[nsp-sec] known botnet controllers on IRC servers?

[Rob Thomas]

Hi, Peter.

> 38.106.105.132:6667

This is (among others) irc.smashthestack.org.  It's an interesting mix,
but not solely a botnet C&C.

> 209.20.75.209:6667

This is irc.idlemonkeys.net and l8nite.net, and we don't see a bevy of
botnets on this one.  It also sourced some spam back on 2008-07-26
16:00:27 UTC.

> 77.222.64.71:6667

We've nothing on this IP for the past 30 days, sorry.

Thanks,
Rob.
-- 
Rob Thomas
Team Cymru
http://www.team-cymru.org/
cmn_err(CEO_PANIC, "Out of coffee!");