[nsp-sec] black_energy ddos drones

[sthaug at nethelp.no]

> please find attached a list of ~6k drones, which were participating
> in a http flood against one of our customers (aandewatches.com,
> 74.208.182.201 & 74.208.203.4).
> 
> The C&C of this botnet is at hack-off.ru, 220.194.54.153 -- any help
> in taking it down would be much appreciated!

ACK 2116. Both victim and C&C traffic verified from Netflow.

Steinar Haug, AS 2116