nanog mailing list archives

Re: Spyware becomes increasingly malicious


From: Richard A Steenbergen <ras () e-gerbil net>
Date: Mon, 12 Jul 2004 12:28:46 -0400


On Mon, Jul 12, 2004 at 04:18:34PM +0000, Paul Vixie wrote:

somebody, probably sean, mentioned scaling earlier in this thread.

coolwebsearch has become more and more sneaky.. so bad that
development of cws shredder has been abandoned by its developer..
...
the first time only about 3 days ago and I got rid of it in 10 minutes!
I can see how it would be a problem for a newbie but it shouldn't be
anything more than 10 minutes work for anyone here with Windows
experience.
...
There are dozen of variants, obviously you've seen only one.

so, this bit of spyware (which was resistant to ad-aware as of last week,
though ad-aware seems to publish a new definition file every day now) relies
on a web site, and that web site relies on the spyware for its traffic and
eyeballs, and the spyware and website are owned/operated/"published" by the
same company.  the website does not move around, it's at a fixed location.

the scaling issue, please:

        "why does that company still have an internet connection?"

or, to put it less mildly:

        "why does that company's provider still have an upstream?"

or, to put it in terms you can all understand:

        "why does that provider's upstream still have bgp peers?"

if you give people the means to hurt you, and they do it, and you take no
action except to continue giving them the means to hurt you, and they take
no action except to keep hurting you, then one of the ways you can describe
the situation is "it isn't scaling well."

http://www.webhelper4u.com/CWS/cwsoriginial.html

These folks? Looks like it's all Cogent. Surely someone has contacted 
Cogent about this?

network:ID:NET-42FA4A8019
network:Network-Name:NET-42FA4A8019
network:IP-Network:66.250.74.128/25
network:Org-Name:HyperSpace Communications
network:Street-Address: 74 West Street
network:City:Waltham
network:State:MA
network:Postal-Code:02451
network:Country-Code:US
network:Tech-Contact:ZC108-ARIN

-- 
Richard A Steenbergen <ras () e-gerbil net>       http://www.e-gerbil.net/ras
GPG Key ID: 0xF8B12CBC (7535 7F59 8204 ED1F CC1C 53AF 4C41 5ECA F8B1 2CBC)


Current thread: