Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Sign In Register

Quick Links


Categories

In this Discussion

› › Who is IP Volume Inc?
New on LowEndTalk? Please Register and read our Community Rules.

All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.

Who is IP Volume Inc?

net0net0 Member
in Providers

I'm getting port scans, attacks, and constant connections from an ISP called "IP Volume Inc". After a bit of research, I found they were previously known as "Quasi Network Ltd". I checked out their website (ipvolume.net) but I couldn't find a way to buy/rent a server. Seems like their company is based in Seychelles, although their physical datacenters are located in Amsterdam.

Is Novogara BV (novogara.com) IP Volume Inc? Or, who's this network and where are people getting servers from them?

Thanks.

Comments

  • HostSlickHostSlick Member, Patron Provider

    I couldn't find a way to buy/rent

    So you are getting port scans and now want to buy a Server for Port scans?

  • henixhenix Member

    @HostSlick said:

    I couldn't find a way to buy/rent

    So you are getting port scans and now want to buy a Server for Port scans?

    i guess he tried to see if they sell servers in the first place

    Thanked by 1kkrajk
  • net0net0 Member

    @HostSlick said:

    I couldn't find a way to buy/rent

    So you are getting port scans and now want to buy a Server for Port scans?

    I'm trying to see if all the port scans and attacks are done by the admins themselves or if they sell servers. I'm not interested in port scans.

  • DPDP Administrator, The Domain Guy

    PubertyVPS maybe.

  • FoxelVoxFoxelVox Member
    edited January 2022

    This is indeed Novogara/Ecatel/Quasi Network Ltd/etc, please read: https://nl.wikipedia.org/wiki/IP_Volume .

    They have hosted some other more nasty stuff before, you can read about it on major news sites also or the page above. I just permanently block their entire AS in my FW or even in the bird BGP daemon as filter because out of experience i didn't receive any good / legitimate requests from them and they are mostly scans/bruteforce.

    Just saving resources as much as i can by blocking it.

    (You'll have to translate the wikipedia article)

    Thanked by 8FrankZ net0 lentro DreamCaster fluffernutter JasonM maverickp shelfchair
  • TamerciagaTamerciaga Member, Host Rep

    They are Ecatel, the drain of the internet, like a big sinkhole of abusive content ran by Reinier van Eeden. They have a lot of subcompanies and subsidiaries: Quasi Networks Ltd, FiberXpress BV, REBA Communications BV, Novogara Ltd, DataOne BV, Alsycon BV, Incrediserve Ltd.

    In fact, there is a hoster here on LET (I won't call names) which uses the same registered office, and is also getting transit from "Ecatel", but it's not owned by Reinier. Strange business choice :smile:

    We simply drop all traffic coming from their ASN's.

    Thanked by 4net0 lentro DreamCaster JasonM
  • deankdeank Member, Troll

    They are the cesspool of the internet, along with social media outlets.

  • net0net0 Member
    edited January 2022

    Thank you FoxelVox. I was getting constant attacks, port scans and vulnerability scans to my servers that host SMTP, IMAP, and other services. But the rDNS links to Group-IB (the Russian cybersecurity firm). Seems like that Russian firm is also using IP Volume's servers. I've written an abuse report to IP Volume ([email protected]) but I'm yet to get a response. I'm just going to drop their netblocks permanently from my server as I've lost patience with them.

    Thanked by 1FoxelVox
  • TamerciagaTamerciaga Member, Host Rep

    @net0 said:
    Thank you FoxelVox. I was getting constant attacks, port scans and vulnerability scans to my servers that host SMTP, IMAP, and other services. But the rDNS links to Group-IB (the Russian cybersecurity firm). Seems like that Russian firm is also using IP Volume's servers. I've written an abuse report to IP Volume ([email protected]) but I'm yet to get a response. I'm just going to drop their netblocks permanently from my server as I've lost patience with them.

    Russian cyber companies frequently use "Dutch" providers to have access inside Europe, combined with their Acceptable Use Policy (which is everything) it's a good combo.

  • SetsuraSetsura Member
    edited January 2022

    Didn't they get slapped around by the Dutch tax authorities or something? I thought they stopped operating around then too, guess not.

  • deankdeank Member, Troll
    edited January 2022

    They keep rebranding as well as changing personnel, meaning the one who's really behind their operations is someone else who hasn't been exposed.

    And, if I recall correctly, they had a part in BurstNet's downfall.

    Real cesspool, the lot.

  • net0net0 Member

    @Tamerciaga said:

    @net0 said:
    Thank you FoxelVox. I was getting constant attacks, port scans and vulnerability scans to my servers that host SMTP, IMAP, and other services. But the rDNS links to Group-IB (the Russian cybersecurity firm). Seems like that Russian firm is also using IP Volume's servers. I've written an abuse report to IP Volume ([email protected]) but I'm yet to get a response. I'm just going to drop their netblocks permanently from my server as I've lost patience with them.

    Russian cyber companies frequently use "Dutch" providers to have access inside Europe, combined with their Acceptable Use Policy (which is everything) it's a good combo.

    Ah, I see. Interesting.

    Anyway, I think this'd do the job of keeping them away.

    #!/usr/bin/env bash
/usr/sbin/iptables -A INPUT -s 5.8.18.0/24 -j DROP
/usr/sbin/iptables -A INPUT -s 80.82.64.0/24 -j DROP
/usr/sbin/iptables -A INPUT -s 80.82.65.0/24 -j DROP
/usr/sbin/iptables -A INPUT -s 80.82.66.0/24 -j DROP
/usr/sbin/iptables -A INPUT -s 80.82.67.0/24 -j DROP
/usr/sbin/iptables -A INPUT -s 80.82.68.0/24 -j DROP
/usr/sbin/iptables -A INPUT -s 80.82.69.0/24 -j DROP
/usr/sbin/iptables -A INPUT -s 80.82.70.0/24 -j DROP
/usr/sbin/iptables -A INPUT -s 80.82.76.0/24 -j DROP
/usr/sbin/iptables -A INPUT -s 80.82.77.0/24 -j DROP
/usr/sbin/iptables -A INPUT -s 80.82.78.0/24 -j DROP
/usr/sbin/iptables -A INPUT -s 80.82.79.0/24 -j DROP
/usr/sbin/iptables -A INPUT -s 89.248.160.0/24 -j DROP
/usr/sbin/iptables -A INPUT -s 89.248.161.0/24 -j DROP
/usr/sbin/iptables -A INPUT -s 89.248.162.0/24 -j DROP
/usr/sbin/iptables -A INPUT -s 89.248.163.0/24 -j DROP
/usr/sbin/iptables -A INPUT -s 89.248.164.0/24 -j DROP
/usr/sbin/iptables -A INPUT -s 89.248.165.0/24 -j DROP
/usr/sbin/iptables -A INPUT -s 89.248.166.0/24 -j DROP
/usr/sbin/iptables -A INPUT -s 89.248.167.0/24 -j DROP
/usr/sbin/iptables -A INPUT -s 89.248.168.0/24 -j DROP
/usr/sbin/iptables -A INPUT -s 89.248.169.0/24 -j DROP
/usr/sbin/iptables -A INPUT -s 89.248.170.0/24 -j DROP
/usr/sbin/iptables -A INPUT -s 89.248.171.0/24 -j DROP
/usr/sbin/iptables -A INPUT -s 89.248.172.0/24 -j DROP
/usr/sbin/iptables -A INPUT -s 89.248.173.0/24 -j DROP
/usr/sbin/iptables -A INPUT -s 89.248.174.0/24 -j DROP
/usr/sbin/iptables -A INPUT -s 93.174.88.0/24 -j DROP
/usr/sbin/iptables -A INPUT -s 93.174.89.0/24 -j DROP
/usr/sbin/iptables -A INPUT -s 93.174.90.0/24 -j DROP
/usr/sbin/iptables -A INPUT -s 93.174.91.0/24 -j DROP
/usr/sbin/iptables -A INPUT -s 93.174.92.0/24 -j DROP
/usr/sbin/iptables -A INPUT -s 93.174.93.0/24 -j DROP
/usr/sbin/iptables -A INPUT -s 93.174.94.0/24 -j DROP
/usr/sbin/iptables -A INPUT -s 93.174.95.0/24 -j DROP
/usr/sbin/iptables -A INPUT -s 93.102.48.0/24 -j DROP
/usr/sbin/iptables -A INPUT -s 93.102.50.0/24 -j DROP
/usr/sbin/iptables -A INPUT -s 93.102.51.0/24 -j DROP
/usr/sbin/iptables -A INPUT -s 93.102.52.0/24 -j DROP
/usr/sbin/iptables -A INPUT -s 93.102.53.0/24 -j DROP
/usr/sbin/iptables -A INPUT -s 93.102.54.0/24 -j DROP
/usr/sbin/iptables -A INPUT -s 93.102.55.0/24 -j DROP
/usr/sbin/iptables -A INPUT -s 93.102.56.0/24 -j DROP
/usr/sbin/iptables -A INPUT -s 93.102.57.0/24 -j DROP
/usr/sbin/iptables -A INPUT -s 93.102.58.0/24 -j DROP
/usr/sbin/iptables -A INPUT -s 93.102.59.0/24 -j DROP
/usr/sbin/iptables -A INPUT -s 93.102.60.0/24 -j DROP
/usr/sbin/iptables -A INPUT -s 93.102.61.0/24 -j DROP
/usr/sbin/iptables -A INPUT -s 93.102.62.0/24 -j DROP
/usr/sbin/iptables -A INPUT -s 93.102.63.0/24 -j DROP
/usr/sbin/iptables -A INPUT -s 145.249.104.0/22 -j DROP
    Thanked by 1debian_dave
  • net0net0 Member

    Seems like shodan scanners also operate within IP Volume Inc's netblocks:

    IPv4: 80.82.77.139
    HOSTNAME: dojo.census.shodan.io
    LOGS: https://pastebin.com/raw/HLfwDNLU

    {
  "ip": "80.82.77.139",
  "hostname": "dojo.census.shodan.io",
  "city": "Amsterdam",
  "region": "North Holland",
  "country": "NL",
  "loc": "52.3740,4.8897",
  "org": "AS202425 IP Volume inc",
  "postal": "1012",
  "timezone": "Europe/Amsterdam",
}
    Thanked by 1debian_dave
  • DennisdeWitDennisdeWit Member

    The Dutch newspaper wrote a longread about IPVolume/Ecatel/Novogara/ReBa Communications.

    https://www.nrc.nl/nieuws/2021/04/02/the-cesspool-of-the-internet-is-to-be-found-in-a-village-in-north-holland-a4038369

    Thanked by 1net0
  • boukanboukan Member

    I just have benn researching for IP Volume.
    I found that infinityvps[.]net and one3erver[.]com,underhost[.]com resell this provider.
    There may be any other provider...
    I continue pursuing IP Volume👍.

    Thanked by 1net0
  • debian_davedebian_dave Member

    Glad I ran into this thread. I've been having the same issue. Great job on those ranges.

    Here's to hoping we stay ahead of this :)

Sign In or Register to comment.