[nsp-sec] "Simplebot" -- a basic HTTP ddos bot

[Jose Nazario]

On Tue, 15 Jul 2008, Jose Nazario wrote:

> C&C	http://reno.wu.lt/ddos/update.php
> COMMAND
> 1 http://deface.lt 80

btw a simple "GET" to this URL will yield the attack command.

reno.wu.lt A INET 193.46.84.8

AS      | IP               | AS Name
43463   | 193.46.84.8      | BST-AS Biuro sprendimu tinklas UAB

-------------------------------------------------------------
jose nazario, ph.d.     <jose at arbor.net>
security researcher, office of the CTO,  arbor networks
v: (734) 821 1427 	      http://asert.arbornetworks.com/