Last week I pointed out a malware site on 91.233.244.102 hosted by Olborg Ltd / ООО "ОЛЬБОРГ" (AS57636) [1] [2] (website at o1host.net) and made a recommendation that admins block access to the entire 91.233.244.0/23 block.
A polite but concerned email from a customer of Olborg with a legitimate sitein that range asked if I wasn't being rather harsh to Olborg with the recommended /23 block, for just one rogue IP.
First, let me explain my rationale behind recommending larger blocks that just single IP addresses. With many web hosts (and yes, a lot of those are in Eastern Europe) the badness isn't usually restricted to one IP address. This appears to be the case with Olborg, with more than one IP looking suspicious. From the point of view of an administrator, blocking a /24 or /23 displaying these characteristics is often the safest approach.. after all, a /24 only represents 0.000006% of the total address space of the internet, but malware sites do tend to cluster.
So, what exactly is going on with Olborg? Although it has 91.233.244.0/23 allocated to it, it only currently uses 91.233.244.0/24 (i.e. the lower half of the range). Of those IPs there appear to be two main blocks, lower down in the range 91.233.244.20, 91.233.244.22 and 91.233.244.28 all seem to host legitimate sites. But further up, 91.233.244.102, 91.233.244.103 and 91.233.244.106 seem to be malicious. It's hardly the most evil web host in the world though, but these rogue IPs are a concern.
I had a look at all the sites I could find in this address range and analysed their WOT ratings, Google malware prognosis and SURBL status, you can find it here [csv]. The SURBL code takes a little explaining, but basically 127.0.0.16 is malware, 127.0.0.4 is (mostly) spam and 127.0.0.20 is both. There more explanation of that here.
The IP 91.233.244.102 has been an issue for over a year [1] [2] [3] [4] although it may or may not be clean at the moment (anti-analysis techniques mean that it can be hard to be certain). Clean or not, I would certainly advise you not to send traffic to this IP.
OK. So you've read this far and somehow I have still kept you interested in Olborg Ltd. All the badness I can find is concentrated in 91.233.244.96/28 and blocking that should keep you protected from any current potential nastiness. Alternatively, you can block the /23, but do bear in mind that there are some legimate customers in that range too (update: and if they are running a sinkhole then there's no point blocking the /23 anyway)
No comments:
Post a Comment