[nsp-sec] 8 Gbps DDoS against AS 3307 IRC server yesterday

[Dirk Stander]

.: sthaug at nethelp.no (Tue, Aug 04, 2009 at 10:52:41AM +0200)
> Schlund/1&1     1.96 Gbps       AS8560  87.106.0.0/16

Hi,

we are aware of this botnet (it's a smallish one which consists
of UNIX servers cracked by the last phpmyadmin RFI).

C&C is 79.99.130.125 6667 -- we are in contact with govCERT.NL

    Sorry for the packet love,
    kind regards, Dirk Stander (1&1) :.