teamwaffle.net(SPAM BOT)

boards.4chan.org
boards.4chan.org 204.152.204.174
static.4chan.org
static.4chan.org 204.152.204.172
teamwaffle.net
teamwaffle.net 94.102.55.216
0.thumbs.4chan.org
1.thumbs.4chan.org
0.thumbs.4chan.org 204.152.204.169
1.thumbs.4chan.org 204.152.204.169
2.thumbs.4chan.org
2.thumbs.4chan.org 204.152.204.169
edge.quantserve.com
edge.quantserve.com 212.201.100.179
pixel.quantserve.com
pixel.quantserve.com 4.71.209.20
www.google-analytics.com
www.google-analytics.com 74.125.43.113
sys.4chan.org
sys.4chan.org 204.152.204.156
UDP Connections
Remote IP Address: 127.0.0.1 Port: 1128
Send Datagram: 401 packet(s) of size 1
Recv Datagram: 401 packet(s) of size 1
Download URLs
http://204.152.204.174/b/ (boards.4chan.org)
http://204.152.204.174/b/res/208670440 (boards.4chan.org)
http://94.102.55.216/4spam/4spam.txt (teamwaffle.net)
http://204.152.204.172/css/yotsuba.9.css (static.4chan.org)
http://204.152.204.172/css/yotsublue.9.css (static.4chan.org)
http://204.152.204.172/css/futaba.9.css (static.4chan.org)
http://204.152.204.172/css/burichan.9.css (static.4chan.org)
http://204.152.204.172/js/script.js (static.4chan.org)
http://204.152.204.172/image/title/ga.gif (static.4chan.org)
http://204.152.204.172/support/gf_rectangle/300×250-04.jpg (static.4chan.org)
http://204.152.204.172/image/jpn-flag.jpg (static.4chan.org)
http://204.152.204.172/image/fade.png (static.4chan.org)
http://204.152.204.172/support/gf_top/468×60.jpg (static.4chan.org)
http://204.152.204.172/support/gf_footer/728×90-bottom-03.jpg (static.4chan.org)
http://204.152.204.169/b/thumb/1269213594201s.jpg (0.thumbs.4chan.org)
http://94.102.55.216/4spam/4spam.txt (teamwaffle.net)
http://204.152.204.172/support/gf_leader/728×90-top-04.jpg (static.4chan.org)
http://204.152.204.172/image/title/4chan-megami.jpg (static.4chan.org)
http://204.152.204.172/support/gf_footer/728×90-bottom-01.jpg (static.4chan.org)
http://204.152.204.174/b/ (boards.4chan.org)
http://204.152.204.169/b/thumb/1269213556594s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269210272135s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269212632061s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269213711834s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269212380577s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269213644776s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269213556357s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269213415796s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269213596041s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269213125424s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269212657842s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269212380577s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269213594201s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269213023661s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269213454372s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269213592152s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269213636180s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269211421469s.jpg (0.thumbs.4chan.org)
http://4.71.209.20/pixel;r=2011867098;fpan=0;fpa=P0-1572541023-1269213606515;ns=0;url=http%3A%2F%2Fboards.4chan.org%2Fb%2Fres%2F208669130;ref=;ce=1;je=1;sr=1280x1024x32;dg=E10679-W-MS-7;dst=0;et=1269213672140;tzo=-60;a=p-0bq3T16a3nFeM (pixel.quantserve.com)
http://204.152.204.169/b/thumb/1269212621891s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269211240560s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269213637240s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269213484002s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269212679808s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269213634754s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269213586842s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269207071583s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269213592501s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269212236264s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269212946983s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269212540058s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269213582600s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269213475899s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269213594260s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269213558841s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269213454372s.jpg (0.thumbs.4chan.org)
http://212.201.100.179/quant.js (edge.quantserve.com)
http://212.201.100.179/quant.js (edge.quantserve.com)
http://4.71.209.20/pixel;r=1083597973;fpan=1;fpa=P0-1572541023-1269213606515;ns=0;url=http%3A%2F%2Fboards.4chan.org%2Fb%2F;ref=;ce=1;je=1;sr=1280x1024x32;dg=E10679-W-MS-7;dst=0;et=1269213606468;tzo=-60;a=p-0bq3T16a3nFeM (pixel.quantserve.com)
http://74.125.43.113/ga.js (www.google-analytics.com)
http://74.125.43.113/__utm.gif?utmwv=4.6.5&utmn=1710545357&utmhn=boards.4chan.org&utmcs=utf-8&utmsr=1280×1024&utmsc=32-bit&utmul=de&utmje=1&utmfl=6.0%20r88&utmcn=1&utmdt=%2Fb%2F%20-%20Random&utmhid=2005654837&utmr=-&utmp=%2Fb%2F&utmac=UA-166538-1&utmcc=__utma%3D228619097.1625747204.1269213607.1269213607.1269213607.1%3B%2B__utmz%3D228619097.1269213607.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B (www.google-analytics.com)
http://74.125.43.113/__utm.gif?utmwv=4.6.5&utmn=750296705&utmhn=boards.4chan.org&utmcs=utf-8&utmsr=1280×1024&utmsc=32-bit&utmul=de&utmje=1&utmfl=6.0%20r88&utmdt=%2Fb%2F%20-%20Random&utmhid=1300611452&utmr=-&utmp=%2Fb%2Fres%2F208670440&utmac=UA-166538-1&utmcc=__utma%3D228619097.1625747204.1269213607.1269213607.1269213607.1%3B%2B__utmz%3D228619097.1269213607.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B (www.google-analytics.com)
http://74.125.43.113/ga.js (www.google-analytics.com)
http://74.125.43.113/__utm.gif?utmwv=4.6.5&utmn=1075210754&utmhn=boards.4chan.org&utmcs=utf-8&utmsr=1280×1024&utmsc=32-bit&utmul=de&utmje=1&utmfl=6.0%20r88&utmdt=%2Fb%2F%20-%20Random&utmhid=1349065680&utmr=-&utmp=%2Fb%2F&utmac=UA-166538-1&utmcc=__utma%3D228619097.1625747204.1269213607.1269213607.1269213607.1%3B%2B__utmz%3D228619097.1269213607.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B (www.google-analytics.com)
http://74.125.43.113/__utm.gif?utmwv=4.6.5&utmn=1057982929&utmhn=boards.4chan.org&utmcs=utf-8&utmsr=1280×1024&utmsc=32-bit&utmul=de&utmje=1&utmfl=6.0%20r88&utmdt=%2Fb%2F%20-%20Random&utmhid=2058724757&utmr=-&utmp=%2Fb%2F&utmac=UA-166538-1&utmcc=__utma%3D228619097.1625747204.1269213607.1269213607.1269213607.1%3B%2B__utmz%3D228619097.1269213607.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B (www.google-analytics.com)
http://74.125.43.113/__utm.gif?utmwv=4.6.5&utmn=675046592&utmhn=boards.4chan.org&utmcs=utf-8&utmsr=1280×1024&utmsc=32-bit&utmul=de&utmje=1&utmfl=6.0%20r88&utmdt=%2Fb%2F%20-%20Random&utmhid=1359022942&utmr=-&utmp=%2Fb%2Fres%2F208669130&utmac=UA-166538-1&utmcc=__utma%3D228619097.1625747204.1269213607.1269213607.1269213607.1%3B%2B__utmz%3D228619097.1269213607.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B (www.google-analytics.com)
http://204.152.204.172/support/gf_leader/728×90-top-02.jpg (static.4chan.org)
http://204.152.204.172/support/gf_rectangle/300×250-06.jpg (static.4chan.org)
http://204.152.204.172/css/yotsuba.9.css (static.4chan.org)
http://204.152.204.172/css/yotsublue.9.css (static.4chan.org)
http://204.152.204.172/css/futaba.9.css (static.4chan.org)
http://204.152.204.172/css/burichan.9.css (static.4chan.org)
http://204.152.204.172/js/script.js (static.4chan.org)
http://204.152.204.172/image/title/Boco_T-4chan_banner_1.png (static.4chan.org)
http://204.152.204.172/image/fade.png (static.4chan.org)
http://204.152.204.172/image/jpn-flag.jpg (static.4chan.org)
http://204.152.204.172/support/gf_top/468×60.jpg (static.4chan.org)
http://204.152.204.172/support/gf_footer/728×90-bottom-01.jpg (static.4chan.org)
http://204.152.204.169/b/thumb/1269213454372s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269213510633s.jpg (0.thumbs.4chan.org)
http://4.71.209.20/pixel;r=1739069307;fpan=0;fpa=P0-1572541023-1269213606515;ns=0;url=http%3A%2F%2Fboards.4chan.org%2Fb%2Fres%2F208670440;ref=;ce=1;je=1;sr=1280x1024x32;dg=E10679-W-MS-7;dst=0;et=1269213614875;tzo=-60;a=p-0bq3T16a3nFeM (pixel.quantserve.com)
http://204.152.204.174/b/ (boards.4chan.org)
http://204.152.204.169/b/thumb/1269213385392s.jpg (0.thumbs.4chan.org)
http://204.152.204.172/support/gf_leader/728×90-top-04.jpg (static.4chan.org)
http://204.152.204.172/support/gf_rectangle/300×250-05.jpg (static.4chan.org)
http://204.152.204.169/b/thumb/1269213581852s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269212236264s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269211989290s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269213211620s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269213620684s.jpg (0.thumbs.4chan.org)
http://212.201.100.179/quant.js (edge.quantserve.com)
http://204.152.204.169/b/thumb/1269213557107s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269213469526s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269213034210s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269213257615s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269213556594s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269213594201s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269213636893s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269213635574s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269211933831s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269213634691s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269213633371s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269212846901s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269213587512s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269211431097s.jpg (0.thumbs.4chan.org)
http://4.71.209.20/pixel;r=1810279993;fpan=0;fpa=P0-1572541023-1269213606515;ns=0;url=http%3A%2F%2Fboards.4chan.org%2Fb%2F;ref=;ce=1;je=1;sr=1280x1024x32;dg=E10679-W-MS-7;dst=0;et=1269213641531;tzo=-60;a=p-0bq3T16a3nFeM (pixel.quantserve.com)
http://4.71.209.20/pixel;r=1880566731;fpan=0;fpa=P0-1572541023-1269213606515;ns=0;url=http%3A%2F%2Fboards.4chan.org%2Fb%2F;ref=;ce=1;je=1;sr=1280x1024x32;dg=E10679-W-MS-7;dst=0;et=1269213647203;tzo=-60;a=p-0bq3T16a3nFeM (pixel.quantserve.com)
http://94.102.55.216/4spam/4spam.txt (teamwaffle.net)
http://204.152.204.169/b/thumb/1269212946983s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269211891035s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269213709877s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269211986511s.jpg (0.thumbs.4chan.org)
http://204.152.204.174/b/res/208669130 (boards.4chan.org)
http://204.152.204.172/support/gf_rectangle/300×250-02.jpg (static.4chan.org)
http://204.152.204.169/b/thumb/1269213319603s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269213390687s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269213634691s.jpg (0.thumbs.4chan.org)
http://94.102.55.216/4spam/4spam.txt (teamwaffle.net)
http://204.152.204.172/css/yotsuba.9.css (static.4chan.org)
http://204.152.204.172/css/yotsublue.9.css (static.4chan.org)
http://204.152.204.172/css/futaba.9.css (static.4chan.org)
http://204.152.204.172/css/burichan.9.css (static.4chan.org)
http://204.152.204.172/js/script.js (static.4chan.org)
http://204.152.204.172/image/title/BADEND-Sora.jpg (static.4chan.org)
http://204.152.204.172/support/gf_rectangle/300×250-02.jpg (static.4chan.org)
http://204.152.204.172/support/gf_top/468×60.jpg (static.4chan.org)
http://204.152.204.172/support/gf_leader/728×90-top-02.jpg (static.4chan.org)
http://204.152.204.172/image/fade.png (static.4chan.org)
http://204.152.204.172/image/jpn-flag.jpg (static.4chan.org)
http://204.152.204.172/support/gf_footer/728×90-bottom-03.jpg (static.4chan.org)
http://204.152.204.169/b/thumb/1269213257615s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269213319767s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269213633413s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269213709910s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269212990744s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269211809250s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269213658838s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269211810312s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269213710085s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269213687537s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269212632061s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269213709577s.jpg (0.thumbs.4chan.org)
http://204.152.204.169/b/thumb/1269213592404s.jpg (0.thumbs.4chan.org)
Data posted to URLs
http://204.152.204.156/b/post (sys.4chan.org)
http://204.152.204.156/b/post (sys.4chan.org)

Outgoing connection to remote server: boards.4chan.org TCP port 80
Outgoing connection to remote server: boards.4chan.org TCP port 80
Outgoing connection to remote server: teamwaffle.net TCP port 80
Outgoing connection to remote server: static.4chan.org TCP port 80
Outgoing connection to remote server: 0.thumbs.4chan.org TCP port 80
Outgoing connection to remote server: teamwaffle.net TCP port 80
Outgoing connection to remote server: static.4chan.org TCP port 80
Outgoing connection to remote server: static.4chan.org TCP port 80
Outgoing connection to remote server: boards.4chan.org TCP port 80
Outgoing connection to remote server: 0.thumbs.4chan.org TCP port 80
Outgoing connection to remote server: 0.thumbs.4chan.org TCP port 80
Outgoing connection to remote server: 0.thumbs.4chan.org TCP port 80
Outgoing connection to remote server: 0.thumbs.4chan.org TCP port 80
Outgoing connection to remote server: pixel.quantserve.com TCP port 80
Outgoing connection to remote server: 0.thumbs.4chan.org TCP port 80
Outgoing connection to remote server: 0.thumbs.4chan.org TCP port 80
Outgoing connection to remote server: 0.thumbs.4chan.org TCP port 80
Outgoing connection to remote server: 0.thumbs.4chan.org TCP port 80
Outgoing connection to remote server: 0.thumbs.4chan.org TCP port 80
Outgoing connection to remote server: edge.quantserve.com TCP port 80
Outgoing connection to remote server: pixel.quantserve.com TCP port 80
Outgoing connection to remote server: www.google-analytics.com TCP port 80
Outgoing connection to remote server: static.4chan.org TCP port 80
Outgoing connection to remote server: static.4chan.org TCP port 80
Outgoing connection to remote server: 0.thumbs.4chan.org TCP port 80
Outgoing connection to remote server: 0.thumbs.4chan.org TCP port 80
Outgoing connection to remote server: pixel.quantserve.com TCP port 80
Outgoing connection to remote server: sys.4chan.org TCP port 80
Outgoing connection to remote server: boards.4chan.org TCP port 80
Outgoing connection to remote server: 0.thumbs.4chan.org TCP port 80
Outgoing connection to remote server: static.4chan.org TCP port 80
Outgoing connection to remote server: 0.thumbs.4chan.org TCP port 80
Outgoing connection to remote server: 0.thumbs.4chan.org TCP port 80
Outgoing connection to remote server: edge.quantserve.com TCP port 80
Outgoing connection to remote server: 0.thumbs.4chan.org TCP port 80
Outgoing connection to remote server: 0.thumbs.4chan.org TCP port 80
Outgoing connection to remote server: 0.thumbs.4chan.org TCP port 80
Outgoing connection to remote server: pixel.quantserve.com TCP port 80
Outgoing connection to remote server: pixel.quantserve.com TCP port 80
Outgoing connection to remote server: teamwaffle.net TCP port 80
Outgoing connection to remote server: 0.thumbs.4chan.org TCP port 80
Outgoing connection to remote server: boards.4chan.org TCP port 80
Outgoing connection to remote server: static.4chan.org TCP port 80
Outgoing connection to remote server: 0.thumbs.4chan.org TCP port 80
Outgoing connection to remote server: 0.thumbs.4chan.org TCP port 80
Outgoing connection to remote server: 0.thumbs.4chan.org TCP port 80
Outgoing connection to remote server: teamwaffle.net TCP port 80
Outgoing connection to remote server: sys.4chan.org TCP port 80
Outgoing connection to remote server: static.4chan.org TCP port 80
Outgoing connection to remote server: static.4chan.org TCP port 80
Outgoing connection to remote server: 0.thumbs.4chan.org TCP port 80
Outgoing connection to remote server: 0.thumbs.4chan.org TCP port 80
Outgoing connection to remote server: 0.thumbs.4chan.org TCP port 80

From i Post Your Infos:

http://sexy4chan.org/2010-01-29_1264751719905.jpg
Click that and something will happen. it's not an image.
When opened in notepad you see this. http://pastebin.com/juQEj0m2
It looked like at html document. In it it had a link to this file. I assume it would have downloaded it.
http://www.funkyred.com/private/upload/uploads/zwarmzZz.exe <--- This is an exe host. http://www.funkyred.com/private/upload/?
I submitted it to virus total, 6/41
Anubis already had it analyzed at http://anubis.iseclab.org/?action=result&task_id=1d6bac2290116b4f451943bdef5f2eca6
Long report short, its an irc bot. It connects from port 1039 to 77.78.235.36:6667
Joined Channel: #korruptz with Password 83nh4rv13
It is then instructed to download http://stashbox.org/866665/BotCrypt.exe and presumably use it on srv32.exe.
The irc is on teamwaffle.net which is hosted somewhere in bosnia. I can't find who is hosting it, which is probably the idea behind hosting it there.
team Waffle is a botnet irc host.
http://74.125.45.132/search?q=cache:yErFy0mZohoJ:www.hackforums.net/showthread.php%3Ftid%3D365883+team+waffle+irc&cd=7&hl=en&ct=clnk&gl=ca
All evidence is pointing towards some Script kiddie from hackforums.net