[nsp-sec] FW: DSL reports under ddos -- C&C info - AS 9121 (TR)

[Jose Nazario]

On Thu, 10 Apr 2008, Krista Hickey wrote:

> Anything we can do to help?

this time it's a black energy botnet, not a machbot net.

here's your C&C:

hostnames:
googlecomaolcomyahoocomaboutcom.net
killgay.com
ad.yandexshit.com

IP:
202.71.106.56
in MY ...

all TCP port 80.

started 2008-04-10 09:05:53 US Eastern, ongoing.

-------------------------------------------------------------
jose nazario, ph.d.     <jose at arbor.net>
security researcher, office of the CTO,  arbor networks
v: (734) 821 1427 	      http://asert.arbornetworks.com/