4 ms·
Really glad to see someone finally talking about this. Does anyone know what's going on with that "Duke de Montosier" spam botnet? It accounts for more than ha
by SyneRyder 4y ago
Really glad to see someone finally talking about this.
Does anyone know what's going on with that "Duke de Montosier" spam botnet? It accounts for more than half of the botspam attacks on my sites, and I can't find anyone talking about it online anywhere, except one tweet dating back to mid-2021. It's identifiable by several short phrases that it posts:
Duke de Montosier
for Countess Louise of Savoy
Testaru. Best known
And cryptic short posts that can assemble into creepy sequences:
Europe, and in Ancient Russia
Century to a kind of destruction:
Western Europe also formed
and was erased, and on cleaned
only a few survived
number of surviving European
55 thousand Greek, 30 thousand Armenian
Many of the IPs involved seemed to be in Russia, China and Hong Kong, though they're coming from all over (eg European & US VPNs, Tor exit nodes). From tracking the IPs on AbuseIPDB, the weird spam posts seem to be just one layer, while behind the scenes it also attempts SMTP Auth and IMAP attacks on the server.
I'm eager to know more if anyone knows, and especially if anyone is trying to shut this thing down. But I can't find anyone even talking about it. (Maybe there's a reason for that?)
- prepend 4y agoI assume it’s time travelers trying to post enough so their message persists.
- marginalia_nu 4y agoHow very numbers station of them. I've seen it suggested that botnets use comment fields for command and control, maybe something like that?
- SyneRyder 4y agoMy theory for the phrases above is that they're a "unique seed" used to identify sites that are easily compromised. Do a web search, find a website filled with "Duke de Montosier" comments - bingo, you've identified an easy website to target with your backlink comment spam. Or, more maliciously, a website that is easy to thoroughly compromise with vulnerabilities. But that's just my current theory. Here's the one tweet I found in Swedish about the comment spam botnet, and it dates back to February 2021. She's the only person I could find who has mentioned it in public. Or maybe my search skills are failing me. https://twitter.com/aureliagu/status/1357368329573400578 https://twitter.com/aureliagu/status/1357368329573400578
- bombcar 4y agoI suspect some of these are "bots sold for hire" where they make money selling the bot to people, many of whom don't know how to use it and run it with the default config. I've found spam email that certainly is the above, because it has things like PUT_LINK_TO_STORE_HERE and other variables that obviously weren't updated in the config file.