full-disclosure - Comment spam: drive-by sites, domains and spyware

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <43F25D1B.7010704@linuxbox.org>
Date: Tue Feb 14 22:45:12 2006
From: ge at linuxbox.org (Gadi Evron)
Subject: Comment spam: drive-by sites,
 domains and spyware - analysis, samples and facts

Warning: this post is being X-posted.

Blog/web spam is not the next spam medium, it is spam plain and simple. 
People, including some anti spam experts, just don't realize how big it 
all is. It's not only about spam, it is about spyware, bots and breaking 
into computers.
How about I provide with some facts?

Below are some selected spam samples from one of the high-traffic blogs 
I help maintain. Some of them are included for the repeat-offenders 
point being made, showing the different IP addresses that attacked us 
from a botnet/proxy list of compromised (broken into) systems.

NOTE: The URL's quoted are NOT safe. DO NOT go there unless you know 
what you are doing. Responsibility is yours alone.

As an example, take a look at:
http://w ww.hackologie.tk/

It is a site for a drive-by. Spyware you say? Find out. :)

Below, further in the text, I start an analysis, showing hundreds of DNS 
RR's for just one of the IP's you will find looking at the A record for 
that site.

This is indeed one of the uses for the new black-list some of us are 
creating. Cooperative effort to compare spams across different blogs, 
analyze them, find distinct groups and block them, as well as terminate 
their domain names.

FURTHER - it's a nice way to find their new Trojan horses and spyware, 
as well as their new domains. These samples will then be reported to 
anti virus and anti spyware vendors, as much like we will work to 
terminate the domains - we will also work to make their malware useless.

The malware proves that most of these guys are not just annoying 
spammers abusing our services, AUP's, users and privacy. It proves they 
break into computers as well as try and break into ours.

Anti spam projects will get a feed so that whatever medium they spam, we 
will all cooperate to kick them back.

So far some of the biggest blogging sites online are enlisted on our 
effort (which is not limited to this), we will see what happens.

My previous (most recent) post on this subject can be found here:
http://blogs.securiteam.com/index.php/archives/285

This post can be found here:
http://blogs.securiteam.com/index.php/archives/290

Some more analysis on the bad site I spoke of above as an example:

A full analysis will take time I don't have, so let's just show a few 
teasers to get you curious!

"Due to restrictions in Dot TK's Privacy Statement personal information 
about the user of the domain name cannot be released."

^^^ Ain't that convenient?

Domain	Type	Class	TTL	Answer

  hackologie.tk.	MX	IN	86400	mx-host.dot.tk. [Preference = 20]
  hackologie.tk.	A	IN	300	62.129.131.38
  hackologie.tk.	A	IN	300	217.115.203.21
  hackologie.tk.	A	IN	300	195.20.32.104
  hackologie.tk.	A	IN	300	209.172.59.193
  hackologie.tk.	A	IN	300	217.119.57.19
  tk.	NS	IN	86400	root-g.taloha.tk.
  tk.	NS	IN	86400	ns-a.taloha.tk.
  tk.	NS	IN	86400	ns-b.taloha.tk.
  tk.	NS	IN	86400	ns-c.taloha.tk.
  tk.	NS	IN	86400	root-a.taloha.tk.
  tk.	NS	IN	86400	root-b.taloha.tk.
  tk.	NS	IN	86400	root-c.taloha.tk.
  tk.	NS	IN	86400	root-d.taloha.tk.
  tk.	NS	IN	86400	root-e.taloha.tk.
  tk.	NS	IN	86400	root-f.taloha.tk.
  root-g.taloha.tk.	A	IN	21600	217.68.243.17
  ns-a.taloha.tk.	A	IN	21600	62.41.22.202
  ns-b.taloha.tk.	A	IN	21600	195.11.245.84
  ns-c.taloha.tk.	A	IN	21600	216.38.132.90
  root-a.taloha.tk.	A	IN	21600	194.109.152.138
  root-b.taloha.tk.	A	IN	21600	195.20.32.102
  root-c.taloha.tk.	A	IN	21600	207.36.228.217
  root-d.taloha.tk.	A	IN	21600	217.199.176.121
  root-e.taloha.tk.	A	IN	21600	66.36.231.236
  root-f.taloha.tk.	A	IN	21600	202.125.44.173

Just a FEW of the DNS RR's pointing to just one of the IP addresses:
www.*****.tk	 A 	62.129.131.38
www.*.tk	 A 	62.129.131.38
www.-fctwente-.tk	 A 	62.129.131.38
www.-beach-.tk	 A 	62.129.131.38
www.-erki-.tk	 A 	62.129.131.38
www.atletiek2000.tk	 A 	62.129.131.38
www.beveren2000.tk	 A 	62.129.131.38
www.cj800.tk	 A 	62.129.131.38
www.boca80.tk	 A 	62.129.131.38
bomma80.tk	 A 	62.129.131.38
www.armenia90.tk	 A 	62.129.131.38
em0.tk	 A 	62.129.131.38
www.stropkaai31.tk	 A 	62.129.131.38
www.piaa1.tk	 A 	62.129.131.38
www.devalkb1.tk	 A 	62.129.131.38
www.brambo1.tk	 A 	62.129.131.38
www.ignis1.tk	 A 	62.129.131.38
www.thesims-2.tk	 A 	62.129.131.38
www.biot2002.tk	 A 	62.129.131.38
www.5voor12.tk	 A 	62.129.131.38
www.boelie-v32.tk	 A 	62.129.131.38
www.jordistylertje-b42.tk	 A 	62.129.131.38
www.seca2.tk	 A 	62.129.131.38
www.pitagora2.tk	 A 	62.129.131.38
www.mywitchworld2.tk	 A 	62.129.131.38
www.4hwe2.tk	 A 	62.129.131.38
aandetoog2.tk	 A 	62.129.131.38
www.aandetoog2.tk	 A 	62.129.131.38
www.lmk2.tk	 A 	62.129.131.38
www.cosan2.tk	 A 	62.129.131.38
www.jones2.tk	 A 	62.129.131.38
www.part2.tk	 A 	62.129.131.38
w.driver-3.tk	 A 	62.129.131.38
www.'tng2003.tk	 A 	62.129.131.38
w-i-t-c-h-g-i-r-l-13.tk	 A 	62.129.131.38
groep13.tk	 A 	62.129.131.38
www.groep13.tk	 A 	62.129.131.38
www.atelier13.tk	 A 	62.129.131.38
www.warez13.tk	 A 	62.129.131.38
www.warez33.tk	 A 	62.129.131.38
www.shark69-shinzl3.tk	 A 	62.129.131.38
www.muzikamp3.tk	 A 	62.129.131.38
www.warez-t3.tk	 A 	62.129.131.38
www.vak-v3.tk	 A 	62.129.131.38
abi04.tk	 A 	62.129.131.38
www.mss-abi04.tk	 A 	62.129.131.38
www.abi04.tk	 A 	62.129.131.38
www.trash14.tk	 A 	62.129.131.38
www.harry-potter14.tk	 A 	62.129.131.38
www.rahoveci24.tk	 A 	62.129.131.38
studi24.tk	 A 	62.129.131.38
www.studi24.tk	 A 	62.129.131.38
studiok4.tk	 A 	62.129.131.38
www.studiok4.tk	 A 	62.129.131.38
www.sv4.tk	 A 	62.129.131.38
www.diesel4x4.tk	 A 	62.129.131.38
www.ampuria2005.tk	 A 	62.129.131.38
www.zw-maloja2005.tk	 A 	62.129.131.38
www.mosta2005.tk	 A 	62.129.131.38
sb2005.tk	 A 	62.129.131.38
www.vormsel2005.tk	 A 	62.129.131.38
halo-clan2005.tk	 A 	62.129.131.38
www.grandkemer2005.tk	 A 	62.129.131.38
abi05.tk	 A 	62.129.131.38
www.lissabon05.tk	 A 	62.129.131.38
www.dieter-b35.tk	 A 	62.129.131.38
www.gdw85.tk	 A 	62.129.131.38
www.witchmagazine5.tk	 A 	62.129.131.38
www.tbc-2006.tk	 A 	62.129.131.38
tds-2006.tk	 A 	62.129.131.38
www.tds-2006.tk	 A 	62.129.131.38
www.oeganda2006.tk	 A 	62.129.131.38
www.tbc2006.tk	 A 	62.129.131.38
www.amuzed2006.tk	 A 	62.129.131.38
jeugdweekend2006.tk	 A 	62.129.131.38
www.jeugdweekend2006.tk	 A 	62.129.131.38
www.festivalveurne2006.tk	 A 	62.129.131.38
www.lkf2006.tk	 A 	62.129.131.38
www.extremepaintball2006.tk	 A 	62.129.131.38
www.mfm2006.tk	 A 	62.129.131.38
www.tds2006.tk	 A 	62.129.131.38
www.skireis2006.tk	 A 	62.129.131.38
www.eindejaarsreis2006.tk	 A 	62.129.131.38
www.lost2006.tk	 A 	62.129.131.38
wewi06.tk	 A 	62.129.131.38
www.wewi06.tk	 A 	62.129.131.38
www.vat18jarigen06.tk	 A 	62.129.131.38
winx-club16.tk	 A 	62.129.131.38
www.stel7076.tk	 A 	62.129.131.38
www.knuffeltje6.tk	 A 	62.129.131.38
www.elle6.tk	 A 	62.129.131.38
www.p407.tk	 A 	62.129.131.38
newssvt07.tk	 A 	62.129.131.38
www.fcvdendereh-u17.tk	 A 	62.129.131.38
www.zeal7.tk	 A 	62.129.131.38
www.ir2008.tk	 A 	62.129.131.38
www.sart68.tk	 A 	62.129.131.38
www.revenge88.tk	 A 	62.129.131.38
www.ami8.tk	 A 	62.129.131.38
www.steakn8.tk	 A 	62.129.131.38
www.leerlingengroep8.tk	 A 	62.129.131.38
www.hypnos69.tk	 A 	62.129.131.38
www.hsl9.tk	 A 	62.129.131.38
www.myt9.tk	 A 	62.129.131.38
www.iw3a.tk	 A 	62.129.131.38
www.leaaa.tk	 A 	62.129.131.38
www.dutchmohaa.tk	 A 	62.129.131.38
daba.tk	 A 	62.129.131.38
www.chimbawamba.tk	 A 	62.129.131.38
www.crystalcynthiawicca.tk	 A 	62.129.131.38
www.chemica.tk	 A 	62.129.131.38
www.sowada.tk	 A 	62.129.131.38
www.taida.tk	 A 	62.129.131.38
www.woida.tk	 A 	62.129.131.38
www.laestampida.tk	 A 	62.129.131.38
www.tango-querida.tk	 A 	62.129.131.38
www.provida.tk	 A 	62.129.131.38
www.juf-linda.tk	 A 	62.129.131.38
www.janenlinda.tk	 A 	62.129.131.38
www.alyda.tk	 A 	62.129.131.38
www.geonea.tk	 A 	62.129.131.38
www.chiroharbalorifa.tk	 A 	62.129.131.38
www.agst-antifa.tk	 A 	62.129.131.38
www.indoorsoccerliga.tk	 A 	62.129.131.38
www.langa.tk	 A 	62.129.131.38
www.remmertwielinga.tk	 A 	62.129.131.38
www.kogonga.tk	 A 	62.129.131.38
www.komboecha.tk	 A 	62.129.131.38
www.bullmastiffsvanboedha.tk	 A 	62.129.131.38
www.sopha.tk	 A 	62.129.131.38
www.trisyha.tk	 A 	62.129.131.38
www.nefaia.tk	 A 	62.129.131.38
www.jeugdclubjia.tk	 A 	62.129.131.38
www.flora-helia.tk	 A 	62.129.131.38
www.eendrachtfamilia.tk	 A 	62.129.131.38
www.zvcutopia.tk	 A 	62.129.131.38
www.spoofzakaria.tk	 A 	62.129.131.38
www.caracastasia.tk	 A 	62.129.131.38
www.chirosinttheresia.tk	 A 	62.129.131.38
www.necromantia.tk	 A 	62.129.131.38
tweeja.tk	 A 	62.129.131.38
www.skorpija.tk	 A 	62.129.131.38
www.nathasja.tk	 A 	62.129.131.38
www.mavicka.tk	 A 	62.129.131.38
www.jhjeka.tk	 A 	62.129.131.38
www.stepashka.tk	 A 	62.129.131.38
www.kinetika.tk	 A 	62.129.131.38
www.nautika.tk	 A 	62.129.131.38
www.kutunka.tk	 A 	62.129.131.38
www.stejoka.tk	 A 	62.129.131.38
www.szczepkowska.tk	 A 	62.129.131.38
www.proxilala.tk	 A 	62.129.131.38
www.vila.tk	 A 	62.129.131.38
www.shabhekla.tk	 A 	62.129.131.38
vinylla.tk	 A 	62.129.131.38
www.vinylla.tk	 A 	62.129.131.38
www.wakayama.tk	 A 	62.129.131.38
www.bacma.tk	 A 	62.129.131.38
www.therasmusmaailma.tk	 A 	62.129.131.38
www.jussinloma.tk	 A 	62.129.131.38
www.druma.tk	 A 	62.129.131.38
escortalana.tk	 A 	62.129.131.38
www.hodena.tk	 A 	62.129.131.38
www.christin-jena.tk	 A 	62.129.131.38
www.chironazoena.tk	 A 	62.129.131.38
supermagna.tk	 A 	62.129.131.38
www.mondina.tk	 A 	62.129.131.38
winx-pagina.tk	 A 	62.129.131.38
www.kidspagina.tk	 A 	62.129.131.38
www.aanvullingspagina.tk	 A 	62.129.131.38
www.tomenkarolina.tk	 A 	62.129.131.38
www.vansina.tk	 A 	62.129.131.38
www.aaatina.tk	 A 	62.129.131.38
www.wouterenanna.tk	 A 	62.129.131.38
www.cenna.tk	 A 	62.129.131.38
ww.jamilahenna.tk	 A 	62.129.131.38
www.mktupa.tk	 A 	62.129.131.38
www.waira.tk	 A 	62.129.131.38
www.sectumsempra.tk	 A 	62.129.131.38
www.club-sakura.tk	 A 	62.129.131.38
www.joura.tk	 A 	62.129.131.38
www.mrsa.tk	 A 	62.129.131.38
www.gojirafanusa.tk	 A 	62.129.131.38
hhakunamatata.tk	 A 	62.129.131.38
www.rs3beta.tk	 A 	62.129.131.38
www.5humweta.tk	 A 	62.129.131.38
www.sanderenanita.tk	 A 	62.129.131.38
ukta.tk	 A 	62.129.131.38
www.chirojuventa.tk	 A 	62.129.131.38
www.juf-tinta.tk	 A 	62.129.131.38
www.titta.tk	 A 	62.129.131.38
www.clanfuta.tk	 A 	62.129.131.38
www.wisnatua.tk	 A 	62.129.131.38
www.djalbflava.tk	 A 	62.129.131.38
www.juliapentcheva.tk	 A 	62.129.131.38
www.ligamufova.tk	 A 	62.129.131.38
www.oipova.tk	 A 	62.129.131.38
www.osipova.tk	 A 	62.129.131.38
www.vanallesewa.tk	 A 	62.129.131.38
www.dfwa.tk	 A 	62.129.131.38

I don't even want to hazzard a guess as to what I would find if I 
followed every host and every IP address, and then looked at what each 
NS is hosting and kept following...

Time for other baddies in the following blog spam samples:

Details are in the following order -
Title
Nickname entered
E-mail entered
IP posted from
URL entered
URL's found in the post DATA (contents)

Not all fields are present in all the below posts.
Some of the links below break.
Not all these host malware, some are just annoying spam.

ALL THESE LINKS ARE TO BE CONSIDERED NOT SAFE. VISIT AT YOUR OWN RISK.

notebook computer ac
Author: notebook computer accessories
E-mail: netsecu11@...oo.com
IP: 200.121.71.53
URL: http://w ww.notebook-computers.co?m-infor.com?
	
Laser Cutting Servic
Author: Laser Cutting Service
E-mail: laser-cutting-service@...igrom.c?om?
IP: 200.117.186.202
URL: http://w ww.laser-cutting-pro.inf?o/laser-cutting-service/laser-cu? 
tting-services.html?
	
Cheap laptop skins
E-mail: shopcart963@...oo.com
IP: 200.121.71.53
URL: http://w ww.cheap-laptops.com-inf?or.com?
	
benozor77
E-mail: webmaster@...kologie.tk
IP: 82.65.181.88
URL: http://w ww.hackologie.tk/

allegra
E-mail:
IP: 203.162.27.81
URL: http://w ww.20mbweb.com/Health/al?legra/?
	
allegra
E-mail:
IP: 202.58.85.6
URL: http://w ww.20mbweb.com/Health/al?legra/?

google pr main
E-mail: sdb6xgc@...il.com
IP: 202.58.85.8
URL: http://w ww.pr.com

http://w ww.pr.com/contacts/
	
google pr main
E-mail: mci6r4b@...os.com
IP: 213.249.155.240
URL: http://w ww.pr.com

http://w ww.pr.com/contac
http://w ww.pr.com
	
pagerank main
E-mail: cfz6qf2@...rch.com
IP: 140.134.4.80
URL: http://w ww.pr.com

http://w ww.pr.com/improvep
http://w ww.pr.com/linksale/?
http://w ww.pr.com
	
online directory mai
Author: online directory main
E-mail: ybww8h9@...y.com
IP: 207.225.139.26
URL: http://w ww.yp.com

http://w ww.yp.com/Sweden/
	
online directory mai
Author: online directory main
E-mail: blcr4cw@...mail.com
IP: 140.134.4.80
URL: http://w ww.yp.com

http://w ww.yp.com/Sweden
http://w ww.yp.com
	
google pr main
E-mail: zjfzw3f@...l.ru
IP: 213.249.155.240
URL: http://w ww.pr.com

http://w ww.pr.com/contacts/
	
google pr main
E-mail: hejlj0e@...il.com
IP: 207.225.139.26
URL: http://w ww.pr.com

http://w ww.pr.com/contac
http://w ww.pr.com
	
pagerank main
E-mail: eqnm7ht@...oo.com
IP: 140.134.4.80
URL: http://w ww.pr.com

http://w ww.pr.com/improvep
http://w ww.pr.com/linksale/?
http://w ww.pr.com
	
yellow pages main
E-mail: smlrkt2@...mail.com
IP: 66.232.147.211
URL: http://w ww.yp.com

http://w ww.yp.com/India/
http://w ww.yp.com/China/
http://w ww.yp.com

no-deposit-casino
IP: 81.31.160.4
URL: http://c asino2006.ca.funpic.de/n?o-deposit-casino.htm?
	
swimsuits
E-mail: akochgdls@...g.com
IP: 203.162.27.87
URL: http://z oomy.home.sapo.pt/ljqff/?human.html?

http://z oomy.home.sapo.pt/ljqff/?ebo?
http://z oomy.home.sapo.pt/toon/2?qz342llxv/cartoonmanga.html?
	
Phentermine
E-mail: contact@...ntermine-support.com
IP: 202.58.85.6
URL: http://w ww.phentermine-support.c?om?

http://b ingo.up-a.com
http://w ww.cheapest-v?iagra-source.com
http://t amiflu.usa-onli?ne-pharmacy.net
http://w ww.viagra-here.c?om
http://w ww.viagra-exchange.com
http://w ww.0-online-c?asino.us
http://w ww?.0-poker.biz
http://w ww.phentermine-s?upport.com
http://w ww.casino-focu?s.com/
	
lorazepam
IP: 68.60.116.167
URL: http://l orazepam1.lo.funpic.de/l?orazepam.htm?

	Gadi.