[nsp-sec] zbot 74.208.200.182

Thu Mar 25 13:47:29 EDT 2010

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 3/25/2010 8:19 AM, Dirk Stander wrote:
> ----------- nsp-security Confidential --------
> 
> Hi Teams,
> 
> please find attached a list of ZeuS botnet drones which were connected to
> the c&c 74.208.200.182 (bestschoolloanconsolidation.com).  The timestamps
> are GMT+00 and the bot id contains the windows host name.

Sanitized notifications will be sent to the following:

> 3794    | 128.194.60.31    | US | bryan_pc_06e0e469 2010-02-28 19:05:04 | TAMU - Texas A&M University

Thank you!

Gabe

- --
Gabriel Iovino
Principal Security Engineer, REN-ISAC
http://www.ren-isac.net
24x7 Watch Desk +1(317)278-6630
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAkurobEACgkQwqygxIz+pTsBzQCgvkZ2lFBxsx8QrkFD+RRpGCyP
KvEAoIzKITRfirFnmMJUIuRqq1b4ODNg
=7b7j
-----END PGP SIGNATURE-----