[nsp-sec] ajax.whitehat.cc botnet

[Tim Wilde]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 9/1/2009 1:29 PM, Dirk Stander wrote:
> ----------- nsp-security Confidential --------
> 
> Hi,
> 
> please find attached a list of ips which were connected to an
> IRC based botnet.  The controller was ajax.whitehead.cc /
> 87.106.24.105:9999 (which is now connected to 72.8.167.167).

Thanks Dirk!  Current IP/port verified and added to magical LART list,
along with the RR added for further monitoring of IP changes.  If you
(or anyone) comes across specific malware we always love to get it!

Thanks,
Tim

- -- 
Tim Wilde, Senior Software Engineer, Team Cymru, Inc.
twilde at cymru.com | +1-630-230-5433 | http://www.team-cymru.org/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAkqdahgACgkQluRbRini9tge0wCfZv9Or3IuSqSjcJwq9UZ+T9Pq
hl8AnjPaFRJZ8CUpDAbof5URRnN/y6fq
=2wJL
-----END PGP SIGNATURE-----