[nsp-sec] ACK1103/1161: ZeuS botnet (s288421667.onlinehome.us)

[Wim Biemolt]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,

Dirk Stander wrote:

> please find attached a list of ~10k drones which used
> s288421667.onlinehome.us as a proxy for a ZeuS controller
> (next backend hop: http://www.sell-ads.cn/a1b8/s.php)
> 
> Format is: ... | <epoch last seen> <uniq bot id (zip)> | ...

ACK 1103 and 1161, SURFcert will take care of these.

Cheers,

- -Wim -/- SURFcert
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (Darwin)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkou0JMACgkQi276J+8k6ijShQCgsW85wdsuvgrQKQks0TYjN8/0
uyEAn3pXxMovty/oAw0NkKRIVkm/VXYl
=8uZG
-----END PGP SIGNATURE-----