Not a day goes by without some scam using the ccTLD “tk”. In the last 8 hours there were at least 6 confirmed reports of tk domains faking the Habbo website (a social networking website aimed at teenagers).

In addition, tk registered domains were used twice this month to provide an extra level of obfuscation for the ZeuS/SpyEye botnet. The tk domains used a fast-flux server to reference the NauNet registered domains for the ZeuS/SpyEye botnet fast=flux servers.

BTW, the dot.tk abuse address never responds.

Early this year, monitoring 52 domains used in a ZeuS-Avalanche campaign, lasting from march 26 thru april 1, there were only 310 active hosts and the most referenced site, on one of the large US cable networks, was the active site 60 times more often than the least referenced site. Current campaigns show a similar pattern. It could actually be a good marketing campaign for the cable company! When criminal botnets need speed and reliability they choose xxx cable!

At the time we had Norton AV but no outgoing firewall. Norton displayed a little envelope icon in the tray each time any email was sent, to signify it was scanning it for malware. The infection was noticed only because once an hour, twelve little envelope icons would appear as email was sent, then the process went back into dormancy. After installing a firewall, we were able to identify the process attempting to send the emails so we could manually disable it. We were never notified that anyone had complained of receiving spam from our IP address.

For mailing spam, it’s better to have a large number of bots sending a small volume of email each, so no one of them is reported enough times to get blocklisted.

As far as hosting the spamvertised websites, while it’s better to have a high capacity server, Spamit didn’t always go that route. They have used fast flux botnets in the past that comprised thousands of individual computers. Each computer would only have borne 1/12 of their website traffic, and only for 5 minutes at a time. And they have documented ties to Storm Worm/Waledac, which used a zero-second refresh, so each computer only got traffic for about 1/3 of a second before another shouldered the load. Most of those were definitely small users on dynamic IP ranges. I suspect they only stopped doing it because it was so easy to get their domains shut down by submitting a table of IP addresses and timestamps — the registrars couldn’t dismiss complaints by making the argument that we should complain to the hosting service.

During any botnet email campaign, regardless of the number of domains used, the hosts referenced by the fast-flux servers will be limited to several hundred. And of those, there are definitely favorites. Some of the infected sites will be the “active” host on the fast-flux server 20+ times more often than the least referenced site.

(Hunchback: thanks for the link!)