12 September 2023
19 September 2023
On September 7, Qurium reported how the infrastructure of proxy and VPN providers shamelessly is used to silence independent media in repressive regimes. Today we are following up with the third forensic report in the series Weaponizing Proxy and VPN Providers focusing on how network providers and hosting facilities use expendable IP networks to conduct DDoS attacks.
Denial of service attacks and web scraping services share a common requirement, the access to large number of IP addresses to bypass detection. When IP addresses are known to conduct malicious activities, providers include them in the filters to build their firewall defenses and block them. Access to new and clean IP addresses is key to avoid detection that is largely based on historical threat intelligence data, also known as the “IP reputation”.
Qurium’s investigation reveals how network prefixes (blocks of IP addresses) are shuffled back and forth between network providers as they are being used for malicious activities and subsequently banned.
These “volatile networks” appeared to be originated by different network providers but were found being advertised and exchanged by one single data center and IP leasing provider.
Qurium’s investigation shows how the ghost-company Aliat LLC registered in Sheridan, Wyoming, was able to obtain large network resources that were weaponized to conduct denial of service attacks.
The network resources were leased from IPXO in April 2023 and are still announced from the PhoenixNAP datacenter in Ashburn, USA.
Despite multiple abuse complains against these actors, as of today neither IPXO nor PhoenixNAP have taken any action against the customer that conducted the attack. The only explanation that has been provided by IPXO, is that the attack traffic was caused by a misconfiguration in a client’s web-scraping service.
We invite you to the world of expendable and unaccountable IP space, yet another play field for attackers to source DDoS attacks.
Report 3: Volatile networks as a source of Denial of Service
All reports: Weaponizing proxy and VPN providers
Contacts
Digital forensics: Tord Lundström <t@virtualroad.org> Technical Director
Media: Clara Zid <info@virtualroad.org> Media and Outreach Manager