76 Service is now 76 Team.com (click on pic to see detail)
Fig2. Current 76 Service user landing page
Loads.cc (click on pic to see detail)
As reported Loads.cc allows less technically proficient cyber-criminal affiliates to "cash in”, the site provides information on the availability and size of the botnet in real-time. Although it has been seen this method is different from that of other similar schemes, such as 76service whereas Loads.cc allows you to pay to infect computers.
Common Thread?
- 76 Team (back1.76team. com or bavk1.76team.com) – IP = 208.72.170.189 = AS 26780 MCCOLO - USA
- Loads.cc – IP = 212.24.53.4 AS 15756 CARAVAN ISP "CARAVAN" Moscow, RU
Fig 4 (a) 76 Service / Team Name servers (click on pic to see detail above)
Fig 4 (b) Loads cc Name servers (click on pic to see detail above)
The common thread is in two parts:
- Loads.cc infects the PCs, 76 Service / Team sells the IDs from those same infected PCs.
- Also as figs 3 & 4 show the common name servers i.e. orderbox-dns and optical jungle with corresponding IP ranges, both within AS30315 and AS31898. These two domain ranges are part of Resellerclub and Logic boxes, which in turn is owned by Directi.com.
Infrastructure:
- Directi has offices in India and UAE
- The new Directiplex, being designed by Hafeez Contractor, a $25 million facility with a capacity of 1700 people, will be ready by December 2007
- Directi has also opening two offices in China - Beijing and Xiamen
- Directi has partnerships with several datacenters worldwide and operates hundreds of servers worldwide for its various businesses
This blog is not suggesting anything more (at this time) than Directi have joined the ranks of the RBN host / name server “stooges”. Hopefully Directi will respond to the related abuse communications promptly.
Fig5 Directi Ops
It is reasonable to draw the following quantitative conclusions from the above and related:
- 76 Service / Team and Loads.cc are synonymous RBN retail operations, working both sides of botnet operations and exploiting personal IDs.
- They are both now operational via Indian web space and elsewhere via Directi
- The community and this blog as a whole have helped to force the RBN from their own servers, the original 76 Service base within Noc4 Hosts, The Planet, and elsewhere, due to publicity and improved CYBERINT and blocking. This not the time to belive in the demise of the RBN, for historians the first time was in 2004.
References:
Original disclosure on 76 Service Recent article on Loads.cc