Re: [sentinix-list] Anyone ever heard of darkprofits.net or darkprofits.com?

Marlon,
 I'm going to make a couple of guesses here but it seems that "darkprofits.com and .net are dDOS targets of the MiMail.C virus.
 Per Symantec:

"Performs a Denial of Service (DoS) with the following characteristics:

Randomly selects a site from the names below:

a. darkprofits.net
b. www.darkprofits.net
c. darkprofits.com
d. www.darkprofits.com

The DoS routine is designed to have 15 attacking threads active at any moment. 
Each thread performs one TCP connection or an ICMP attack, and then sleeps for five seconds. 
Randomly chooses to perform a TCP connection on port 80 or to perform an ICMP attack. 
The packets sent to the victim carry a 2k payload filled with random data. 
Uses a random ICMP type when performing the ICMP attack. 
The data sent is either the GET request or some random data when performing the HTTP connection."

details here:
http://securityresponse.symantec.com/avcenter/venc/data/[email protected]

And both domains are registered to:

02/02/04 14:19:31 whois www.darkprofits.net
.net is a domain of Network services
Searches for .net can be run at http://www.crsnic.net/

whois -h whois.crsnic.net darkprofits.net ...
Redirecting to TUCOWS, INC.

whois -h whois.opensrs.net darkprofits.net ...
Registrant:
 ali frameed
 Attn: 7588  - 145
 3522 2nd Floor Rm 2 AL 11 B
 Lard Prao Road, Klongchan Bangkapi
 Bangkok,  10240
 TH

 Domain name: DARKPROFITS.NET

 Administrative Contact:
    frameed, ali  [email protected]
    Attn: 7588  - 145
    3522 2nd Floor Rm 2 AL 11 B
    Lard Prao Road, Klongchan Bangkapi
    Bangkok,  10240
    TH
    66 2-957-5664 x7588    Fax: 66 2-957-5664 x7588

 Technical Contact:
    frameed, ali  [email protected]
    Attn: 7588  - 145
    3522 2nd Floor Rm 2 AL 11 B
    Lard Prao Road, Klongchan Bangkapi
    Bangkok,  10240
    TH
    66 2-957-5664 x7588    Fax: 66 2-957-5664 x7588


 Registrar of Record: TUCOWS, INC.
 Record last updated on 28-Jan-2004.
 Record expires on 27-Apr-2004.
 Record created on 27-Apr-2003.

 Domain servers in listed order:
    NS1.DARKPROFITS.COM   63.219.179.213
    NS2.DARKPROFITS.COM   63.219.179.214


But they appear to be offline.

thats all I know,
Michael

-----Original Message-----
From: Marlon.Richards-5I9FqcT3+DFWk0Htik3J/[email protected]
Sent: Feb 2, 2004 1:59 PM
To: The SENTINIX Mailing List <[email protected]>
Subject: [sentinix-list] Anyone ever heard of darkprofits.net or	darkprofits.com?






Hi guys. I know this is the Sentinix mailing list but i am just wondering
if i could get some help here. I found that my DNS server is being asked to
make numerous resolutions of darkprofits.com and darkrpofits.net. None of
my internal clients are making these requests. My Sniffer shows me that the
requests are being made from outside my network and that my DNS server is
making a request for this domain to external hosts. Does anyone know where
this may be coming from and how to stop it?


Regards


_______________________________________________
SENTINIX mailing list
[email protected]
http://elevenprospect.com/mailman/listinfo/sentinix