Russia Hosting Parler
10 comments
If you don't understand that LACNIC is an entity similar to RIPE, ARIN or APNIC you're operating from flawed assumptions there. LACNIC is a regional entity that controls the supply of blocks of ipv4/ipv6 addresses, issued to ISPs.
The IP address is not "registered" to LACNIC, it comes from LACNIC and is issued to an ISP. As does any other IP address for an ISP with a business address in the LACNIC region.
https://www.lacnic.net/631/2/lacnic/coverage-area
The IP you've posted belongs to a /24 block issued to autonomous system AS262254, which does appear to be a Belize corporation with a mail.ru (russian version of free gmail/yahoo webmail) contact address.
The fact that it's a mail.ru address doesn't really say anything, anymore than a person anywhere in the world can access a yahoo or gmail webmail address over https in a browser.
Take a look at global BGP tables for where the /24 that contains that address is actually being announced from, and what other upstream transit/peer ASes are adjacent to it.
The AS in question appears to have as its primary upstream AS57724, which does seem to represent itself as a Russian hosting/DDoS filtering company.
https://ddos-guard.net/en
aut-num: AS262254 owner: DDOS-GUARD CORP. ownerid: BZ-DALT-LACNIC responsible: Evgeniy Marchenko address: 1/2Miles Northern Highway, --, -- address: -- - Belize - BZ country: BZ phone: +7 928 2797045 owner-c: HUN8 routing-c: HUN8 abuse-c: HUN8 created: 20121205 changed: 20170825 inetnum: 190.115.16.0/20 inetnum: 2803:f900::/32 inetnum: 186.2.160.0/20
nic-hdl: HUN8 person: Huan Nadas e-mail: [email protected] address: Avenue Jorge Perez Concha, 712, - address: 090511 - Guayaquil - country: EC phone: +7 9282797045 [0000] created: 20150320 changed: 20200923
The IP address is not "registered" to LACNIC, it comes from LACNIC and is issued to an ISP. As does any other IP address for an ISP with a business address in the LACNIC region.
https://www.lacnic.net/631/2/lacnic/coverage-area
The IP you've posted belongs to a /24 block issued to autonomous system AS262254, which does appear to be a Belize corporation with a mail.ru (russian version of free gmail/yahoo webmail) contact address.
The fact that it's a mail.ru address doesn't really say anything, anymore than a person anywhere in the world can access a yahoo or gmail webmail address over https in a browser.
Take a look at global BGP tables for where the /24 that contains that address is actually being announced from, and what other upstream transit/peer ASes are adjacent to it.
The AS in question appears to have as its primary upstream AS57724, which does seem to represent itself as a Russian hosting/DDoS filtering company.
https://ddos-guard.net/en
aut-num: AS262254 owner: DDOS-GUARD CORP. ownerid: BZ-DALT-LACNIC responsible: Evgeniy Marchenko address: 1/2Miles Northern Highway, --, -- address: -- - Belize - BZ country: BZ phone: +7 928 2797045 owner-c: HUN8 routing-c: HUN8 abuse-c: HUN8 created: 20121205 changed: 20170825 inetnum: 190.115.16.0/20 inetnum: 2803:f900::/32 inetnum: 186.2.160.0/20
nic-hdl: HUN8 person: Huan Nadas e-mail: [email protected] address: Avenue Jorge Perez Concha, 712, - address: 090511 - Guayaquil - country: EC phone: +7 9282797045 [0000] created: 20150320 changed: 20200923
See this reporting from The Guardian about DDoS-Guard among other things:
"DDoS-Guard, the company that provided services to VanwaTech until earlier this week, was registered under a limited partnership, a financial structure in Scotland that allows non-residents to create companies with little scrutiny, on 24 November 2017 by Aleksei Likhachev and Evgeniy Marchenko – two Russian businessmen who remain owners of the company. The partnership under which DDoS-Guard is registered is called Cognitive Cloud and is listed at an address in Edinburgh’s Forth Street.
Speaking from the southern Russian city of Rostov-on-Don earlier this week, Marchenko told the Guardian that 8kun was not a direct client of DDoS-Guard, but that his company provided services to VanwaTech.
...
Asked why he used a company based in Scotland, Marchenko said: “Why not? The UK is very comfortable for business. I visited London one time, 14 years ago.” He said: “We don’t support any illegal activity. We know nothing about what happened in Washington or support one side or another. This company [VanwaTech] is just one of our many customers.”
DDoS-Guard’s other clients include the Russian ministry of defense, as well as media organizations in Moscow. The firm’s webpage links to an official ministry history, which sets out recent steps the Kremlin has taken to ban the use of smartphones by Russian soldiers, after a series of leaks."
https://www.theguardian.com/technology/2021/jan/15/8kun-8cha...
"DDoS-Guard, the company that provided services to VanwaTech until earlier this week, was registered under a limited partnership, a financial structure in Scotland that allows non-residents to create companies with little scrutiny, on 24 November 2017 by Aleksei Likhachev and Evgeniy Marchenko – two Russian businessmen who remain owners of the company. The partnership under which DDoS-Guard is registered is called Cognitive Cloud and is listed at an address in Edinburgh’s Forth Street.
Speaking from the southern Russian city of Rostov-on-Don earlier this week, Marchenko told the Guardian that 8kun was not a direct client of DDoS-Guard, but that his company provided services to VanwaTech.
...
Asked why he used a company based in Scotland, Marchenko said: “Why not? The UK is very comfortable for business. I visited London one time, 14 years ago.” He said: “We don’t support any illegal activity. We know nothing about what happened in Washington or support one side or another. This company [VanwaTech] is just one of our many customers.”
DDoS-Guard’s other clients include the Russian ministry of defense, as well as media organizations in Moscow. The firm’s webpage links to an official ministry history, which sets out recent steps the Kremlin has taken to ban the use of smartphones by Russian soldiers, after a series of leaks."
https://www.theguardian.com/technology/2021/jan/15/8kun-8cha...
John Matze met a Russian woman, married her in Russia, and then travelled around Russia for about 8 months before coming back to Vegas and starting Parler. I don't find it very surprising that Parler has ties to Russia..
More details in following threads:
https://twitter.com/davetroy/status/1327253991936454663
https://twitter.com/VickerySec/status/1302815780782764033
https://twitter.com/davetroy/status/1327253991936454663
https://twitter.com/VickerySec/status/1302815780782764033
> Troy reported that Mukhutidinova's mother's name is Gulnara, a longtime government functionary who was an "Honored Builder of Russia" in Soviet times.
https://www.the-sun.com/news/2118059/john-matzes-wife-alina-...
https://www.the-sun.com/news/2118059/john-matzes-wife-alina-...
Honestly I'm not surprised that Parler found services outside of the US to use. I feel like Russian companies are probably the most resistant to western-progressive's boycotts.
Are you surprised that they didn't do it initially?
Remember when the US government made sure Snowden couldn't travel to any other country, let alone return to the US, then used the fact that he stayed in russia as evidence for his russian ties? This is just as cynical.
Would ddos guard not be like cloudflare and be just a front end? Could it be hosted somewhere else, and they just act as a protection?
I wouldn't go that far; if you go to parler.com, it's just a simple website saying they have technical difficulties and will be back.
Parler.com points to a single IP address, 190.115.31.151
This IP address is registered to “LACNIC” and was allocated to DDOS-GUARD Corp.
The “responsible” person aka who it was allocated to is “Evgeniy Marchenko” from Belize.
There’s also another listed person from “Guayaquil Ecuador” whose email is “xengine[at]mail.ru” and the phone number listed is +7 which is Russia’s country code.
Russians are literally going to be hosting Parler when it comes back online.