Wired mag article on spammers playing traceroute games with trojaned boxes

Looks like attachments wont go through, so I will repost without the attachment. If anyone wants a copy, let me know


Oops... Try this again...

And as soon as you call law enforcement what happends? The spammer is
located offshore. Then what?

Actually, in the case of the wired article (removeform.com), it seems to be connected to a site in Florida. I asked my programmer (gabor@sentex.net) to decode the obfuscated java script/page that is served up by one of the zombies (On FreeBSD fetch -B 18192 -o danger.html http://www.removeform.com/d - I got it from at the time). I have attached it as a zip file with its contents. You will note that the form post goes back to

form action=""

OrgName: CyberGate, Inc.
Address: 3250 W. Commercial Blvd. Suite 200
City: Ft. Lauderdale
StateProv: FL
PostalCode: 33309
Country: US