InBoxRevenge KS Forum

Do you believe the servers are abandoned, and or possibly on shared hosting?

If the IP of a spammed link goes to a shared hosting company, maybe contacting that company can get the machine shutdown or at least fixed.

EDIT: I guess if I had read your other posts, my response would have been answered.

to: [site owner], [hosting company abuse email]

Your web server has been hacked by EvaPharmacy [ip.add.re.ss]

Hello

The subject says it all.

I've been investigating a Russian rogue online pharmacy group known as EvaPharmacy since 2005.

EvaPharmacy host all of their illicit rogue pharmacy websites on other people's servers, like yours, by performing scans and attempting to find servers with very weak Root passwords. A server you control - at IP address ip.add.re.ss - is now under their control. I know this because your IP address shows up when I perform a "dig" command on a recently spammed domain of theirs.

%dig roguedomain.com

; <<>> DiG 9.8.3-P1 <<>> roguedomain.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 9530
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2

;; QUESTION SECTION:
;roguedomain.com. IN A

;; ANSWER SECTION:
roguedomain.com. 600 IN A ip.add.re.ss

;; AUTHORITY SECTION:
roguedomain.com. 600 IN NS ns1.roguedomain.com.
roguedomain.com. 600 IN NS ns2.roguedomain.com.

;; ADDITIONAL SECTION:
ns1.roguedomain.com. 172800 IN A other.ip.add.ress
ns2.roguedomain.com. 172800 IN A other.ip.add.ress

How can you tell your server has been taken over?

Using SSH, run the following command:

ps w | grep tirqd

If infected, you will be shown at least one running instance of the binary program "tirqd", which is EvaPharmacy's web-mirroring and DNS software.

You may also notice that one or all of the following commands are now missing from your server, as they usually remove them when they take your server over:

passwd
restart
reboot
shutdown

Your server is now being used to host at least one domain for a rogue pharmacy website. The one I was sent (via spam) today was "roguedomain [dot] com".

This server needs to be taken offline and repaired, and obviously the root password needs to be changed, but as mentioned you may not be able to do that.

This is obviously a criminal act. I thought you should be aware.

Sincerely

[Signature]

CNCERT/CC

National Computer network Emergency Response technical Team/Coordination Center of China
Website：http://www.cert.org.cn/
Email：cncert@cert.org.cn
Tel：+8610 82991000
Fax：+8610 82990375
PGP Key：http://www.cert.org.cn/cncert.asc

For a) and c)

<snip>

After supplying convincing evidence of criminal abuse, the terminology is usually a request to "null route or blackhole" the IP address

No. How would I have found that out?! How do I tell them I found the relationship between Pavel Suk and their company?

SiL

inetnum: 93.99.132.0 - 93.99.137.255
netname: VM-NET
descr: V - data s.r.o., Vysoke Myto
country: CZ
admin-c: PS9259-RIPE
tech-c: PS9259-RIPE
status: ASSIGNED PA
mnt-by: SLOANE-MNT
mnt-lower: SLOANE-MNT
source: RIPE # Filtered

person: Pavel Suk
address: V - data s.r.o.
address: Fugnerova 4
address: Vysoke Myto
address: Czech Republic
phone: +420 465 421 760


% Information related to '93.99.128.0/17AS29113'

route: 93.99.128.0/17
descr: Sloane Park Property Trust, a.s.
origin: AS29113

Detailed Description
Slunecni namesti 2588/14
Prague 5
Prague, 158 00
Czech Republic

Founded in 1998
Phone: 420 2 4241 5111
Fax: 420 2 4241 5555
www.sloane.cz

contact: OTEC
name: LubomA-r Otec
address: LuÅ_nA¡ 2/716
address: Praha 6 - Vokovice
address: 16000
address: CZ
e-mail: Otec@sloane.cz
registrar: REG-IGNUM
created: 29.06.2004 16:15:00

SLOANE PARK Property Trust, a.s. provides wholesale telecommunications services to operators in the Czech Republic and internationally. The company operates optical fiber cables that use DWDM, CWDM, GE, and SDH technologies to provide services, such as IP connectivity;