4 ms·

I don't understand why the ICQ traffic would go through the servers. Were they running ICQ on the servers for some strange reason?

by msh 9y ago

zzzcpan 9y ago
Running a messaging client on a server, like centericq or irssi, was not uncommon, especially for someone from Russia, since all of their internet communications are openly surveilled.
nopcode 9y ago
Leaseweb is known to be a quite 'hands-off' provider, often the source of ddos attacks, torrent sites, etc. Figures that Leaseweb, who doesn't do much (any?) self-policing ends up being a honeypot.
twiss 9y ago
The background article [1] in Dutch somewhat vaguely states that: (emphasis mine) It's hard to do anything against this type of crime: the [ZeuS] virus is particularly effective and the owners are hiding behind anonymous internet browsers. And often they use the servers of the Dutch provider Leaseweb. In 2008, 27 percent of European data traffic went via the servers of this company from Haarlemmermeer. The police have an explanation for this. 'This is likely due to the combination of high-speed internet access, a relatively inexpensive product offering and a high degree of freedom and anonymity when setting up the leased facilities,' says an internal note. [1]: http://www.volkskrant.nl/kijkverder/2017/hacker/ http://www.volkskrant.nl/kijkverder/2017/hacker/
tinco 9y ago
Perhaps ICQ comms servers or proxies are located at Leaseweb? The AMS-IX is I think the largest connection between Europe and the US, it makes sense as a central location for a messaging service, or as pass through for messages between Russia and the U.S. (not sure what the lines are like the other way around the world).
- raarts 9y ago
  > AMS-IX is the largest connection between Europe and the US An IX (Internet eXchange) is not a connection, but is more like a giant switch, where internet access providers send local traffic, so they don't have to send it through their bandwidth providers, to cut bandwidth costs. The AMS-IX is more or less the largest internet exchange in the world.
nl 9y ago
Maybe the criminals were running a VPN server on the leaseweb servers, so incoming ICQ was encrypted but outgoing (to the ICQ servers) was unencrypted? It isn't too clear.

I don't understand why the ICQ traffic would go through the servers. Were they running ICQ on the servers for some strange reason?

by msh 9y ago

I don't understand why the ICQ traffic would go through the servers. Were they running ICQ on the servers for some strange reason?

zzzcpan 9y ago

Running a messaging client on a server, like centericq or irssi, was not uncommon, especially for someone from Russia, since all of their internet communications are openly surveilled.

nopcode 9y ago

Leaseweb is known to be a quite 'hands-off' provider, often the source of ddos attacks, torrent sites, etc. Figures that Leaseweb, who doesn't do much (any?) self-policing ends up being a honeypot.

twiss 9y ago

The background article [1] in Dutch somewhat vaguely states that: (emphasis mine) It's hard to do anything against this type of crime: the [ZeuS] virus is particularly effective and the owners are hiding behind anonymous internet browsers. And often they use the servers of the Dutch provider Leaseweb. In 2008, 27 percent of European data traffic went via the servers of this company from Haarlemmermeer. The police have an explanation for this. 'This is likely due to the combination of high-speed internet access, a relatively inexpensive product offering and a high degree of freedom and anonymity when setting up the leased facilities,' says an internal note. [1]: http://www.volkskrant.nl/kijkverder/2017/hacker/ http://www.volkskrant.nl/kijkverder/2017/hacker/

tinco 9y ago

Perhaps ICQ comms servers or proxies are located at Leaseweb? The AMS-IX is I think the largest connection between Europe and the US, it makes sense as a central location for a messaging service, or as pass through for messages between Russia and the U.S. (not sure what the lines are like the other way around the world).

raarts 9y ago
> AMS-IX is the largest connection between Europe and the US An IX (Internet eXchange) is not a connection, but is more like a giant switch, where internet access providers send local traffic, so they don't have to send it through their bandwidth providers, to cut bandwidth costs. The AMS-IX is more or less the largest internet exchange in the world.

nl 9y ago

Maybe the criminals were running a VPN server on the leaseweb servers, so incoming ICQ was encrypted but outgoing (to the ICQ servers) was unencrypted? It isn't too clear.