![Fredrick Brennan @HW BEAT_THAT Someone asked how I know Yalishanda, that is to say, Media Land LLC, a criminal organization that facilitates cybercrime including phishing, ransomware, and malware, masterminded by Alexander Volosovik, is hosting 8chan right now. So let's have a thread. krebsonsecurity.com/2019/07/meet-t 5:36 AM - 5 Nov 2019 11 Retweets 38 Likes 7 38 t 11 Fredrick Brennan @HW_BEAT_THAT 23h 8chan is currently going by the name "8kun" and using the domain 8KUN.NET. If we ask for its IP, we get 185.254.121.200. This is where some journalists are getting confused: if you do a normal WHOIS, this IP should not be usable: no useful information is returned. dig A 8kun.net 4.7 < A 8kun.net ons: +cmd opcode: QUERY, status: NOERROR, id: 502 dra QUERY: 1, ANSWER: 1, AUTHORITY: 0, ECTION: h: 0, flags: ; udp: 512 CTION: IN A tON: 59 IN 185.254 203 msec 8.8#53(8.8.8.8) v 05 21:37:16 PST 2019 vd: 53 1 20 Fredrick Brennan @HW_BEAT_THAT 23h So what's going on? 185.254.121.200 is what's called a «bogon». It's an IP that should not be routable according to the authority on this sort of thing, @TeamARIN. Yet, clandestine operators don't care about rules, and see these IPs as free real estate techopedia.com/definition/238.. Bogon Definition- What does Bogon mean? A bogon is an bogus IP address from the bogon space, which is a set of IP addresses not yet officially assigned to any entity by the Internet Assigned Number Authority (IANA) or a regional Internet registration institute. Bogon IP addresses are legitimate addresses. You may see a bogon IP address as a result of a misconfiguration (whether intentional or unintentional) that fools a recipient about a sender's legitimate IP address. Bogon IP addresses are popular in hacking or malicious activities and are used by spammers and those who initiate distributed denial-of- service attacks. As such, many Internet service providers and firewalls block bogons. A bogon is also known as a bogon space or bogon IP address. 2 19 t 2 Fredrick Brennan @HW_BEAT_THAT 23h So how can we figure out which clandestine operator is announcing a route to 185.254.121.200? This is where BGP (Border Gateway Protocol) comes in. BGP is how ISPS announce their routes. So, we can quite simply ask: which AS is claiming to have a route to 185.254.121.200? [ fred@pc tmp ] $ whois -h whois .cymru.com 185.254.121. 200 AS 206728 [fred@pc tmp]$ [ AS Name IP 185.254.121.200 MEDIALAND-AS, RU O 1 15 Fredrick Brennan t@HW_BEAT_THAT 23h So, AS206728 claims to have a route to bogon IP 185.254.121.200. Many ISPS filter bogon ranges and ignore announcements of their routes, so 8kun's clearnet gateway may not work for you; if you ask for a route to 185.254.121.200, your ISP might refuse. (M) 24 Seven Hunting for bogons and the ISPS that announce them In the coming weeks, I will be monitoring bogons in the wild and the ISPS that announce them. But first, what the heck is a bogon anyway? Bogon is badpackets.net 3 14 Fredrick Brennan @HW_BEAT_THAT 23h I know journalists love third party verification, so @henet, a large ISP, runs a service that allows you to lookup autonomous services and IPs without using the Linux command line. @henet confirms, Media Land LLC is announcing a route to 185.254.121.200. FHURRICANE ELECTRIC INTERNET SERVICES Search 185.254.121.200 IP Info WhoisDNS RBL Quick Links BGP Toolkit Home BGP Prefix Report GP Peer Report Exchanoe Rcnart Bon Routes World Report Multi Oriain Routes DNS Benon Iop Host Report Internet Statistics Leoking Glass Network Tools ApR Eree IE Tunnel Pv6 Certification Pr6 Progress Going Natire 185.254.121.200 Announced By Description Origin AS Announcement AS205728 185.254.121.0/24 Internet Assigned Numbers. Autharity Address has 0 hosts associated with it. 14 1 Fredrick Brennan t@HW_BEAT_THAT 23h There is simply no doubt about it: 8kun is relying on a cybercriminal to get online. 8kun's host is best known for hosting ransomware and phishing websites. 8kun is using an unallocated IP, which is if not illegal, extremely bad practice that many ISPS, @henet included, shun. AS Info Graph v4 Prefixes v4 Peers v4 Whais IRR Quick Links BGP Teolkit Heme BGP Prefix Regort BGP Peer Reaart Exchange Repert Bogon Routes World Report Multi Origin Rautes DNS Report Top Hest Report Internet Statistics Looking Glass Network Tools App AS206728 announces bogons Country of Origin Russian Federation Prefixes Originated (all): 3 Prefixes Originated (v4): 3 Prefixes Originated (v6): 0 Prefixes Announced (all: 3 Prefixes Announced (v4): 30 Prefixes Announced (v6): 0 BGP Peers Observed (all): 1 BGP Peers Observed (v4): 1 IPs Originated (v4): 1,536 AS Paths Observed (v4): 516 AS Paths Observed (v6): 0 Eree Py Tunnel Pv6 Certification Pv6 Progress Saing Native Contact Us BGP Peers Observed (v6): 0 Average AS Path Length (all): 4.531 Average AS Path Length (v4): 4.531 Average AS Path Length (v6): 0.000 AS206728 IPv4 Peers A53216 AS206728 IPv4 Prefixes Anncunced AS206728 IPvd Prefixes Originated 13 t8 29 Σ](https://i.kym-cdn.com/photos/images/original/001/629/774/ff4.jpg "8kun Media Land LLC Thread by Fredrick Brennan")
8kun Media Land LLC Thread by Fredrick Brennan
Uploaded by Philipp Nov 06, 2019 at 07:52AM EST
8kun 8chan jim watkins fredrick brennan media land llc
Origin Entry: 8chan / 8kun
File type: jpg
Resolution: (640px x 3577px)
File size: 1010 KB
Uploaded by Philipp Nov 06, 2019 at 07:52AM EST
8kun 8chan jim watkins fredrick brennan media land llc
Origin Entry: 8chan / 8kun
File type: jpg
Resolution: (640px x 3577px)
File size: 1010 KB
![All the p--- >>/leftypol/ Announcing mass shootings online chan Non-aligned boards >/pol/ [adultswim.com] >>>/leftypol/ All the p--- chan Non-aligned >>>/pol/ boards [adultswim.com Why would leftists do this? CORAECI BUTGAS PORKOSNI](https://i.kym-cdn.com/photos/images/newsfeed/001/532/812/a10.jpg "Who Killed Hannibal?")
