[SpamCop-List] Re: Lycos DDos Screensaver ?

[Spam N Scams Reporter]

Spam Hater wrote:
> What I am wondering is which sites are on the attack list??  The article I
> read mentioned SpamCop as the source, but SpamCop only lists email
> injection sites, not SPAMvertisers...  So, does that mean the screen saver
> is going after all the zombie boxes that are spewing out the SPAM itself
> or do they have access to some hidden list of SPAMvertisers that we
> report?
> 
> At 10:39 PM 12/1/2004 -0800, sk1w1 typed:
>  
> 
>>snip<
>>Wonder how many users after signing up will get there service threatened 
>>/ cut by their own ISP for 'denial of service' reasons... and/or ISPs 
>>start charging for 'excessive' download volumes...


Here is what seems to be the target list.

 > Here's some operational data captured via ethereal
 >
 > The target list generated by the botnet controller:
 >
 > GET
 > 
/xml/69426058014054/94772079193788/35264029467456/12122010129438/CONFIG_2865
 > 2023942308.xml HTTP/1.1
 > Referer:
 > 
http://backend.makelovenotspam.com/xml/69426058014054/94772079193788/3526402
 > 9467456/12122010129438/CONFIG_28652023942308.xml
 > x-flash-version: 7,0,19,0
 > User-Agent: Shockwave Flash
 > Host: backend.makelovenotspam.com
 > Cache-Control: no-cache
 >
 > HTTP/1.1 200 OK
 > Server: Resin/2.1.14
 > Content-Type: text/xml; charset=UTF-8
 > Content-Length: 2889
 > Connection: close
 > Date: Thu, 02 Dec 2004 15:22:00 GMT
 >
 > <?xml version="1.0" encoding="UTF-8"?>
 > <mlns><targets location="US"><target id="TVRBd01EQXdOVGt5"
 > domain="myshopinternetcompany.com"
 > url="http://myshopinternetcompany.com/?e=aa5100" bytes="357460680"
 > hits="2572309" percentage="100" responsetime01="498" responsetime02="0"
 > location="BR" /><target id="TVRBd01EQXdOVEk0" domain="grlswaiting4u.com"
 > url="http://grlswaiting4u.com/" bytes="206765667" hits="1488797"
 > percentage="100" responsetime01="11866" responsetime02="0" location="US"
 > /><target id="TVRBd01EQXdOVGc0" domain="1stwebsitetheyourshop.com"
 > url="http://1stwebsitetheyourshop.com/?e=aa5100" bytes="317867325"
 > hits="2288427" percentage="100" responsetime01="507" responsetime02="0"
 > location="BR" /><target id="TVRBd01EQXdOVGcx" domain="cheap-r-x.com"
 > url="http://cheap-r-x.com/" bytes="355920802" hits="2565612"
 > percentage="100" responsetime01="787" responsetime02="0" location="CN"
 > /><target id="TVRBd01EQXdOVGcz" domain="www.hlplmanhds.biz"
 > url="http://www.hlplmanhds.biz/" bytes="317590861" hits="2269503"
 > percentage="100" responsetime01="785" responsetime02="0" location="CN"
 > /><target id="TVRBd01EQXdOVEkz" domain="r.vtm.homewo.com"
 > url="http://r.vtm.homewo.com/" bytes="367630639" hits="2248424"
 > percentage="100" responsetime01="5542" responsetime02="0" location="CN"
 > /><target id="TVRBd01EQXdOVE0w" domain="www.incentiverewardcenter.com"
 > 
url="http://www.incentiverewardcenter.com/xg_reg.htm?SID=ab9ee352c3402bdc858
 > 
e5540b887d28a--landing_page=1--show=zip--=--p=92375--c=5411-toys250_720_emc-
 > -catalog_id=14--a=--affil=5408--subid=1" bytes="1028999994" 
hits="6992693"
 > percentage="-144200" responsetime01="1442" responsetime02="-1" 
location="US"
 > /><target id="TVRBd01EQXdOVEk1" domain="www.macromed.ws"
 > url="http://www.macromed.ws/" bytes="742958780" hits="5063804"
 > percentage="100" responsetime01="1212" responsetime02="0" location="RU"
 > /><target id="TVRBd01EQXdOVEEz" domain="www.curdom.com"
 > url="http://www.curdom.com/" bytes="734756904" hits="4831221"
 > percentage="46" responsetime01="2134" responsetime02="4541" location="CN"
 > /><target id="TVRBd01EQXdOVGt4" domain="www.bacbwefds.info"
 > url="http://www.bacbwefds.info/" bytes="422036604" hits="2463679"
 > percentage="100" responsetime01="3375" responsetime02="0" location="CN"
 > /></targets><conf><key name="source-xml"
 > value="http://backend.makelovenotspam.com/xml" /><key
 > name="interval-diagram" value="10000" /><key name="interval-hit"
 > value="10000" /><key name="post-data-length" value="5" /><key
 > name="refresh-xml" value="1200000" /><key name="current-version" 
value="1.0"
 > /><key name="spray-filter-count" value="39" /><key name="url-report"
 > value="http://backend.makelovenotspam.com/report" /></conf><stats><key
 > name="average-percentage" value="100.0" /><key name="bytes"
 > value="143003829363" /><key name="hits" value="859880020" /><key
 > name="downloads" value="103803" /><key name="target-count" value="69"
 > /></stats></mlns>
 >
 >