Snakes never whisper in one another's ear - it's supposed to tickle. In a blog post yesterday, Sunbelt Labs pointed out on the re-emergence of the Botnet on Demand Service that I covered last year. It's great to see we're on the same page, or wiki article as we can always expand the discussion. In need of more such fancy snakes admin panels courtesy of a web based malware C&C? Here are four more related :
legendarypornmovies.net/ts (88.85.81.211)
slutl.com/ts (88.85.78.7)
cwazo.net/ts (83.222.14.218)
oin.ru/ts (194.135.105.203)
Now the juicy details regarding loads.cc. During the time of posting this, the malicious domain is starting to redirect to a very descriptive one, which basically says "given up on ddos-ing", and a featured ad in between loads.cc's old interface is pitching the new service - contextual advertising consultations, as you can see in the attached screenshot. Apparently, a little more in-depth research acts as public pressure, especially when they're lazy enough to have a great deal of malware variants "phone back home" to their promotional domain. However, the current one responding to 67.228.69.191 is hosted by SoftLayer, and is using ns1.4wap.org as DNS server provided by Layered Technologies again confirming the Russian Business Network connection since, both, Layered Technologies and SoftLayer are known to have been and continue providing services to the RBN, knowingly or unknowingly. Moreover, the malware infected counter at the stats section continues reporting new additions.Being one of the most venerable examples of DDoS for hire services, it's worth reposting its FAQ in an automatically translated fashion, so that a better perspective to the dynamics of offering such services is provided to the readers. Here's the FAQ on using the service, which is relatively easy to understand :
- All that is pure downloads nothing is loaded simultaneously- The "mix" is not Buro countries on specified individual prices
- Loaded only those countries which are specified in the problem
- The country is determined to maxmind geoip
- When it ALL loaded all countries and the price of downloads is calculated separately for each country that is DE for the download you pay for a $ 0.2 PE 0.03
- Prices for downloads can sometimes vary slightly this watch themselves
- As such, the concept of mix does not exist, each country has its own price, and if the country is not clearly specified in the price is $ 30 price / 1k
- The money is withdrawn from the account in accordance with the facts and running leaps ekze by car users
- In the balance on deposit $ 5 or less stopped loading
- No minimum, it is possible to load even though 3 pc 10k limit pointing in the problem
- The claims, made by ALREADY download will not be accepted, DICOM small parties or do the test to check quality
- Following the establishment of tasks it must be activated by clicking on the link in the status, the same method could be suspended
- Pole challenge "received" shows how many bots believed assignment, it is usually little more than a "loaded" on the fabric sur somehow prichnam some boats were not able to download and run your ekze dolzhili or not yet know
Undercover DDoS in between contextual advertising, or "giving up on DDoS" entirely? Let's wait and see, without being naive enough to forget that this among the hundreds of other DDoS for hire services currently available in the wild.
