[nsp-sec] mariposa botnet drones

[Rodolfo Baader]

Hi!

ACK for AR ASNs: 5692 7303 7908 10318 10481 10834 11315 11664 16814 17401 19037
20207 22927 27747 27756 27822 27879 27960 27980 27984

Notifications were sent to the abuse/noc departments.

R.

Dirk Stander wrote:
> ----------- nsp-security Confidential --------
> 
> 
> 
> ------------------------------------------------------------------------
> 
> Hi,
> 
> I've uploaded a list of ~20k drone IPs, which were in the last 4 hours
> beaconing to some C&Cs as described here:
> http://defintel.blogspot.com/2009/09/half-of-fortune-100-companies.html
> Some of the destination ports used in the c&c communication
> are: 5907 1111 2222 3333 4444 5555 1234 7007 7008 protocol UDP
> 
> the complete list:
> https://asn.cymru.com/nsp-sec/upload/1253885710.whois.txt
> 
> Attached is a summary by IP count and ASN.
> 
>     cheers, Dirk Stander (1&1) :.
> 
> 
> 
> ------------------------------------------------------------------------
> 
> 
> 
> _______________________________________________
> nsp-security mailing list
> nsp-security at puck.nether.net
> https://puck.nether.net/mailman/listinfo/nsp-security
> 
> Please do not Forward, CC, or BCC this E-mail outside of the nsp-security
> community. Confidentiality is essential for effective Internet security counter-measures.
> _______________________________________________