a somewhat more skilled class of frauds, rogues,
criminals and spies on the Internet. I mean this is just baby stuff,
and it only takes a couple of minutes and few clicks to see past such
transparent gibberish.

So c'mon all ye criminals, rogues and spys! You need to up your game
fer cryin' out loud! At least present us with something a bit more
challenging than -this- kind of very superflous crap. I mean, have you
no self-respect?

Geeeessshhh!

Regards,
rfg

Aftab_Siddiqui · June 6, 2017, 2:03am

Same mobile number (+92-304-4000736 <+92%20304%204000736>) and address are
listed here for Blue Angel Hosting with only 1 peer AS206776.

aut-num: AS206349
as-name: blueangelhost
org: ORG-BPL5-RIPE
sponsoring-org: ORG-HGC2-RIPE
import: from AS206776 accept ANY
export: to AS206776 announce AS206349
import: from AS57344 accept ANY
export: to AS57344 announce AS206349
admin-c: SS30461-RIPE
tech-c: SS30461-RIPE
remarks: For information on "status:" attribute read
https://www.ripe.net/data-tools/db/faq/faq-status-values-legacy-resources
status: ASSIGNED
mnt-by: RIPE-NCC-END-MNT
mnt-by: blueangelhost
mnt-routes: blueangelhost
created: 2017-02-08T10:44:15Z
last-modified: 2017-02-08T10:44:15Z
source: RIPE

organisation: ORG-BPL5-RIPE
org-name: BlueAngelHost Pvt. Ltd
org-type: OTHER
address: HOUSE NO 173 STREET NO 4 BLOCK E YOHANA ABAD, FEROZ
PUR ROAD, LAHORE, PAKISTAN
abuse-c: ACRO1320-RIPE
mnt-ref: MNT-NETERRA
mnt-ref: AZ39139-MNT
mnt-ref: MNT-LIR-BG
mnt-by: blueangelhost
created: 2016-10-21T17:23:02Z
last-modified: 2016-11-01T21:03:31Z
source: RIPE # Filtered

person: Sunil Shahzad
address: HOUSE NO 173 STREET NO 4 BLOCK E YOHANA ABAD, FEROZ
PUR ROAD, LAHORE, PAKISTAN
phone: +92-304-4000736
nic-hdl: SS30461-RIPE
mnt-by: blueangelhost
created: 2016-10-21T17:19:19Z
last-modified: 2016-10-21T17:19:19Z
source: RIPE

Ronald_F_Guilmette1 · June 6, 2017, 4:37am

In message <CAK5YLgccBQWHUQNdfrwm-pHNH39G1xqFATD34=UGzp2moUw8_A@mail.gmail.com>

Same mobile number (+92-304-4000736 <+92%20304%204000736>) and address are
listed here for Blue Angel Hosting with only 1 peer AS206776.

I noticed Blue Angel. I -didn't- notice that it had the same phone number
as the other thing, host-offshore.com, which looks to me like a paper-mache
mock up of a false front of a sham of a mockery of travesty of a sham.

I am terrifically tempted, right at this moment, to engage in at least
a couple of noteworthy feats of unbridled cultural disparagement, directed
pointedly at the owners/operators of blueangelhost.com/host-offshore.com,
but I am restrained by the knowledge that any such would serve only to
sully my own already dubious reputation, such as it is. So I simply ask
readers to imagine the kinds of verbal venom that I would point in that
direction if the better angels of my nature did not, on this occaasion,
prevail.

Regards,
rfg

Rich_Kulawiec · June 6, 2017, 5:26pm

Out of curiosity, I ran a DNS scan against all of the /24's that you
enumerated (thank you, by the way). I am also perplexed that a hosting
company which has "sold out" of virtual servers seems to have precious
few servers -- of any type -- represented in its DNS records. To save
everyone else the trouble, I'm appending below all the results (1023)
that did not result in NXDOMAIN or SERVFAIL (5121). Note in re the
last dozen on the list: I believe "correo" translates to "post", in
the sense of "mail", so those may well be (customer?) mail servers.

---rsk

Andrew_Fried1 · June 6, 2017, 6:18pm

PTR records rarely paint an accurate picture. Looking at passive dns
for the past week, I see a slightly different view of those subnets:

2017-06-05 16:41:45,amasonsuper.com,A,168.176.194.132
2017-06-03 17:09:42,amztodai.com,A,168.176.194.4
2017-06-06 17:45:13,asianbabee.com,A,168.176.194.73
2017-06-05 16:40:29,asianbabez.com,A,168.176.194.197
2017-06-03 19:32:13,aydsleep.com,A,168.176.194.67
2017-06-05 19:56:30,becomedriverz.com,A,168.176.194.133
2017-06-05 23:31:07,bestkidbookz.com,A,168.176.194.71
2017-06-04 18:50:58,besttransforms.com,A,168.176.194.196
2017-06-03 21:03:57,brainkares.com,A,168.176.194.195
2017-06-06 14:28:15,cannabizmoney.com,A,168.176.194.10
2017-06-06 14:26:51,cvstodai.com,A,168.176.194.72
2017-06-03 20:07:48,extragiftz.com,A,168.176.194.130
2017-06-04 18:50:36,foxlivescand.com,A,168.176.194.68
2017-06-02 20:34:16,foxtodaylive.com,A,168.176.194.194
2017-06-02 18:20:10,funguzcured.com,A,168.176.194.193
2017-06-04 18:51:51,healthydiscoverz.com,A,168.176.194.131
2017-06-05 16:11:20,helpsavelifes.com,A,168.176.194.69
2017-06-05 16:15:25,kellyscandals.com,A,168.176.194.7
2017-06-06 17:45:43,kohlmaster.com,A,168.176.194.11
2017-06-05 19:44:34,luckireward.com,A,168.176.194.70
2017-06-05 16:41:35,mail.amasonsuper.com,A,168.176.194.132
2017-06-03 17:09:41,mail.amztodai.com,A,168.176.194.4
2017-06-06 17:45:56,mail.asianbabee.com,A,168.176.194.73
2017-06-05 16:40:28,mail.asianbabez.com,A,168.176.194.197
2017-06-03 19:32:12,mail.aydsleep.com,A,168.176.194.67
2017-06-05 19:56:30,mail.becomedriverz.com,A,168.176.194.133
2017-06-05 23:31:07,mail.bestkidbookz.com,A,168.176.194.71
2017-06-04 18:50:58,mail.besttransforms.com,A,168.176.194.196
2017-06-03 21:03:56,mail.brainkares.com,A,168.176.194.195
2017-06-06 14:28:15,mail.cannabizmoney.com,A,168.176.194.10
2017-06-06 14:26:57,mail.cvstodai.com,A,168.176.194.72
2017-06-03 20:07:55,mail.extragiftz.com,A,168.176.194.130
2017-06-04 18:50:40,mail.foxlivescand.com,A,168.176.194.68
2017-06-02 20:34:16,mail.foxtodaylive.com,A,168.176.194.194
2017-06-02 18:20:21,mail.funguzcured.com,A,168.176.194.193
2017-06-04 18:51:53,mail.healthydiscoverz.com,A,168.176.194.131
2017-06-05 16:11:03,mail.helpsavelifes.com,A,168.176.194.69
2017-06-05 16:15:25,mail.kellyscandals.com,A,168.176.194.7
2017-06-06 17:45:43,mail.kohlmaster.com,A,168.176.194.11
2017-06-05 19:44:34,mail.luckireward.com,A,168.176.194.70
2017-06-05 19:56:09,mail.navylighting.com,A,168.176.194.8
2017-06-05 19:42:38,mail.pharmacyalertz.com,A,168.176.194.198
2017-06-05 23:38:35,mail.prettyrussianz.com,A,168.176.194.134
2017-06-06 14:51:55,mail.primemazons.com,A,168.176.194.135
2017-06-05 21:20:18,mail.secretpotz.com,A,168.176.194.9
2017-06-04 19:06:59,mail.supersundayamz.com,A,168.176.194.5
2017-06-06 15:24:58,mail.todaymedications.com,A,168.176.194.199
2017-06-06 18:06:51,mail.wehelpbrains.com,A,168.176.194.136
2017-06-05 19:56:09,navylighting.com,A,168.176.194.8
2017-06-05 19:42:38,pharmacyalertz.com,A,168.176.194.198
2017-06-05 23:38:40,prettyrussianz.com,A,168.176.194.134
2017-06-06 14:51:55,primemazons.com,A,168.176.194.135
2017-06-05 21:20:18,secretpotz.com,A,168.176.194.9
2017-06-04 19:06:56,supersundayamz.com,A,168.176.194.5
2017-06-06 15:24:59,todaymedications.com,A,168.176.194.199
2017-06-06 18:06:51,wehelpbrains.com,A,168.176.194.136

2017-06-05 19:53:34,alertcvs.com,A,181.57.40.195
2017-06-06 14:48:56,amasonprimes.com,A,181.57.40.133
2017-06-03 17:20:21,amasuperprime.com,A,181.57.40.5
2017-06-06 00:27:57,amazinstorez.com,A,181.57.40.196
2017-06-05 16:32:57,amzntodaygift.com,A,181.57.40.131
2017-06-05 16:12:11,bloodlifesaver.com,A,181.57.40.69
2017-06-06 17:58:56,brainupdatez.com,A,181.57.40.134
2017-06-05 23:16:15,disneyfavz.com,A,181.57.40.9
2017-06-04 19:07:35,hbpsos.com,A,181.57.40.130
2017-06-05 19:41:29,kohlsupdatez.com,A,181.57.40.70
2017-06-02 20:34:52,livefoxscandal.com,A,181.57.40.4
2017-06-05 16:42:43,lovelyazian.com,A,181.57.40.194
2017-06-06 17:54:40,lovethisasian.com,A,181.57.40.73
2017-06-05 19:43:53,lyftdrivez.com,A,181.57.40.132
2017-06-05 19:53:34,mail.alertcvs.com,A,181.57.40.195
2017-06-06 14:48:55,mail.amasonprimes.com,A,181.57.40.133
2017-06-03 17:20:23,mail.amasuperprime.com,A,181.57.40.5
2017-06-06 00:27:50,mail.amazinstorez.com,A,181.57.40.196
2017-06-05 16:32:39,mail.amzntodaygift.com,A,181.57.40.131
2017-06-05 16:12:14,mail.bloodlifesaver.com,A,181.57.40.69
2017-06-06 17:59:14,mail.brainupdatez.com,A,181.57.40.134
2017-06-05 23:16:23,mail.disneyfavz.com,A,181.57.40.9
2017-06-04 19:07:34,mail.hbpsos.com,A,181.57.40.130
2017-06-05 19:41:25,mail.kohlsupdatez.com,A,181.57.40.70
2017-06-02 20:34:52,mail.livefoxscandal.com,A,181.57.40.4
2017-06-05 16:42:40,mail.lovelyazian.com,A,181.57.40.194
2017-06-06 17:54:40,mail.lovethisasian.com,A,181.57.40.73
2017-06-05 19:43:58,mail.lyftdrivez.com,A,181.57.40.132
2017-06-06 14:52:27,mail.medicationalertz.com,A,181.57.40.197
2017-06-05 16:09:55,mail.megynkelupdate.com,A,181.57.40.7
2017-06-05 19:58:32,mail.militaryequipz.com,A,181.57.40.8
2017-06-04 19:08:49,mail.momshocker.com,A,181.57.40.193
2017-06-03 17:14:54,mail.mycvscardz.com,A,181.57.40.68
2017-06-06 14:24:21,mail.pharmascvs.com,A,181.57.40.72
2017-06-06 14:22:58,mail.potstockk.com,A,181.57.40.10
2017-06-05 23:17:38,mail.russiancute.com,A,181.57.40.71
2017-06-06 17:49:46,mail.specialkohlz.com,A,181.57.40.11
2017-06-04 19:41:51,mail.sundaireward.com,A,181.57.40.6
2017-06-04 19:08:44,mail.toniteshowfox.com,A,181.57.40.67
2017-06-06 14:52:27,medicationalertz.com,A,181.57.40.197
2017-06-05 16:09:55,megynkelupdate.com,A,181.57.40.7
2017-06-05 19:58:20,militaryequipz.com,A,181.57.40.8
2017-06-04 19:08:00,momshocker.com,A,181.57.40.193
2017-06-03 17:14:50,mycvscardz.com,A,181.57.40.68
2017-06-06 14:24:35,pharmascvs.com,A,181.57.40.72
2017-06-06 14:25:56,potstockk.com,A,181.57.40.10
2017-06-05 23:17:38,russiancute.com,A,181.57.40.71
2017-06-06 17:49:42,specialkohlz.com,A,181.57.40.11
2017-06-04 19:41:51,sundaireward.com,A,181.57.40.6
2017-06-04 19:08:44,toniteshowfox.com,A,181.57.40.67

2017-06-03 17:16:40,amasonikusa.com,A,186.147.230.5
2017-06-06 14:51:56,amazntoda.com,A,186.147.230.139
2017-06-02 14:16:59,bizawardz.com,A,186.147.230.132
2017-06-06 18:00:51,bloodpressurealertz.com,A,186.147.230.140
2017-06-04 18:54:38,botoxkills.com,A,186.147.230.199
2017-06-01 22:46:46,bpmedz.com,A,186.147.230.68
2017-06-02 20:53:55,byesnorings.com,A,186.147.230.71
2017-06-06 14:27:48,cannabissal.com,A,186.147.230.10
2017-06-01 18:53:21,cvsextracares.com,A,186.147.230.67
2017-06-06 00:19:30,dizneyrewardz.com,A,186.147.230.202
2017-06-06 14:26:31,extracaregift.com,A,186.147.230.77
2017-06-01 18:50:40,extracarelight.com,A,186.147.230.130
2017-06-05 19:44:58,freebiezsibies.com,A,186.147.230.75
2017-06-02 19:33:35,fullnightsleepz.com,A,186.147.230.70
2017-06-02 14:19:21,giftamaazon.com,A,186.147.230.195
2017-06-06 17:46:46,giftcerttoday.com,A,186.147.230.11
2017-06-03 19:34:00,healthsleepz.com,A,186.147.230.72
2017-06-02 22:21:58,healthytypz.com,A,186.147.230.134
2017-06-05 23:30:41,heartallert.com,A,186.147.230.76
2017-06-04 19:07:49,hellpyourheart.com,A,186.147.230.136
2017-06-01 21:33:05,helpwbloodpressure.com,A,186.147.230.193
2017-06-05 16:12:57,highbloodpressurekill.com,A,186.147.230.74
2017-06-02 13:26:59,hollywoodlifez.com,A,186.147.230.69
2017-06-04 18:53:48,hollywudscandal.com,A,186.147.230.73
2017-06-02 16:35:59,importantfunds.com,A,186.147.230.133
2017-06-05 23:17:57,inzurancehealth.com,A,186.147.230.9
2017-06-03 17:16:32,kohlstodai.com,A,186.147.230.198
2017-06-03 21:40:59,kohlstodais.com,A,186.147.230.135
2017-06-05 16:26:52,livecandidacy.com,A,186.147.230.200
2017-06-05 16:15:53,livefoxtvusa.com,A,186.147.230.7
2017-06-01 22:52:15,livescandals.com,A,186.147.230.131
2017-06-03 17:16:40,mail.amasonikusa.com,A,186.147.230.5
2017-06-06 14:51:39,mail.amazntoda.com,A,186.147.230.139
2017-06-02 14:17:44,mail.bizawardz.com,A,186.147.230.132
2017-06-06 18:00:47,mail.bloodpressurealertz.com,A,186.147.230.140
2017-06-04 18:54:17,mail.botoxkills.com,A,186.147.230.199
2017-06-01 22:46:50,mail.bpmedz.com,A,186.147.230.68
2017-06-02 20:53:54,mail.byesnorings.com,A,186.147.230.71
2017-06-06 14:27:47,mail.cannabissal.com,A,186.147.230.10
2017-06-01 18:53:21,mail.cvsextracares.com,A,186.147.230.67
2017-06-06 00:19:38,mail.dizneyrewardz.com,A,186.147.230.202
2017-06-06 14:26:31,mail.extracaregift.com,A,186.147.230.77
2017-06-01 18:52:35,mail.extracarelight.com,A,186.147.230.130
2017-06-05 19:45:30,mail.freebiezsibies.com,A,186.147.230.75
2017-06-02 19:33:35,mail.fullnightsleepz.com,A,186.147.230.70
2017-06-02 14:19:21,mail.giftamaazon.com,A,186.147.230.195
2017-06-06 17:46:58,mail.giftcerttoday.com,A,186.147.230.11
2017-06-03 19:34:24,mail.healthsleepz.com,A,186.147.230.72
2017-06-02 22:18:33,mail.healthytypz.com,A,186.147.230.134
2017-06-05 23:30:30,mail.heartallert.com,A,186.147.230.76
2017-06-04 19:07:58,mail.hellpyourheart.com,A,186.147.230.136
2017-06-01 21:33:07,mail.helpwbloodpressure.com,A,186.147.230.193
2017-06-05 16:12:57,mail.highbloodpressurekill.com,A,186.147.230.74
2017-06-02 13:26:57,mail.hollywoodlifez.com,A,186.147.230.69
2017-06-04 18:53:48,mail.hollywudscandal.com,A,186.147.230.73
2017-06-02 16:35:58,mail.importantfunds.com,A,186.147.230.133
2017-06-05 23:17:56,mail.inzurancehealth.com,A,186.147.230.9
2017-06-03 17:16:43,mail.kohlstodai.com,A,186.147.230.198
2017-06-03 21:40:54,mail.kohlstodais.com,A,186.147.230.135
2017-06-05 16:26:52,mail.livecandidacy.com,A,186.147.230.200
2017-06-05 16:15:53,mail.livefoxtvusa.com,A,186.147.230.7
2017-06-01 22:52:27,mail.livescandals.com,A,186.147.230.131
2017-06-06 14:48:58,mail.medicinekillz.com,A,186.147.230.203
2017-06-05 21:13:42,mail.moneyofbud.com,A,186.147.230.8
2017-06-06 17:47:21,mail.sheishottoday.com,A,186.147.230.78
2017-06-02 16:35:52,mail.skinscareusa.com,A,186.147.230.196
2017-06-01 22:46:41,mail.snoringkillz.com,A,186.147.230.194
2017-06-04 18:57:47,mail.sundaygiveawayz.com,A,186.147.230.4
2017-06-02 20:57:25,mail.supergiveawayz.com,A,186.147.230.197
2017-06-05 19:53:42,mail.todaycvspharma.com,A,186.147.230.201
2017-06-05 16:34:14,mail.todayweamazn.com,A,186.147.230.137
2017-06-05 21:13:26,mail.zippygives.com,A,186.147.230.138
2017-06-06 14:48:45,medicinekillz.com,A,186.147.230.203
2017-06-05 21:13:44,moneyofbud.com,A,186.147.230.8
2017-06-06 17:47:21,sheishottoday.com,A,186.147.230.78
2017-06-02 16:35:58,skinscareusa.com,A,186.147.230.196
2017-06-01 22:46:12,snoringkillz.com,A,186.147.230.194
2017-06-04 18:57:47,sundaygiveawayz.com,A,186.147.230.4
2017-06-02 20:57:26,supergiveawayz.com,A,186.147.230.197
2017-06-05 19:53:42,todaycvspharma.com,A,186.147.230.201
2017-06-05 16:34:01,todayweamazn.com,A,186.147.230.137
2017-06-05 21:13:36,zippygives.com,A,186.147.230.138

Andrew Fried
andrew.fried@gmail.com

_Stephane_Bortzmeyer · June 9, 2017, 7:47am

a message of 85 lines which said:

I just think that by now, in 2017, we should have a somewhat more
skilled class of frauds, rogues, criminals and spies on the
Internet.

"This city deserves a better class of criminal and I'm gonna give it to them."

-- The Joker (in one of the Batman movies)

_Stephane_Bortzmeyer · June 11, 2017, 4:40pm

a message of 85 lines which said:

Late last night, I put together the following simple annotated listing of
the routes being announced by AS34991.

Note that they apparently stopped on 7 june.