That's a pretty good guess, as IP addresses and domains used in spam in the past have come up over and over as belonging to "Leni Neto" in Brazil.
Our colleague in anti-spam blogging, Spam Hound has such an example in his blog from June 2006!
Leni is a fairly technical person, if he's the same Brazilian Leni Neto found sharing his expertise on "mysql.com".
But mostly we know Leni is a spammer. One who, fortunately, in 2004 hadn't yet learned the importance of hiding his identity, as evidenced by the WHOIS information on this US Bank Phish from 2004 at "USBANK-SECURE.BIZ":
Domain Name: USBANK-SECURE.BIZ
Domain ID: D7530751-BIZ
Sponsoring Registrar: GO DADDY SOFTWARE, INC.
Domain Status: ok
Registrant ID: GODA-07675458
Registrant Name: Leni Neto
Registrant Organization: BR IT Consulting
Registrant Address1: Av Cons Nebias, 340 Cj 64
Registrant City: Santos
Registrant State/Province: Sao Paulo
Registrant Postal Code: 11015-002
Registrant Country: Brazil
Registrant Country Code: BR
Back then AbuseButler listed Leni Neto as the registrant of at least twelve spammed domains in September 2004. ScamFraudAlert has also listed some Leni Neto owned domains, such as "lilo-three.com", and Ackadia's Anti-Spam Pages mentions him as the owner of utoometoo.biz and wallacerights.com, registered to his email address of "lneto77@uol.com.br". Nigerianspam.com listed his in their second tier, "Lesser (bleep)-eating scumbags", crediting him with 345 419-scam emails. He was also listed as the owner of a company doing Digital Cable Filter scams, "roll-toit.biz". Toasted Spam documents his pill-spamming under the domain "moreofitnow.biz", also in February 2004.
With all of that information, let me be the first to say, Leni Neto, welcome to the United States of America!
Shutting Down the Botnet
The nice twist on this case is that after the Dutch High-Tech Crime Unit worked with Kaspersky Anti-Virus to create special instructions for the victims - using the criminals own Botnet to identify which people needed to be notified of how to remove the infection!
Once infected, bots would connect to an IRC channel, hosted at "elena.ccpower.ru" on port 3306, and join the chat rooms with names such as "#.nigger", or "#.xxcc2". In discussions of this particular botnet dating back as long ago as May 18th, that can be found on the Ryan1918.com forum, security afficionados such as a "superior member" there, named "SF", said that the botnet belonged to "whoopies" and that it contained 105,000 bots.
Kaspersky's instructions for removing the bot are given both in Dutch and English.
Unfortunately, law enforcement in general seems to have a very low interest in actually shutting down botnets, despite a few high profile cases, such as those in Operation Bot Roast II.
For instance, this botnet. The Command & Control, "elena.ccpower.ru", has been a well-documented botnet C&C site for years! Look for example at this McAfee AV Report from 2005, which lists both this site and this channel as being the way a particular piece of malware spreads.
Acting Assistant Attorney General Matthew Friedrich of the Criminal Division and Jim Letten, U.S. Attorney for the Eastern District of Louisiana, announced Thursday, August 21 that they had indicted Neto, and that extradition proceedings were underway to have Neto sent from the Netherlands to New Orleans for trial. The case is another example of international cooperation, with the Cyber Squad of the FBI's New Orleans field office, the Dutch Hi-Tech Crimes Unit and the Cyber Section of the Brazilian Federal Police all working together to bring about the arrest and indictments.
Get 24/7 expert customer services for all your QuickBooks software issues. Dial the QuickBooks support number to get instant assistance.
ReplyDelete