[nsp-sec] Kaiten Botnet C&C is still alive @ AS 8972 - PlusServer

[Neil Long]

Confirmed and added to the leetle list :-)

Thanks Gerard

Neil


On 27 Mar 2008, at 00:56, White, Gerard wrote:
> ----------- nsp-security Confidential --------
>
>
> Greetings.
>
> If anyone wants to take a crack at a Kaiten Botnet C&C... there's one
> listening on TCP/113 @
>
> AS      | IP               | AS Name
> 8972    | 85.25.86.52      | PLUSSERVER-AS PlusServer AG, Germany
>
> Approx 250 Kaiten bots sitting on it.  Currently giving this /32 a UDP
> Spankin'
>
> AS      | IP               | AS Name
> 6389    | 65.13.143.4      | BELLSOUTH-NET-BLK - BellSouth.net Inc.
>
>
> GW
> 855 - Aliant
>
>
>
> _______________________________________________
> nsp-security mailing list
> nsp-security at puck.nether.net
> https://puck.nether.net/mailman/listinfo/nsp-security
>
> Please do not Forward, CC, or BCC this E-mail outside of the nsp- 
> security
> community. Confidentiality is essential for effective Internet  
> security counter-measures.
> _______________________________________________

Neil Long
Team Cymru
http:// www.cymru.com