[dns-operations] MX record scanning

Antoin Verschuren antoin.verschuren at sidn.nl
Wed May 18 09:50:28 UTC 2011


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 16-05-11 17:26, Jake Zack wrote:
> The "spambot killer" doesn't appear to be randomly generating domains in
> real-time, or if it does, it appears to be doing a fairly lousy job at
> randomness.

If you're interested, this is the original source I found.
People may have changed Keywords and Domains I imagine:


<?php
/*=======================================================================
 Nuke-Evolution   :   Enhanced Web Portal System
 ========================================================================

 Nuke-Evo Base          :   Basic
 Nuke-Evo Version       :   2.1.0
 Nuke-Evo Build         :   1960
 Nuke-Evo Patch         :   0
 Nuke-Evo Filename      :   #$#FILENAME
 Nuke-Evo Date          :   13-Aug-2010 12:00

 Copyright (c) 2010 by The Nuke Evolution Development Team
 ========================================================================

 LICENSE INFORMATIONS COULD BE FOUND IN COPYRIGHTS.PHP WHICH MUST BE
 DISTRIBUTED WITHIN THIS MODULEPACKAGE OR WITHIN FILES WHICH ARE
 USED FROM WITHIN THIS PACKAGE.
 IT IS "NOT" ALLOWED TO DISTRIBUTE THIS MODULE WITHOUT THE ORIGINAL
 COPYRIGHT-FILE.
 ALL INFORMATIONS ABOVE THIS SECTION ARE "NOT" ALLOWED TO BE REMOVED.
 THEY HAVE TO STAY AS THEY ARE.
 IT IS ALLOWED AND SHOULD BE DONE TO ADD ADDITIONAL INFORMATIONS IN
 THE SECTIONS BELOW IF YOU CHANGE OR MODIFY THIS FILE.

/*****[CHANGES]**********************************************************
- -=[Base]=-
- -=[Mod]=-
 ************************************************************************/

if (!defined('MODULE_FILE')) {
   die('You can\'t access this file directly...');
}

global $bgcolor2, $_GETVAR;

$module_name = basename(dirname(__FILE__));
include_once(NUKE_BASE_DIR.'header.php');
get_lang($module_name);
title(_SBK, $module_name, 'spambot-logo.png');

/*****[BEGIN]******************************************
 [ Configuration:                                     ]
 ******************************************************/
//Keywords
$keywords = "Accounting Business Cooperatives Customer Commerce Defence
Education Training Employment Email Human Resources Investing Companies
Management Marketing Advertising Opportunities Small Business Big Trade
Technology Free Cheap Sale Automobiles Cars";

//Words
$spamwords = $keywords;
$words = explode(" ", strtolower($spamwords));

//300 useless emails!
$numemails = 300;

//Chars
$spamchars = "a b c d e f g h i j k l m n o p q r s t u v w x y z 1 2 3
4 5 6 7 8 9 0";
$chars = explode(" ", $spamchars);

//Domains
$domains = array(".com", ".net", ".org", ".co.uk", ".nl", ".de");
srand(microtime() * 1000000);

//Counter
$counter = $_GETVAR->get('count', '_REQUEST', 'int', 0);
/*****[END]********************************************
 [ Configuration:                                     ]
 ******************************************************/

//Functions
function gensalt($length) {
    global $chars;
    mt_srand(microtime() * 1000000);
    $salt = "";
    for($j=0; $j<$length; $j++) {
        $salt .= $chars[mt_rand(0, count($chars) - 1)];
    }
    return $salt;
}

OpenTable();
echo '<table width="100%"><tr><td>';
echo $keywords ; //Fool targeted spambots!
echo '</td></tr><tr><td>';
$emailsserved = 0;
for($i=0; $i<$numemails; $i++) {
    $emailaddr = "";
    for($j=0; $j<mt_rand(2,3); $j++) {
        $emailaddr .= $words[mt_rand(0, count($words) - 1)];
    }

    //Append some junk to make it less likely to hit
    $emailaddr .= gensalt(mt_rand(0,6));
    $emailaddr .= "@";
    for($j=0; $j<mt_rand(2,3); $j++) {
        $emailaddr .= $words[mt_rand(0, count($words) - 1)];
    }

    //Append some junk to make the domain more unlikely to hit
    $emailaddr .= gensalt(mt_rand(0,6));
    $emailaddr .= $domains[mt_rand(0, count($domains) - 1)];
    echo "<a href=\"mailto:".$emailaddr."\">".$emailaddr."</a><br />\n";
    $emailsserved++;

    //Some bonuses
    if (mt_rand(1, 5) == 1) {
        $emailaddr = gensalt(mt_rand(7, 14)) . "@" . gensalt(mt_rand(8,
12)) . $domains[mt_rand(0, count($domains)-1)];
        echo "<a href=\"mailto:".$emailaddr."\">".$emailaddr."</a><br
/>\n";
        $emailsserved++;
    }

    //For real dumb spambots who don't even recognise MD5 hashes ;)
    if (mt_rand(1, 15) == 1) {
        $emailaddr = md5(mt_rand(1, 1000000)) . "@" . md5(mt_rand(1,
1000000)) . $domains[mt_rand(0, count($domains)-1)];
        echo "<a href=\"mailto:".$emailaddr."\">".$emailaddr."</a><br
/>\n";
        $emailsserved++;
    }
}
echo "<p>".$emailsserved. _SBK_SERVED."</p>\n";

//Don't use up too much bandwidth: limit hits by spambots
if ($counter <= 3) {
    $counter++;
    for($i=0; $i<10; $i++) {
        //Random salt
        $salt = gensalt(30);
        echo "<a
href=\"modules.php?name=Spambot_Killer&count=$counter&salt=$salt\">"._SBK_MORE."</a><br
/>\n";
    }

    //More death traps, so even though spambots can no longer eat your
bandwidth there are other ways for them to get fake emails
    $death = explode(" ", "http://www.turnstep.com/cgi-bin/Infinospam.pl
http://www.turnstep.com/cgi-bin/Spamthis.pl
http://www.obliquity.com/computer/spambait/loopback.html
http://fantomaster.com/xfodder/mailme1.html
http://fantomaster.com/xfodder/mailme2.html
http://fantomaster.com/xfodder/mailme3.html
http://www.towerofbabel.com/antispam/ http://mcmillan.net.nz/tackle.html
http://www.unicom.com/spambait/servebait.cgi/a
http://www.unicom.com/spambait/servebait.cgi/b
http://www.unicom.com/spambait/servebait.cgi/c
http://www.unicom.com/spambait/servebait.cgi/d
http://www.unicom.com/spambait/servebait.cgi/e
http://www.unicom.com/spambait/servebait.cgi/f
http://www.mts.net/~mbreault/maillist.html
http://www.100megsfree3.com/bookmarks/bane/page1.htm
http://www.100megsfree3.com/bookmarks/bane/page2.htm
http://www.100megsfree3.com/bookmarks/bane/page3.htm
http://www.100megsfree3.com/bookmarks/bane/page4.htm
http://www.cling.gu.se/~cl3polof/spambait.html
http://members.sitegadgets.com/stoplavelle/email.html
http://www.fleiner.com/bots/mailtrap.shtml");

    //Link to them
    if ($counter >= 2) {
        foreach($death as $dying) {
            $salt = gensalt(30);
            echo "<a
href=\"".$dying."?salt=".$salt."\">".$dying."</a><br />\n";
        }
    }
}

//Shovel some junk down the throat of the spambot - try to make it
crash! ;)
$limit = 8000; //Crank it up for effectiveness!
echo '</td></tr></table><table width="100%"><tr><td>';
echo "<p>"._SBK_BOTS_ONLY."</p><hr />";
for($i=0; $i<$limit; $i++) {
    echo chr(mt_rand(0, 255));
    if (mt_rand(1, 25) == 1) echo "<a href=mailto:";
    if (mt_rand(1, 25) == 1) echo ">";
    if (mt_rand(1, 25) == 1) echo "</a>\n";
}

echo '</td></tr></table>';
CloseTable();

include_once(NUKE_BASE_DIR.'footer.php');

?>


- -- 
Antoin Verschuren

Technical Policy Advisor SIDN
Utrechtseweg 310, PO Box 5022, 6802 EA Arnhem, The Netherlands

P: +31 26 3525500  F: +31 26 3525505  M: +31 6 23368970
mailto:antoin.verschuren at sidn.nl  xmpp:antoin at jabber.sidn.nl
http://www.sidn.nl/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iQEcBAEBAgAGBQJN05ZVAAoJEDqHrM883AgnFTIH/jzBsmigp1/1VJcIhVr/OEyE
Hrhf9xZqOq0TIcEWtUcoP47Y153zAuUFpaACMVu6Dpzl+i1ljeamu4XFfC7mfSQN
IHuaiTL3mbXZz47TYQcfK4lSQakx9lYaQ2qmxs/Y5BWvFzmg1XMrkBcqv1in0V83
N4GdSubYCGnM2O0ojdYHFHgSz1H6lP8TwbMMNvSlex1AzzThrFNpPsOay3wvKRH+
jL7SCG7E4AVtMchCTCogg75+25pfygXxKrep+j0XkB9hRBclufAZu7+suXzWxcR8
nnoPd24VSxHIF+mawFrWixyQhFH9fK2dqN+Cx+XjtWSvKeaeuJURqNSUOLt6CWs=
=VtmA
-----END PGP SIGNATURE-----



More information about the dns-operations mailing list