Cybercrime's U.S. Home

When cybercrime is mentioned it never takes long for Russia and the Ukraine to enter the picture. However, while a lot of cybercriminals are based in those countries, a lot of their infrastructure is housed in the west, in the United States to be precise.

Without exception, all of the major security organizations on the Internet agree that the 'Home' of cybercrime in the western world is a firm known as Atrivo/Intercage, based in California. We ourselves have not come to this conclusion lightly but from many years of dealing with criminal operations hosted by Atrivo/Intercage, gangs of cybercriminals - mostly Russian and East European but with several US online crime gangs as well - whose activities always lead back to servers run by Atrivo/Intercage. We have lost count of the times we have tracked a major virus botnet's "command and control" to Atrivo/Intercage servers. At almost every Internet security conference, or law enforcement seminar on cyber-crime, a presentation will detail some attack, exploit, phish or financial crime that has some nexus at Atrivo/Intercage.

The person who runs Atrivo/Intercage, Emil Kacperski is an expert at playing the "surprised janitor", unaware of every new criminal enterprise found on his servers and keen to show he gets rid of some criminals once their activities on his network are exposed. His Internet hosting career first came to the attention of most anti-abuse organizations when he pinched (or 'purchased stolen goods' as he put it) and routed an unused block of 65,536 IP addresses belonging to the County of Los Angeles.

Spamhaus has dealt with over 350 incidents of cyber-crime hosting on Atrivo/Intercage and its related networks in the last 3 years alone, all of which involved criminal operations such as malware, virus spreaders and botnet command and control servers. Malware found by Spamhaus on Atrivo/Intercage/Cernel/Hostfresh just in the last few months included the Storm Worm installer and controller and a MySpace spambot amongst others. Spamhaus currently sees a large amount of activity related to malicious software and exploits being hosted on Atrivo/Intercage which include DNS hijack malware, IFRAME browser attacks, dialers, pirated software websites and blatantly criminal services.

We assume that every law enforcement agency with a cyber-crimes division has a dossier bursting at the seams on Atrivo/Intercage and its tentacles such as Esthost, Estdomains, Cernel, Hostfresh. The only question on everyone's mind is which agency will beat the others to shutting the whole place down and indicting the people behind it. Because if shut down, one thing is certain: the amount of malware-driven crime on the Internet would drop overnight as cyber-criminals rush to find a new crime-friendly host - difficult to find in the US, as Atrivo/Intercage is one of the very few remaining dedicated crime hosting firms whose customer base is composed almost, or perhaps entirely, of criminal gangs. More importantly, millions of Internet users currently being targeted by the malware gangs operating from Atrivo/Intercage will be, for a while, safer.

Perhaps one may be wondering about the costs of hosting at Atrivo/Intercage or how to sign up? Well, don't expect to find this information at the company's websites as they were empty for years and for the last year have just shown "Website Coming Soon."

http://www.atrivo.com => "InterCage, Inc. INTENSE SERVERS. Website Coming Soon:"

Last Updated: Thursday, September 06, 2007 4:32:59 PM

http://www.intercage.com => "InterCage, Inc. INTENSE SERVERS. Website Coming Soon:"

Tuesday, September 04, 2007 6:45:52 PM

At one time after being asked, "how on earth does your company get business?" an Atrivo/Intercage representative coyly said, "by word of mouth." That seems to be quite obvious.

*** UPDATE: Intercage/Atrivo has been de-peered from the internet ***

Additional reading:

• Washington Post: Report Slams U.S. Host as Major Source of Badware- Washington Post: Estdomains: A Sordid History- Washington Post: A Superlative Scam and Spam Site Registrar- Washington Post: Fake Antispyware Purveyor Doubles as Domain Registrar- Hostexploit: Atrivo - Cyber Crime USA White Paper- StopBadware: Report calls out Atrivo (Intercage) and affiliates- Securityfocus: Cracking Down on Cyberspace Land Grabs- Spamhaus: The hijacking of Los Angeles county- Virus Bulletin: Can You Trust Your DNS? (PDF)- ZD Net: ISPs hosting spyware - who are they?- InfoWorld: Cyber-scammers are entrenched, even in the U.S.- Shadowserver: Atrivo/InterCage - Malware Haven- CircleID: Cyber Crime: An Economic Problem- AdvertLabs: The darksides domains- Washington Post: Spam Volumes Plummet After Atrivo Shutdown- Ars technica: Atrivo ISP shutdown sends ripples through the spam deluge