Beware the trolls, secure your trackers Archived: 2026-04-05 18:24:42 UTC by Claudio Guarnieri (Note: the post was originally written on Aug 8th 2012) You track botnets? Right, we do as well. You spent your weekends building your slick botnet trackers and some fancy web interface? Damn, we did too. But let’s face the truth, DDoS is f**king boring. What gives better sense to your day than some random crook trolling you and your monitoring infrastructure? Nothing. So here’s what happened today… Since I’m not really following the DDoS scene a lot lately, I kinda left over for some time the trackers that I built and that we are using internally in Shadowserver. Today I decided to open it up again just to show it some love and check if there was anything interesting being targeted, while sipping my coffee. I was expecting the usual amount of porn websites, random Russian forums, Lineage II shards and the traditional average target for the traditional average botnet, but that wasn’t the case today… something stood up. One of the DirtJumper botnets we are tracking, located on the domain “bnbgcw.com” started spreading some weird commands: The beginning of the command is a traditional DirtJumper response, some basic parameters (like threads, duration of attack, delay of C&C polling and such) separated by a dash and followed by the actual target of the DDoS attack, and here comes the funny thing. Appended to the original target (which was already being attacked previously and that isn’t really relevant for us at this stage) is a whole bunch of obfuscated JavaScript code. I removed the whole obfuscated code, but you can see it decoded as follows: https://www.shadowserver.org/news/beware-the-trolls-secure-your-trackers/ Page 1 of 5 So what this thing does in short is: 1. dynamically generate a domain out of a given seed and the current date 2. use the domain to build a landing URL 3. embed the URL in an