[nsp-sec] skunkx bots - sinkhole data

[Carles Fragoso]

José,

ACK for AS39551 (GENCAT) and AS21193 (XTEC).

Proxy ACK for Spanish ISPs AS12479, AS6739, AS16338.

Trying to proxy ack for the rest...

  35 12479   | UNI2-AS France Telecom Espana SA
  25 3352    | TELEFONICA-DATA-ESPANA Internet Access Network of TDE
   4 6739    | ONO-AS Cableuropa - ONO
   3 12430   | VODAFONE_ES VODAFONE ES AS
   2 21193   | XARXA-AS Xarxa Telematica Educatica de Catalunya
   1 5400    | BT BT European Backbone
   1 39551   | GENCAT-AS Generalitat de Catalunya-AS
   1 34977   | PROCONO-AS PROCONO S.A.
   1 16338   | ONO-AS2 Cableuropa - ONO
   1 12715   | JAZZNET Jazz Telecom S.A.

Thanks a lot and good job!

-- Carlos Fragoso (CESICAT-CERT)


On Apr 26, 2011, at 9:19 PM, Jose Nazario wrote:

----------- nsp-security Confidential --------

On Apr 26, 2011, at 3:14 PM, Jose Nazario wrote:

data enclosed, format is ASN, IP, CC, UTC timestamp of last observation, and network name


big attachment, it got stripped by the mailserv. data is here:

http://atlas-public.ec2.arbor.net/tmp/2011-04-26/data/skunkx.txt

_____________________________
jose nazario, ph.d. jose at arbor.net<mailto:jose at arbor.net>
sr. manager of security research, arbor networks
http://asert.arbor.net/




_______________________________________________
nsp-security mailing list
nsp-security at puck.nether.net
https://puck.nether.net/mailman/listinfo/nsp-security

Please do not Forward, CC, or BCC this E-mail outside of the nsp-security
community. Confidentiality is essential for effective Internet security counter-measures.
_______________________________________________