[nsp-sec] The DNS Changer Take Down - Please check your flows ....

[Tim Wilde]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 11/10/2011 1:55 AM, Hank Nussbacher wrote:
> At 19:23 09/11/2011 -0500, Tim Wilde wrote:
> 
> It would be useful to get one of those large reports sorted by ASN
> of all infected systems so we can proxy it to those who don't have
> access to this data.

Hank, all,

The restrictions placed on this data by the DNSChanger Working Group
do not permit its dissemination in wholesale form - distribution is
permitted only of targeted data to organizations to whom the data is
directly relevant.  So I can't really post a list of all infected IPs
(plus it would be quite large - over 600k unique IPs in a 24 hour time
period).  I have attached a list of ASN -> unique IP count mappings,
though, and you're welcome to contact us for any ASNs you'd like to proxy.

Note: we are currently considering releasing the DNSChanger data
directly to any operators who can demonstrate their responsibility for
a network, much like we did with Conficker data and actively do with
Open Resolver data.  Don't let that stop you from asking for
downstream/proxied data now, as we haven't made a final determination,
just letting you know that we may be doing that going forward, and
will let folks know here if/when we decide to do so.

Thanks,
Tim

- -- 
Tim Wilde, Senior Software Engineer, Team Cymru, Inc.
twilde at cymru.com | +1-847-378-3333 | http://www.team-cymru.org/
-----BEGIN PGP SIGNATURE-----

iEYEARECAAYFAk6719wACgkQluRbRini9thpgQCdH6F2igEq+be2HmocpZdKtWAD
PxkAnRG3bwrfnha2lz86G0NVULGv8ZxI
=JwKT
-----END PGP SIGNATURE-----
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: dnschanger-asns.txt
URL: <https://puck.nether.net/mailman/private/nsp-security/attachments/20111110/adfea313/attachment-0001.txt>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: dnschanger-asns.txt.sig
Type: application/octet-stream
Size: 72 bytes
Desc: not available
URL: <https://puck.nether.net/mailman/private/nsp-security/attachments/20111110/adfea313/attachment-0001.obj>