Romania: A Well-known Cybercrime Haven


Romania is a country that many Internet security researchers and various law enforcement agencies equate with cybercrime and have probably had that mind for quite a while now.  Even some casual readers of spam news know about Romania’s bad reputation online. The good news is over the years more and more people directly involved cybercrime rings based in Romania have been caught.

In the latest news, on 6th April, 2010, 70 people were arrested in Romania for phishing and other Internet related fraud. The arrests which were undertaken by the Directorate for the Investigation of Organized Crime in Romania, together with police officers, and followed by over 90 searches issued by prosecutors (Article in Romanian by DIICOT).

Update: 4/12/10 Current time zone: EEST 12:11 AM

The Internet Scammers blog which broke the story earlier last week in English has updated the names of some 34 of these Romanian scammers who engaged in eBay, 419 and other auction fraud  a form of (advance fee fraud – AFF). The source of the story in Romanian is  Romanian Masura Media. which was posted on the 8th of April 2010.

The rough translation into English via Google is here as kindly provided by the writer at the Internet Scammers blog.  According to the translation into the English with the aid of the FBI, DDICOT, and other law enforcement agencies, according to investigators since 2006, the three organized criminal groups have acted in several countries  including: Spain, Italy, France, New Zealand, Denmark, Sweden, Germany, Austria, USA, Canada, and Switzerland. They were organizing fraudulent auctions through the Internet. … There could be up to 250 people involved in three separate criminal groups.

Backstory in Clamping down on Romanian Cybercrime

In more recent years, there has been more success by various law enforcement agencies to arrest Romanian-based cybercriminals. Romanian officials have been working harder with international law enforcement to make these arrests possible. Romanian Prosecutor-General Laura Codruta Kövesi was noted as a McAfee Cybercrime Fighter Award Winner in 2008. These recent successes of arrests are worth definitely noting, so that more cybercriminals are eventually caught in other countries in part to more increased government cooperation with international law enforcement, in other nations nearby such as Russia, Estonia, Ukraine, and some other East European nations.

Romanian Flag

Romania has had a strong presence or digital footprint online for well over a decade now as compared to some other countries of its size. Romania has around 22 million people and ranks as the 51th most populated country in the world according to the CIA Factbook. Romania’s presence online in terms of users and that of Internet IP hosts does outranks many other countries relative to its size and outranks some larger countries as well who are not as wired in general. Romania has an active hacker community and Romanians are well represented on IRC (Instant Relay Chat).

Since breaking away from the shackles of the Soviet Bloc in policy lead by the brutal dictator Nicolae Ceauşescu whose rule ended violently in 1989, Romania has gone through a lot of political transformation from a communist country to that of aligning itself more with Western Europe and the United States for the past 2 decades. Romania joined NATO since 2004 has been in the European Union since 2007. For more about Romania’s geopolitical history as former Soviet Satellite, check out its English-language Wikipedia entry.

While Broadband penetration study for European countries in percentage amongst Romanians is not ranked very high (24%) according to Tech Crunchies, the average Romanian enjoys a very high speed on the Internet  as ranked with those from other countries: Ranked #4 in the Top 10 with 6.2 Mbps. (Download Speeds of Megabits per Second).

Romanians have been involved in cybercrime in larger numbers for at least a decade now which is quite a longtime for the average lifespan of any particular online activity. For several years now, Romania has had a tarnished reputation similar to those cybercriminal reputations of much larger countries such as Nigeria, Brazil, Russia, China and the United States.

70 Romanians Arrested in April 2010

Despite these facts, there have been recent arrests of large numbers of cybercriminals in Romania in the past few years. We  are highlighting the most recent arrest of 70 people arrested in Romania on April 6th, 2010 which was first posted on Internet Scammers blog in English. We will post more details as they come available.

Spamhaus Blocklists large swaths of Romanian ISP EuroWeb.RO:

In early April 2010, Spamhaus blocklisted large IP ranges of this Romanian ISP: for hosting botnet and various cybercrime enterprises with the latest name Due to the recent blocklistings, it would be a good guess this provider will get rid of these blackhat accounts. The downstream which is causing these listings is called At the time of this posting, there were 7 active SBLs for

The most recent listings are:

07-Apr-2010 to  11-Apr-2010 Listed on SBL

The /19 listing is over 8000 IP addresses. The smallest netblock is /24 which is 256 IP addresses.  A few details to note below from the SBL88578 :

07-Apr-2010 01:21 GMT
Botnet/cybercrime spammer hosting:

AS38913 Enter-Net-Team-AS
AS31571 ALtNet Bucharest, ROMANIA

Notable External Links for Further Reading / Information:

There have been several recent arrests of cybercriminals in Romania over the past few years. Below are some recent highlights:

Informational Blogs to Video Links:

Internet Scammers: 70 Romanians Arrested on 6th of April 2010

CyberCrime & Doing Time: 70 Romanian Phishers & Fraudsters Arrested


YouTube: Safe Internet – Romanian Child Safety Commercial – (1 min)

Older News Stories – (incomplete)

2008: SC: Romanian cybercrime ring busted

2003: MSNBC: How Romania became a center of cybercrime


NirSoft: Romanian IP Ranges

ROTLD Registry: .RO rules for TLD usage

No Responses Yet to “Romania: A Well-known Cybercrime Haven”

  1. Leave a Comment

Leave a Reply

Please log in using one of these methods to post your comment: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: