<html>
<head>
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
</head>
<body>
<p>We've had similar experience with this VPN provider. <br>
<br>
He claims not being able to track malicious actor is for the
benefit of free speech but when malware is used to attack people
who express free speech he did not understand that his service is
not contributing towards free speech but hinders it. <br>
<br>
Tonu<br>
CERT-EE<br>
</p>
<div class="moz-cite-prefix">On 25.06.2020 04:15, PP wrote:<br>
</div>
<blockquote type="cite"
cite="mid:4adcfbef-3f2f-646d-b933-cacdd0128e43@storey.ovh">
<meta http-equiv="content-type" content="text/html;
charset=windows-1252">
<p>Botnet controllers on VPN provider that refuses to act:</p>
<p><br>
</p>
<p>��� organisation:��� ORG-SL751-RIPE<br>
��� org-name:������� Freedom Of Speech VPN<br>
��� org-type:������� OTHER<br>
��� address:�������� P.O. Box 9173<br>
��� address:�������� Victoria<br>
��� address:�������� Mahe Island<br>
��� address:�������� Seychelles<br>
��� e-mail:��������� <a class="moz-txt-link-abbreviated"
href="mailto:info@FOS-VPN.org" moz-do-not-send="true">info@FOS-VPN.org</a><br>
��� abuse-c:�������� SL12644-RIPE<br>
��� mnt-ref:�������� FOS-VPN-MNT<br>
��� mnt-by:��������� FOS-VPN-MNT<br>
��� created:�������� 2018-07-13T05:33:45Z<br>
��� last-modified:�� 2020-02-28T12:37:39Z<br>
��� source:��������� RIPE</p>
<p><br>
</p>
<div class="moz-forward-container"><br>
<br>
-------- Forwarded Message --------
<table class="moz-email-headers-table" cellspacing="0"
cellpadding="0" border="0">
<tbody>
<tr>
<th valign="BASELINE" nowrap="nowrap" align="RIGHT">Subject:
</th>
<td>Re: botnet controllers</td>
</tr>
<tr>
<th valign="BASELINE" nowrap="nowrap" align="RIGHT">Date:
</th>
<td>Wed, 24 Jun 2020 21:49:21 +0200</td>
</tr>
<tr>
<th valign="BASELINE" nowrap="nowrap" align="RIGHT">From:
</th>
<td><a class="moz-txt-link-abbreviated"
href="mailto:info@ghlc.biz" moz-do-not-send="true">info@ghlc.biz</a></td>
</tr>
<tr>
<th valign="BASELINE" nowrap="nowrap" align="RIGHT">To: </th>
<td>PP <a class="moz-txt-link-rfc2396E"
href="mailto:phishphucker@storey.ovh"
moz-do-not-send="true"><phishphucker@storey.ovh></a></td>
</tr>
</tbody>
</table>
<br>
<br>
On 2020-06-24 13:03, PP wrote:<br>
Hello!<br>
<br>
<br>
Please note that all mentioned IPs belong to non-logging VPN
services.<br>
<br>
No user logs are kept.<br>
<br>
<br>
Sincerely yours<br>
<br>
David Craig<br>
<br>
<br>
<blockquote type="cite">SBL488704<br>
185.140.53.75/32<br>
ghlc.biz<br>
23-Jun-2020 05:26 GMT<br>
Malware botnet controller @185.140.53.75<br>
<a class="moz-txt-link-freetext"
href="https://www.spamhaus.org/sbl/query/SBL488704"
moz-do-not-send="true">https://www.spamhaus.org/sbl/query/SBL488704</a><br>
<br>
<br>
SBL488686<br>
91.193.75.58/32<br>
ghlc.biz<br>
22-Jun-2020 18:39 GMT<br>
NanoCore botnet controller @91.193.75.58<br>
<a class="moz-txt-link-freetext"
href="https://www.spamhaus.org/sbl/query/SBL488686"
moz-do-not-send="true">https://www.spamhaus.org/sbl/query/SBL488686</a><br>
<br>
<br>
SBL488548<br>
185.244.30.201/32<br>
ghlc.biz<br>
19-Jun-2020 13:21 GMT<br>
QuasarRAT botnet controller @185.244.30.201<br>
<a class="moz-txt-link-freetext"
href="https://www.spamhaus.org/sbl/query/SBL488548"
moz-do-not-send="true">https://www.spamhaus.org/sbl/query/SBL488548</a><br>
<br>
<br>
SBL488006<br>
185.140.53.162/32<br>
ghlc.biz<br>
18-Jun-2020 10:11 GMT<br>
NanoCore botnet controller @185.140.53.162<br>
<a class="moz-txt-link-freetext"
href="https://www.spamhaus.org/sbl/query/SBL488006"
moz-do-not-send="true">https://www.spamhaus.org/sbl/query/SBL488006</a><br>
<br>
<br>
SBL487900<br>
185.140.53.229/32<br>
ghlc.biz<br>
16-Jun-2020 13:28 GMT<br>
NanoCore botnet controller @185.140.53.229<br>
<a class="moz-txt-link-freetext"
href="https://www.spamhaus.org/sbl/query/SBL487900"
moz-do-not-send="true">https://www.spamhaus.org/sbl/query/SBL487900</a><br>
<br>
<br>
SBL487899<br>
185.244.30.113/32<br>
ghlc.biz<br>
16-Jun-2020 12:59 GMT<br>
RemcosRAT botnet controller @185.244.30.113<br>
<a class="moz-txt-link-freetext"
href="https://www.spamhaus.org/sbl/query/SBL487899"
moz-do-not-send="true">https://www.spamhaus.org/sbl/query/SBL487899</a><br>
<br>
<br>
SBL487893<br>
185.140.53.236/32<br>
ghlc.biz<br>
16-Jun-2020 12:07 GMT<br>
NanoCore botnet controller @185.140.53.236<br>
<a class="moz-txt-link-freetext"
href="https://www.spamhaus.org/sbl/query/SBL487893"
moz-do-not-send="true">https://www.spamhaus.org/sbl/query/SBL487893</a><br>
<br>
<br>
SBL487886<br>
185.165.153.45/32<br>
ghlc.biz<br>
16-Jun-2020 10:26 GMT<br>
NanoCore botnet controller @185.165.153.45<br>
<br>
<a class="moz-txt-link-freetext"
href="https://www.spamhaus.org/sbl/query/SBL487886"
moz-do-not-send="true">https://www.spamhaus.org/sbl/query/SBL487886</a><br>
</blockquote>
</div>
</blockquote>
<pre class="moz-signature" cols="72">
</pre>
</body>
</html>