DCWG http://www.dcwg.org DNS Changer Working Group Wed, 15 Aug 2012 22:11:44 +0000 en-US hourly 1 http://wordpress.org/?v=3.5.1 RIPE NCC Responds to the Rove Digital/DNS Changer Re-allocations http://www.dcwg.org/ripe-ncc-responds-to-the-rove-digitaldns-changer-re-allocations/ http://www.dcwg.org/ripe-ncc-responds-to-the-rove-digitaldns-changer-re-allocations/#comments Wed, 15 Aug 2012 22:11:44 +0000 bgreene http://www.dcwg.org/?p=952 (Read More)]]> RIPE has publicly responded to the surprise felt by members of the DCWG and others involved with the Rove Digital/DNS Changer clean up community. (Read More)

]]> http://www.dcwg.org/ripe-ncc-responds-to-the-rove-digitaldns-changer-re-allocations/feed/ 0 Clarification on Reallocated IPv4 Address Space Related to Dutch Police Order http://www.dcwg.org/clarification-on-reallocated-ipv4-address-space-related-to-dutch-police-order/ http://www.dcwg.org/clarification-on-reallocated-ipv4-address-space-related-to-dutch-police-order/#comments Wed, 15 Aug 2012 22:10:00 +0000 bgreene http://www.dcwg.org/?p=955 15 Aug 2012 — ripe ncc As reported in previous announcements, the RIPE NCC will go to court in the Netherlands on 29 November 2012 to seek clarification on the procedure taken by the Dutch police on 8 November 2011 when it presented the RIPE NCC with a police order to “lock” registrations [...]]]> 15 Aug 2012 — ripe ncc

As reported in previous announcements, the RIPE NCC will go to court in the Netherlands on 29 November 2012 to seek clarification on the procedure taken by the Dutch police on 8 November 2011 when it presented the RIPE NCC with a police order to “lock” registrations in the RIPE Database.

For background on this story, see: Summons of the RIPE NCC Against the State of the Netherlands.

After receiving independent legal advice that the police order had no sufficient legal grounds to force the RIPE NCC to execute the order, the RIPE NCC unlocked the blocks of IPv4 address space on 10 January 2012. We’d like to give you an update on the current situation.

Two of the four address blocks included in the police order (93.188.160.0/21 and 85.255.112/20) were reallocated after the contractual relationship with the member holding the address space was terminated. The member’s account was closed and the space was deregistered according to ripe-541, “Closure of LIR and Deregistration of Internet Number Resources”. The address space was quarantined for six weeks before being returned to the RIPE NCC’s available pool of IPv4 address space. It was then randomly reallocated to a new resource holder according to normal allocation procedures.

As the RIPE NCC nears IPv4 exhaustion, it will reduce the quarantine period of returned address space accordingly to ensure that there is no more IPv4 address space available before the last /8 is reached. The  RIPE NCC recognises that this shortened quarantine could lead to routability problems and offers its members assistance to reduce this.

More information about the RIPE NCC’s Resource Quality Assistance.

]]> http://www.dcwg.org/clarification-on-reallocated-ipv4-address-space-related-to-dutch-police-order/feed/ 0 Beware! DNS Changer’s IP Blocks are re-allocated and advertised! http://www.dcwg.org/beware-dns-changers-ip-blocks-are-re-allocated-and-advertised/ http://www.dcwg.org/beware-dns-changers-ip-blocks-are-re-allocated-and-advertised/#comments Sat, 11 Aug 2012 04:38:04 +0000 bgreene http://www.dcwg.org/?p=949 bgreene On August 10, 2012 · As of Friday morning (August 10, 2012), the IP address blocks used by the Rove Digital criminal operations have been re-allocated by RIPE-NCC and advertised to the Internet: http://www.ris.ripe.net/cgi-bin/lg/index.cgi?rrc=RRC001&query=1&arg=85.255.112.0%2F20 http://www.ris.ripe.net/dashboard/85.255.112.0/20 (Read full blog here)]]> From Senki.org …. By On ·

As of Friday morning (August 10, 2012), the IP address blocks used by the Rove Digital criminal operations have been re-allocated by RIPE-NCC and advertised to the Internet:

http://www.ris.ripe.net/cgi-bin/lg/index.cgi?rrc=RRC001&query=1&arg=85.255.112.0%2F20

http://www.ris.ripe.net/dashboard/85.255.112.0/20

(Read full blog here)

]]> http://www.dcwg.org/beware-dns-changers-ip-blocks-are-re-allocated-and-advertised/feed/ 0 New Hilbert Curve Maps of the Infections http://www.dcwg.org/new-hilbert-curve-maps-of-the-infections/ http://www.dcwg.org/new-hilbert-curve-maps-of-the-infections/#comments Mon, 09 Jul 2012 18:35:18 +0000 bgreene http://www.dcwg.org/?p=942 http://www.dcwg.org/wp-content/uploads/2012/07/dnschanger_hilbert_4096_20120101_000000-20120630_230000.png ]]> Shadowserver.org processed the final data through their Hilbert Curve tool. The have posted a video along with the attached graphic.

The big Hilbert Curve is here: http://www.dcwg.org/wp-content/uploads/2012/07/dnschanger_hilbert_4096_20120101_000000-20120630_230000.png

]]> http://www.dcwg.org/new-hilbert-curve-maps-of-the-infections/feed/ 0 DCWG Ends Clean DNS Function http://www.dcwg.org/dcwg-ends-clean-dns-function/ http://www.dcwg.org/dcwg-ends-clean-dns-function/#comments Mon, 09 Jul 2012 16:44:01 +0000 bgreene http://www.dcwg.org/?p=931 On 12:01 Eastern Time on Monday July 9th 2012, the DCWG stop responding to DNS queries from infected machines. This is in compliance with the US Justice Department Court Order authorizing the clean DNS servers.

At 12:23 Eastern Time on Monday July 9th 2012, the server started to reply to all DNS request with an ICMP Unreachable. This would help infected computers troubleshot their problem is they find they cannot access DNS servers.

Some data will be collected through Monday July 9th, 2012, but the servers will be disconnected at midnight. At that time the BGP route advertisements will be shut down for the following IPs:

Starting IPEnding IPCIDR
85.255.112.085.255.127.25585.255.112.0/20
67.210.0.067.210.15.25567.210.0.0/20
93.188.160.093.188.167.25593.188.160.0/21
77.67.83.077.67.83.25577.67.83.0/24
213.109.64.0213.109.79.255213.109.64.0/20
64.28.176.064.28.191.25564.28.176.0/20

These IP addresses will be monitored by a several Service Provider and Security Organizations to insure they are not “maliciously hijacked.”

 

]]> http://www.dcwg.org/dcwg-ends-clean-dns-function/feed/ 0 Last Day of DCWG Data http://www.dcwg.org/last-day-of-dcwg-data/ http://www.dcwg.org/last-day-of-dcwg-data/#comments Mon, 09 Jul 2012 16:25:12 +0000 bgreene http://www.dcwg.org/?p=929 July 8th 2012 is the last day we collect DNS data on the DNS Changer Victims. The total “unique IPs” and last day of infections per DNS Top Level Domain Country Code (TLD CC) are linked below.

Now that this phase of the remediation exercise is over, researchers will collect all the data and compare results. We know that there “unique IPs talking to the clean DNS servers” under count the total number of infections. Estimates built around unique browser IDs demonstrate higher total infection counts.

]]> http://www.dcwg.org/last-day-of-dcwg-data/feed/ 0 Updated DNS Changer Infection Data http://www.dcwg.org/updated-dns-changer-infection-data/ http://www.dcwg.org/updated-dns-changer-infection-data/#comments Fri, 06 Jul 2012 16:21:40 +0000 bgreene http://www.dcwg.org/?p=918 Daily Unique IPs connecting to the clean DNS servers up to June 27th 2012 – dcwg-unique-ips-up-to-June-27 Daily Unique IPs in July 2012 – dcwg-unique-ips-July-2012 Current List of Infections by [...]]]> Lots of people have been asking for updated data. Thanks to one of our volunteers, we have the latest dump:

 

 ]]> http://www.dcwg.org/updated-dns-changer-infection-data/feed/ 0 DNS Changer – Top 25 ASNs http://www.dcwg.org/dns-changer-top-25-asns/ http://www.dcwg.org/dns-changer-top-25-asns/#comments Wed, 13 Jun 2012 18:01:46 +0000 bgreene http://www.dcwg.org/?p=909 Top 25 ASNs seen on Monday, June 11th who have DNS Changer infections communicating with the DCWG Clean DNS servers.

+-------+------------+
| asn   | unique_ips |
+-------+------------+
| 9829  |      15568 |
| 3269  |      13406 |
| 7922  |      11964 |
| 3320  |       9250 |
| 7132  |       6743 |
| 3215  |       5748 |
| 7018  |       5544 |
| 6389  |       5117 |
| 1267  |       4859 |
| 8151  |       4685 |
| 4134  |       4618 |
| 3352  |       4387 |
| 1221  |       4383 |
| 13285 |       4151 |
| 6128  |       4139 |
| 12874 |       3930 |
| 5089  |       3926 |
| 2856  |       3468 |
| 43234 |       3131 |
| 9121  |       3114 |
| 20115 |       3076 |
| 7303  |       2602 |
| 12715 |       2520 |
| 577   |       2503 |
| 17813 |       2499 |
+-------+------------+
]]> http://www.dcwg.org/dns-changer-top-25-asns/feed/ 0 Top DNS Changer Infections by Country http://www.dcwg.org/top-dns-changer-infections-by-country/ http://www.dcwg.org/top-dns-changer-infections-by-country/#comments Wed, 13 Jun 2012 17:59:17 +0000 bgreene http://www.dcwg.org/?p=907 Here is our latest country based on Country codes for Monday, June 11th:

 

+----+------------+
| cc | unique_ips |
+----+------------+
| US |      69517 |
| IT |      26494 |
| IN |      21302 |
| GB |      19589 |
| DE |      18427 |
| FR |      10454 |
| CN |      10304 |
| ES |      10213 |
| CA |       8924 |
| AU |       8518 |
| MX |       7054 |
| AR |       6078 |
| BR |       6074 |
| JP |       5867 |
| PL |       4916 |
| RU |       4383 |
| HU |       4021 |
| TR |       3884 |
| TH |       2941 |
| CZ |       2134 |
| CL |       2004 |
| GR |       1886 |
| NL |       1733 |
| BE |       1721 |
| PK |       1682 |
+----+------------+
]]> http://www.dcwg.org/top-dns-changer-infections-by-country/feed/ 0 Updated DNS Changer Data – Daily Count of Unique IP Addresses http://www.dcwg.org/updated-dns-changer-data-daily-count-of-unique-ip-addresses/ http://www.dcwg.org/updated-dns-changer-data-daily-count-of-unique-ip-addresses/#comments Wed, 13 Jun 2012 17:49:35 +0000 bgreene http://www.dcwg.org/?p=896 The following is our latest figures on the number of unique IP addresses communicating with the DNS Changer “Clean Servers.”

+------------+------------+
| date | unique_ips |
+------------+------------+
| 2011-11-08 | 551436 |
| 2011-11-09 | 567957 |
| 2011-11-10 | 672972 |
| 2011-11-11 | 661664 |
| 2011-11-12 | 617054 |
| 2011-11-13 | 605889 |
| 2011-11-14 | 672386 |
| 2011-11-15 | 691137 |
| 2011-11-16 | 816718 |
| 2011-11-17 | 573724 |
| 2011-11-18 | 521247 |
| 2011-11-19 | 494467 |
| 2011-11-20 | 485296 |
| 2011-11-21 | 517736 |
| 2011-11-22 | 514824 |
| 2011-11-23 | 512850 |
| 2011-11-24 | 498862 |
| 2011-11-25 | 503775 |
| 2011-11-26 | 482288 |
| 2011-11-27 | 474802 |
| 2011-11-28 | 505838 |
| 2011-11-29 | 535948 |
| 2011-11-30 | 529832 |
| 2011-12-01 | 524789 |
| 2011-12-02 | 513766 |
| 2011-12-03 | 490732 |
| 2011-12-04 | 488155 |
| 2011-12-05 | 515924 |
| 2011-12-06 | 516522 |
| 2011-12-07 | 518654 |
| 2011-12-08 | 512045 |
| 2011-12-09 | 504135 |
| 2011-12-10 | 482767 |
| 2011-12-11 | 472589 |
| 2011-12-12 | 494361 |
| 2011-12-13 | 508190 |
| 2011-12-14 | 496203 |
| 2011-12-15 | 504387 |
| 2011-12-16 | 497167 |
| 2011-12-17 | 471916 |
| 2011-12-18 | 468637 |
| 2011-12-19 | 495749 |
| 2011-12-20 | 492309 |
| 2011-12-21 | 488828 |
| 2011-12-22 | 486519 |
| 2011-12-23 | 476165 |
| 2011-12-24 | 449228 |
| 2011-12-25 | 469494 |
| 2011-12-26 | 491428 |
| 2011-12-27 | 569380 |
| 2011-12-28 | 560015 |
| 2011-12-29 | 519658 |
| 2011-12-30 | 492238 |
| 2011-12-31 | 456939 |
| 2012-01-01 | 429223 |
| 2012-01-02 | 482365 |
| 2012-01-03 | 502011 |
| 2012-01-04 | 510582 |
| 2012-01-05 | 504683 |
| 2012-01-06 | 475627 |
| 2012-01-07 | 449685 |
| 2012-01-08 | 438583 |
| 2012-01-09 | 474462 |
| 2012-01-10 | 474422 |
| 2012-01-11 | 472175 |
| 2012-01-12 | 468252 |
| 2012-01-13 | 455512 |
| 2012-01-14 | 437862 |
| 2012-01-15 | 431765 |
| 2012-01-16 | 463693 |
| 2012-01-17 | 441884 |
| 2012-01-18 | 458977 |
| 2012-01-19 | 454730 |
| 2012-01-20 | 446976 |
| 2012-01-21 | 427621 |
| 2012-01-22 | 417131 |
| 2012-01-23 | 445440 |
| 2012-01-24 | 445733 |
| 2012-01-25 | 442928 |
| 2012-01-26 | 439053 |
| 2012-01-27 | 434739 |
| 2012-01-28 | 417892 |
| 2012-01-29 | 412845 |
| 2012-01-30 | 447484 |
| 2012-01-31 | 449863 |
| 2012-02-01 | 448202 |
| 2012-02-02 | 440306 |
| 2012-02-03 | 438036 |
| 2012-02-04 | 419248 |
| 2012-02-05 | 406651 |
| 2012-02-06 | 437777 |
| 2012-02-07 | 439329 |
| 2012-02-08 | 433467 |
| 2012-02-09 | 433368 |
| 2012-02-10 | 428755 |
| 2012-02-11 | 407398 |
| 2012-02-12 | 404555 |
| 2012-02-13 | 434048 |
| 2012-02-14 | 429640 |
| 2012-02-15 | 430756 |
| 2012-02-16 | 429404 |
| 2012-02-17 | 422390 |
| 2012-02-18 | 401729 |
| 2012-02-19 | 388080 |
| 2012-02-20 | 415763 |
| 2012-02-21 | 417152 |
| 2012-02-22 | 423421 |
| 2012-02-23 | 417621 |
| 2012-02-24 | 412958 |
| 2012-02-25 | 383529 |
| 2012-02-26 | 372594 |
| 2012-02-27 | 397601 |
| 2012-02-28 | 398584 |
| 2012-02-29 | 397174 |
| 2012-03-01 | 392561 |
| 2012-03-02 | 386912 |
| 2012-03-03 | 376006 |
| 2012-03-04 | 376898 |
| 2012-03-05 | 407927 |
| 2012-03-06 | 401681 |
| 2012-03-07 | 394333 |
| 2012-03-08 | 379217 |
| 2012-03-09 | 378782 |
| 2012-03-10 | 365686 |
| 2012-03-11 | 356793 |
| 2012-03-12 | 384691 |
| 2012-03-13 | 381371 |
| 2012-03-14 | 379227 |
| 2012-03-15 | 375988 |
| 2012-03-16 | 372425 |
| 2012-03-17 | 354205 |
| 2012-03-18 | 343030 |
| 2012-03-19 | 362075 |
| 2012-03-20 | 362366 |
| 2012-03-21 | 362596 |
| 2012-03-22 | 358860 |
| 2012-03-23 | 353690 |
| 2012-03-24 | 346051 |
| 2012-03-25 | 338809 |
| 2012-03-26 | 364729 |
| 2012-03-27 | 364784 |
| 2012-03-28 | 363762 |
| 2012-03-29 | 364001 |
| 2012-03-30 | 360391 |
| 2012-03-31 | 343339 |
| 2012-04-01 | 335088 |
| 2012-04-02 | 359679 |
| 2012-04-03 | 361266 |
| 2012-04-04 | 360451 |
| 2012-04-05 | 349785 |
| 2012-04-06 | 333970 |
| 2012-04-07 | 324726 |
| 2012-04-08 | 312270 |
| 2012-04-09 | 345625 |
| 2012-04-10 | 360972 |
| 2012-04-11 | 360613 |
| 2012-04-12 | 356439 |
| 2012-04-13 | 349000 |
| 2012-04-14 | 332856 |
| 2012-04-15 | 328778 |
| 2012-04-16 | 356560 |
| 2012-04-17 | 357197 |
| 2012-04-18 | 353726 |
| 2012-04-19 | 349429 |
| 2012-04-20 | 349203 |
| 2012-04-21 | 331641 |
| 2012-04-22 | 327401 |
| 2012-04-23 | 347962 |
| 2012-04-24 | 344332 |
| 2012-04-25 | 339006 |
| 2012-04-26 | 333085 |
| 2012-04-27 | 327920 |
| 2012-04-28 | 312046 |
| 2012-04-29 | 303994 |
| 2012-04-30 | 327616 |
| 2012-05-01 | 318436 |
| 2012-05-02 | 335254 |
| 2012-05-03 | 332583 |
| 2012-05-04 | 327041 |
| 2012-05-05 | 312678 |
| 2012-05-06 | 303475 |
| 2012-05-07 | 329292 |
| 2012-05-08 | 328507 |
| 2012-05-09 | 330932 |
| 2012-05-10 | 330543 |
| 2012-05-11 | 326747 |
| 2012-05-12 | 312034 |
| 2012-05-13 | 305541 |
| 2012-05-14 | 335376 |
| 2012-05-15 | 334629 |
| 2012-05-16 | 331357 |
| 2012-05-17 | 328782 |
| 2012-05-18 | 326695 |
| 2012-05-19 | 308103 |
| 2012-05-20 | 301036 |
| 2012-05-21 | 331352 |
| 2012-05-22 | 333908 |
| 2012-05-23 | 326826 |
| 2012-05-24 | 326435 |
| 2012-05-25 | 313566 |
| 2012-05-26 | 294139 |
| 2012-05-27 | 282475 |
| 2012-05-28 | 317494 |
| 2012-05-29 | 318775 |
| 2012-05-30 | 315963 |
| 2012-05-31 | 318610 |
| 2012-06-01 | 311412 |
| 2012-06-02 | 287427 |
| 2012-06-03 | 283927 |
| 2012-06-04 | 311532 |
| 2012-06-05 | 310206 |
| 2012-06-06 | 309119 |
| 2012-06-07 | 304145 |
| 2012-06-08 | 300939 |
| 2012-06-09 | 283157 |
| 2012-06-10 | 277027 |
| 2012-06-11 | 303867 |

]]> http://www.dcwg.org/updated-dns-changer-data-daily-count-of-unique-ip-addresses/feed/ 0