[nsp-sec] [C&C nodes]

Mon Jun 9 21:09:45 EDT 2008

On Mon, 9 Jun 2008, Dave Mitchell wrote:

> 128.39.2.28:6667
> 195.12.59.195:6667
> 195.12.59.196:6667
> 213.131.156.51:6667
> 66.225.225.66:6667
> 83.140.172.210:6667
> 83.140.172.211:6667
> 83.140.172.212:6667

all turn up as DNS for irc.quakenet.org. look for connections to ports 
6667-6669.

-------------------------------------------------------------
jose nazario, ph.d.     <jose at arbor.net>
security researcher, office of the CTO,  arbor networks
v: (734) 821 1427 	      http://asert.arbornetworks.com/