aa419 under DDOS attack - update 2 - forum back online

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Baiting Guru Joined: 06 May 2004 Posts: 4012

As some of you may have noticed, aa419.org has been under a severe DDOS attack the last days. The attack is still ongoing. Our fabulous tech specialists were able to block thousands of IP addresses. As a result we can keep the website online despite the attack.

We strongly suspect that a Russian crime syndicate is behind this - apparently they are a bit upset about many, many shut down job scam / money mule scam websites. So in a way this DDOS attack is good news, because it certainly means that we cost these people a LOT of money.

We absolutley intend to keep aa419 online and not give in to them. And we think this is a good time to get some more money mule / job scam websites shut down.

Posted: Tue Sep 04, 2007 10:30 pm

Would this be the reason why I have not heard back from A1an confirming receipt of some accounts I sent?

Usually I get a return nod, however over the past week or so, I sent a couple of emails with accounts with no word back. Just want to be sure they are being received. Thx!

Master Baiter Joined: 04 May 2007 Posts: 139

Rock on! They're spending even more money trying to take you down. Botnet time is expensive. I suppose you've passed the IP addresses on to ISPs so they can take the appropriate action, whether that's warning the user or shutting down their Internet connection.

Posted: Tue Sep 04, 2007 10:37 pm

Wow that's pretty scary stuff. As you say meyer it's just a sign showing that baiting sites and others like aa419 really do make a difference, otherwise nobody would bother.

I hope you guys get through it sweet as.

Baiting Guru Joined: 06 May 2004 Posts: 4012

SumYunGai wrote:

Botnet time is expensive. I suppose you've passed the IP addresses on to ISPs so they can take the appropriate action, whether that's warning the user or shutting down their Internet connection.

Yes, we are passing the IP addresses on to the relevant ISPs. But we are talking about several thousand blocked IP addresses so far.

If you know how much one has to pay for such a botnet of thousands of bots over several days - lemme know. Laughing

I suspect it is quite a significant amount of money.

Posted: Tue Sep 04, 2007 11:04 pm

@meyer, unfortunately costs are perhaps not all that significant, considering that these are professional criminal enterprises. There's a Trend Micro white paper on the subject of Botnets in connection with Phishing attacks here that quotes $500-1500 for a DoS attack, and another rate of up to $100/day per 1,000 bots.

Posted: Wed Sep 05, 2007 12:56 am

Quote:

we are talking about several thousand blocked IP addresses

Mine was one of them. I was locked out all weekend. Crying or Very sad

419Eater is my life Joined: 15 Jun 2006 Posts: 493

I've just been advised that Alan is still receiving emails that are sent to him, despite the attacks.

So do please keep reporting those bank accounts Very Happy

EDIT - it's passed 1 terrabyte of bandwidth now...sheesh!

Posted: Wed Sep 05, 2007 10:59 am

@ Meyer

Could you list any specific ways that the average Eater could assist? I realise that there are specific skills in shutting down sites, but equally they have to be found before they can be identified. For example I work with a group of Eaters that have considerable mass mail expertise. What is the best way to assist?

Posted: Wed Sep 05, 2007 1:13 pm

Hi Meyer,

I expect you already know this, but I bumped into this

http://www.anti-aa419.com/?gclid=CMDTsveurI4CFSQWgQodAXUfRQ

under google.

It seems it could be related to the DOS you are having at the moment?

It actually came up as a sponsored link!

Cheers

LN

EDIT - I recall seeing a CIA project recently to see how many bots there
are on the net. I think they estimated some 1 million, so filtering IPs is
going to be a bit of a lengthy process. Sad

Posted: Wed Sep 05, 2007 1:16 pm

Hi Meyer

It hasn't shut down Muguito i have it running at the moment.

I have a shortcut from the desktop. Smile

Posted: Wed Sep 05, 2007 1:37 pm

I leave Vampire running when I go to bed quite a lot(when I remember anyways) and for as much as this is a PITA it at least shows the Lads are getting affected enough for them to go to these lengths to shut aa419 down.

@Fo'andles
I may be wrong(a more 'pootery person than me will correct if I am), but from what I gathered from Lord Nelsons link Muguito and Vampire are actually leeching aa419 just now. Somebody has turned them against themselves with the funny coding in the link. It might be better not to run it at the moment!

B-S

Posted: Wed Sep 05, 2007 1:44 pm

^^^^ don't believe everything you read... Twisted Evil

...including this....

Posted: Wed Sep 05, 2007 1:45 pm

We've been aware of this link for quite a while. It doesn't disturb us.

Baiting Guru Joined: 08 Jul 2004 Posts: 11857 Location: UK

Yeah, the link that Lord Nelson posted is for a site that was made by a disgruntled webhoster, it's been around for quite a while, it wont be anything to do with this attack.

Baiting Guru Joined: 06 May 2004 Posts: 4012

Scampatroller is correct - this comes from a very unprofessional small hoster who had refused to take down a mugu website and chose instead to pick up a fight with us. The best thing we can do with this is to entirely ignore this and target mugus and other criminals instead. Our goal is not fighting with shady hosters who run their business out of their living room, we want to take down genuine criminals.

To comment on the other points: There is no way that the aa419 vampire could be redirected against aa419, since it's directly under aa419's control. And there are no "rogue" vampires out there that have been reprogrammed to target us, either, we've had measures in place for years to prevent such things.

The aa419 administration knows what this attack is (botnet sending bad data requests) and is working with the hoster on getting things sorted. This isn't a bandwidth drain, it's an attempt to melt our server.

@afferbecklauder: if you want to assist, try to find as many new job scam / money mule scam websites as possible and get them closed. You can do this by looking at known scammer websites (you will find these in the aa419 database and forum as soon as the server is back online) and also in the eater fake bank forum. Take text from these and use google to find clones. The same templates are reused all the time, therefore it is quite easy to find the newest scam websites this way.

Baiting Guru Joined: 06 May 2004 Posts: 4012

Allright, the hoster temporarily took down our server. The criminals were pounding our server at 400GB/h. That means, they severaly increased the attack after our excellent tech guys were able to keep aa419 online the last days despite the attack.

We will keep you updated.

Master Baiter Joined: 14 Jun 2007 Posts: 109

meyer wrote:

There is no way that the aa419 vampire could be redirected against aa419, since it's directly under aa419's control.

Sure it can. If it's making http requests to a website then those requests will run through their website, usually apache.
Apache uses .htaccess as a "mapping" file. So sites can use .htaccess to tell apache to tell the browser (the user of vampire) to redirect it to anywhere they like.

They can't control's vampire's code directly, but they can control the requests coming to them.

Good luck beating off the attack from these cowardly bastards.

*** BANNED *** Joined: 03 Aug 2004 Posts: 881

@johnny5 and others

Final Answer-- LV and Muguito are *not* and *were not* leeching aa419.

Not quite a Newb Joined: 14 Jul 2005 Posts: 41

Bank killing operations will still continue over here in the meantime.

I have made a post outlining the modalities here:
http://forum.419eater.com/forum/viewtopic.php?p=979802#979802

Posted: Wed Sep 05, 2007 5:32 pm

This mail came in from Alan in reply to my sending him a lad bank account:

Alan wrote:

Wed, 5 Sep 2007 08:32:49 +0100

Can you please tell your friends that in spite of the Russian Bot
attack I am still alive and running normally.

Alan

Master Baiter Joined: 14 Jun 2007 Posts: 109

Jezabelle wrote:

@johnny5 and others

Final Answer-- LV and Muguito are *not* and *were not* leeching aa419.

I didn't say they were.
I said it can be done, in response to meyer saying it can't.

Posted: Wed Sep 05, 2007 6:47 pm

Yes I am operating normally, but owing to the ferocity of the attack, I have had to move. My new address is alanATfastmail.es

(to minimise spam I have changed @ to AT - to use the address switch it back)

** ACCOUNT CLOSED ** Joined: 15 Apr 2007 Posts: 766

Lord Nelson wrote:

I expect you already know this, but I bumped into this

http://www.anti-aa419.com/?gclid=CMDTsveurI4CFSQWgQodAXUfRQ

under google.

Somebody made that guy cry.

Good.

--J.D.

Posted: Wed Sep 05, 2007 7:13 pm

re: Alans post

so I guess the CC's to the database addy are not going to arrive for a while?

aa419 under DDOS attack - update 2 - forum back online	View next topic View previous topic