[89512] in North American Network Operators' Group
Re: Ongoing DDoS helped by non responsive abuse desks
daemon@ATHENA.MIT.EDU (Martin Lathoud)
Thu Mar 23 11:35:34 2006
Date: Thu, 23 Mar 2006 11:35:02 -0500
From: "Martin Lathoud" <nytral@gmail.com>
To: nanog@merit.edu
In-Reply-To: <A1452A4B-29F8-4C58-8A67-625916C14222@blighty.com>
Errors-To: owner-nanog@merit.edu
2006/3/23, Steve Atkins <steve@blighty.com>:
> [snip]
> >
> > target[0]=3D"http://weerona.com/ph/order.php?%rand%"
> > target[1]=3D"http://fabutons.info/aw/001/?%rand%"
> > target[2]=3D"http://movi96.dayaugusta.com/aspx/search.asp?t=3D%rand%"
> > target[3]=3D"http://www.fakeidonline.com/store.php?%rand%"
> > target[4]=3D"http://ccebak.bestti.info/p/?%rand%"
> > target[5]=3D"http://www.zpgo.net/pweb7/texpo/?%rand%"
> > target[6]=3D"http://www.tex-win.com/productshow.asp?id=3D1808&%rand%=3D=
%
> > rand%"
> > target[7]=3D"http://7eklp9g3.tagsully.net/p/?%rand%&zz=3Dlowcost"
> >
>
> Which of these is your website?
none, they change A records of these rogue domains as they see fit to
spread the attack among more victims.
