Portrait of a Spam BotNet

Comment spammers are thick on social networking sites like Digg most of their comments include a link back to a bogus site. If you go to their profile you will see all of the spam they have posted and it is easy to bury from there. Post a link to that page here and we can all bury it as spam.

Moderators: JeanInMontana, rockingmtranch, ShadowPuterDude, admin, MysteryFCM, Owner

User avatar
JeanInMontana
It's Mine!!
It's Mine!!
Posts: 3331
Joined: Fri Jun 08, 2007 6:10 am
Location: South Central Montana
Contact:

Portrait of a Spam BotNet

Postby JeanInMontana » Tue Jul 17, 2007 11:49 am

This is amazing, what a find. Read the full story and have a look at the screen shots they are really eye popping. http://www.symantec.com/enterprise/secu ... alone.html

Earlier this year, I saw some screenshots of the Zunker bot and its controlling interface. I became curious about the existence of other similar interfaces and began paying a bit more attention to the spam coming into my inbox on a personal account. After a few weeks of wandering through IP blocks referenced by the spam, I ran across an open directory containing a few screen shots of what looked like another interface actively spamming multiple products.

The following screen shot shows a statistics screen for a botnet they are currently using. Similar to the Zunker interface, this interface also has the ability to group by country. It looks like the feature is broken though, as you can only see one bot, which is originating from Poland. Given that, it is tempting to presume the owner is Polish; however, the interface's text is entirely in English and the screen shot was found on a Russian server. It could, however, mean that the person leasing this interface is controlling it from a machine in Poland, but this is just an assumption.
~Think Globally * Dream Universally~Anon
ImageImageImage Donating any amount helps keep this site alive.

User avatar
rockingmtranch
I Have Powah
I Have Powah
Posts: 1893
Joined: Sat Jun 09, 2007 11:13 pm
Location: Meadowbrook, CA
Contact:

Postby rockingmtranch » Tue Jul 17, 2007 12:59 pm

Wow. I would love to know how he found the directories to look through them. Sounds fascinating. Like a treasure hunt of sorts.
Linux. Don't fight it. You will be assimilated.
*******
Gulf War Vet--2nd Squadron, 2nd Armored Cavalry--Fort Polk, LA

User avatar
JeanInMontana
It's Mine!!
It's Mine!!
Posts: 3331
Joined: Fri Jun 08, 2007 6:10 am
Location: South Central Montana
Contact:

Postby JeanInMontana » Tue Jul 17, 2007 1:29 pm

Well it says he started by going through the netblocks in his "personal" spam. The way I read it was someone must have left the door open so to speak. I'm sure it wasn't on purpose. But, who knows. These guys are fairly smug in their attitudes and with good reason. It is very hard to catch and prosecute them, many operate out of lawless countries or countries that just don't care.
~Think Globally * Dream Universally~Anon
ImageImageImage Donating any amount helps keep this site alive.

User avatar
rockingmtranch
I Have Powah
I Have Powah
Posts: 1893
Joined: Sat Jun 09, 2007 11:13 pm
Location: Meadowbrook, CA
Contact:

Postby rockingmtranch » Tue Jul 17, 2007 4:20 pm

Ah...that makes sense. Maybe I'll get lucky someday 8)
Linux. Don't fight it. You will be assimilated.
*******
Gulf War Vet--2nd Squadron, 2nd Armored Cavalry--Fort Polk, LA

User avatar
JeanInMontana
It's Mine!!
It's Mine!!
Posts: 3331
Joined: Fri Jun 08, 2007 6:10 am
Location: South Central Montana
Contact:

Postby JeanInMontana » Tue Jul 17, 2007 4:27 pm

If you use Firefox I recommend the DNSStuff toolbar. It has spam DBASE lookup plus several DNS dada base options, ton of resources and you can hide it when your not using it so you get the space back. extentions.roachfiend.com You will have to hunt around on that site, it's not actually there but that is what it says in the "about" for the thing.
~Think Globally * Dream Universally~Anon
ImageImageImage Donating any amount helps keep this site alive.

User avatar
rockingmtranch
I Have Powah
I Have Powah
Posts: 1893
Joined: Sat Jun 09, 2007 11:13 pm
Location: Meadowbrook, CA
Contact:

Postby rockingmtranch » Tue Jul 17, 2007 5:07 pm

I'll tell ya. Sometimes! If I'm in the DNSStuff site and click install, it should do something right? Well, not if I'm using Galeon browser at the time LMFAO.....I need to start taking those pills that help with memory. I can't remember what they are called though. :?
Linux. Don't fight it. You will be assimilated.
*******
Gulf War Vet--2nd Squadron, 2nd Armored Cavalry--Fort Polk, LA

User avatar
JeanInMontana
It's Mine!!
It's Mine!!
Posts: 3331
Joined: Fri Jun 08, 2007 6:10 am
Location: South Central Montana
Contact:

Postby JeanInMontana » Tue Jul 17, 2007 8:25 pm

There is nothing to install. I don't know what you mean? Ginko Bilboa?
~Think Globally * Dream Universally~Anon
ImageImageImage Donating any amount helps keep this site alive.

User avatar
rockingmtranch
I Have Powah
I Have Powah
Posts: 1893
Joined: Sat Jun 09, 2007 11:13 pm
Location: Meadowbrook, CA
Contact:

Postby rockingmtranch » Tue Jul 17, 2007 8:35 pm

When I went to DNSStuff, there is a download button. I was on Tina's pc at the time. I don't use Firefox on hers but I'm on mine now. I'll give 'er a try.

Ok. Looking at this site, I was in the wrong place. Good thing I've got Linux going around smelly-nelly clicking stuff. :D
Linux. Don't fight it. You will be assimilated.
*******
Gulf War Vet--2nd Squadron, 2nd Armored Cavalry--Fort Polk, LA

User avatar
rockingmtranch
I Have Powah
I Have Powah
Posts: 1893
Joined: Sat Jun 09, 2007 11:13 pm
Location: Meadowbrook, CA
Contact:

Postby rockingmtranch » Tue Jul 17, 2007 8:40 pm

Ginko Bilboa? Naw, that can't be it is it?
Linux. Don't fight it. You will be assimilated.
*******
Gulf War Vet--2nd Squadron, 2nd Armored Cavalry--Fort Polk, LA

User avatar
JeanInMontana
It's Mine!!
It's Mine!!
Posts: 3331
Joined: Fri Jun 08, 2007 6:10 am
Location: South Central Montana
Contact:

Postby JeanInMontana » Tue Jul 17, 2007 8:52 pm

You don't need a memory pill you need glasses! extentions.roachfiend.com That is where the extension is, it is called DNSStuff toolbar.

Here it is https://addons.mozilla.org/en-US/firefox/addon/827
:rotf:
~Think Globally * Dream Universally~Anon
ImageImageImage Donating any amount helps keep this site alive.

User avatar
rockingmtranch
I Have Powah
I Have Powah
Posts: 1893
Joined: Sat Jun 09, 2007 11:13 pm
Location: Meadowbrook, CA
Contact:

Postby rockingmtranch » Tue Jul 17, 2007 9:03 pm

Glasses could be useful. We keep threatening to get our glasses up to date. However, that site is unavailable. I tried it first and again just now.
Linux. Don't fight it. You will be assimilated.
*******
Gulf War Vet--2nd Squadron, 2nd Armored Cavalry--Fort Polk, LA

User avatar
rockingmtranch
I Have Powah
I Have Powah
Posts: 1893
Joined: Sat Jun 09, 2007 11:13 pm
Location: Meadowbrook, CA
Contact:

Postby rockingmtranch » Tue Jul 17, 2007 9:04 pm

Ok Jean. Now that is the site I was talking about. The Install now button is right there.

I, uh, suppose that's to install Firefox. This is exactly the reason I tried to do this stuff in PM. At least only you knew how scatterbrained I was.
Linux. Don't fight it. You will be assimilated.
*******
Gulf War Vet--2nd Squadron, 2nd Armored Cavalry--Fort Polk, LA

User avatar
rockingmtranch
I Have Powah
I Have Powah
Posts: 1893
Joined: Sat Jun 09, 2007 11:13 pm
Location: Meadowbrook, CA
Contact:

Postby rockingmtranch » Tue Jul 17, 2007 9:22 pm

Ok. I didn't realize I was using Galeon so much. I finally hit the install button WHILE in Firefox and it installed. Can I have a cookie? :D
Linux. Don't fight it. You will be assimilated.
*******
Gulf War Vet--2nd Squadron, 2nd Armored Cavalry--Fort Polk, LA

User avatar
JeanInMontana
It's Mine!!
It's Mine!!
Posts: 3331
Joined: Fri Jun 08, 2007 6:10 am
Location: South Central Montana
Contact:

Postby JeanInMontana » Tue Jul 17, 2007 9:38 pm

rockingmtranch wrote:Ok. I didn't realize I was using Galeon so much. I finally hit the install button WHILE in Firefox and it installed. Can I have a cookie? :D


:fdl: Snap out of it man. :slp: :hpprp:
~Think Globally * Dream Universally~Anon
ImageImageImage Donating any amount helps keep this site alive.

User avatar
rockingmtranch
I Have Powah
I Have Powah
Posts: 1893
Joined: Sat Jun 09, 2007 11:13 pm
Location: Meadowbrook, CA
Contact:

Postby rockingmtranch » Tue Jul 17, 2007 9:42 pm

Where's my cookie and now what do I do with the bar? :lol:
Linux. Don't fight it. You will be assimilated.
*******
Gulf War Vet--2nd Squadron, 2nd Armored Cavalry--Fort Polk, LA

User avatar
rockingmtranch
I Have Powah
I Have Powah
Posts: 1893
Joined: Sat Jun 09, 2007 11:13 pm
Location: Meadowbrook, CA
Contact:

Postby rockingmtranch » Tue Jul 17, 2007 9:51 pm

Linux. Don't fight it. You will be assimilated.
*******
Gulf War Vet--2nd Squadron, 2nd Armored Cavalry--Fort Polk, LA


Return to “Mission Comment Spammer”

Who is online

Users browsing this forum: No registered users and 1 guest