[nsp-sec] Daily Reports Summary for week ending 2009-02-02

[Tim Wilde]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Tim Wilde wrote:
> Bots       2,226,325  - 67.7%  8208      0       39     6,887,938 10361

Greetings again everyone,

I was reminded by a question off-list that I hadn't explained the
meteoric rise and drop of the bots category over the past couple of
weeks.  We had begun receiving a feed of Conficker infected hosts, which
caused the significant rise in this category that you saw in last week's
summary.  Unfortunately, due to the nature of Conficker's shifting C&C
patterns, this data source was only able to provide data for a brief
period.  We expect this to continue fluctuate somewhat in coming days
and weeks, so do not be surprised if you see the bots numbers changing a
lot.

Also, we have updated the bots report description page to explain the
Conficker data being presented, and to note the new tag that can appear
on these data lines indicating that they are based on Conficker
infections, rather than the otherwise generic/unknown bot infections.
You can see the new description page here:

	https://www.cymru.com/nsp-sec/dailyreports/bots.html

Using your NSP-SEC mailing list login and password as usual.  Please
don't hesitate to let us know if you have any questions, concerns,
comments, etc!

Regards,
Tim Wilde

- --
Tim Wilde, Senior Software Engineer, Team Cymru, Inc.
twilde at cymru.com | +1-312-924-4033 | http://www.team-cymru.org/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFJhxpFluRbRini9tgRAuY+AJ4w53y1qdW9gPPxU0UahEjn79PvNACcDLyl
FQ/a1zCZvFDNrh+1HSZdwEc=
=qvb5
-----END PGP SIGNATURE-----