[nsp-sec] The DNS Changer Take Down - Please check your flows ....

[Jose Nazario]

On Nov 10, 2011, at 1:55 AM, Hank Nussbacher wrote:

> It would be useful to get one of those large reports sorted by ASN of all infected systems so we can proxy it to those who don't have access to this data.

something like this? this is about 18h of data off the SIE tap aggregated by number of queries seen per source ASN:

AS36666  | GTCOMM - GloboTech Communications | CA | 585974 hits seen
AS6128   | CABLE-NET-1 - Cablevision Systems Corp. | US | 273460 hits seen
AS6478   | ATT-INTERNET3 - AT&T Services, Inc. | US | 183061 hits seen
AS7132   | SBIS-AS - AT&T Internet Services | US | 123641 hits seen
AS12654  | RIPE-NCC-RIS-AS RIPE Network Coordination Center | EU | 123529 hits seen
AS5089   | NTL Virgin Media Limited | GB | 110974 hits seen
AS22909  | COMCAST-22909 - Comcast Cable Communications, Inc. | US | 110868 hits seen
AS33287  | COMCAST-33287 - Comcast Cable Communications, Inc. | US | 101868 hits seen
AS7015   | COMCAST-7015 - Comcast Cable Communications Holdings, Inc | US | 73582 hits seen
AS20115  | CHARTER-NET-HKY-NC - Charter Communications | US | 71708 hits seen
AS19262  | VZGNI-TRANSIT - Verizon Online LLC | US | 69949 hits seen
AS6327   | SHAW - Shaw Communications Inc. | CA | 65119 hits seen
AS33657  | CMCS - Comcast Cable Communications, Inc. | US | 61758 hits seen
AS11427  | SCRR-11427 - Road Runner HoldCo LLC | US | 61131 hits seen
AS705    | UUNET - MCI Communications Services, Inc. d/b/a Verizon Business | US | 60249 hits seen
AS12271  | SCRR-12271 - Road Runner HoldCo LLC | US | 55482 hits seen
AS2856   | BT-UK-AS BTnet UK Regional network | GB | 52501 hits seen
AS1267   | ASN-INFOSTRADA Infostrada S.p.A. | EU | 52361 hits seen
AS3352   | TELEFONICA-DATA-ESPANA TELEFONICA DE ESPANA | ES | 50002 hits seen
AS19548  | ADELPHIA-AS2 - Road Runner HoldCo LLC | US | 49866 hits seen
AS3269   | ASN-IBSNAZ Telecom Italia S.p.a. | IT | 48816 hits seen
AS11426  | SCRR-11426 - Road Runner HoldCo LLC | US | 42795 hits seen
AS812    | ROGERS-CABLE - Rogers Cable Communications Inc. | CA | 34773 hits seen
AS10994  | TAMPA2-TWC-5 - Road Runner HoldCo LLC | US | 33505 hits seen
AS5462   | CABLEINET Virgin Media Limited | GB | 32169 hits seen
AS33650  | COMCAST-33650 - Comcast Cable Communications, Inc. | US | 31166 hits seen
AS11351  | RR-NYSREGION-ASN-01 - Road Runner HoldCo LLC | US | 30019 hits seen
AS15149  | EZZI-101-BGP - Access Integrated Technologies, Inc. | US | 30007 hits seen
AS12479  | UNI2-AS France Telecom Espana SA | ES | 29087 hits seen
AS7757   | COMCAST-7757 - Comcast Cable Communications Holdings, Inc | US | 28850 hits seen
AS7018   | ATT-INTERNET4 - AT&T Services, Inc. | US | 28039 hits seen
AS10796  | SCRR-10796 - Road Runner HoldCo LLC | US | 27820 hits seen
AS6079   | RCN-AS - RCN Corporation | US | 27450 hits seen
AS577    | BACOM - Bell Canada | CA | 25844 hits seen
AS13571  | VIDEOTRON-LTEE - Videotron ltee | CA | 24924 hits seen
AS7725   | COMCAST-7725 - Comcast Cable Communications Holdings, Inc | US | 22661 hits seen
AS9829   | BSNL-NIB National Internet Backbone | IN | 21901 hits seen
AS33489  | COMCAST-33489 - Comcast Cable Communications, Inc. | US | 21275 hits seen
AS20214  | COMCAST-20214 - Comcast Cable Communications Holdings, Inc | US | 20945 hits seen
AS22047  | VTR BANDA ANCHA S.A. | CL | 20485 hits seen
AS3215   | AS3215 France Telecom - Orange | EU | 20244 hits seen
AS1221   | ASN-TELSTRA Telstra Pty Ltd | AU | 19869 hits seen
AS701    | UUNET - MCI Communications Services, Inc. d/b/a Verizon Business | US | 19856 hits seen
AS3320   | DTAG Deutsche Telekom AG | DE | 19801 hits seen
AS7992   | COGECOWAVE - Cogeco Cable | CA | 19545 hits seen
AS3356   | LEVEL3 Level 3 Communications | US | 19538 hits seen
AS4134   | CHINANET-BACKBONE No.31,Jin-rong Street | CN | 18985 hits seen
AS22291  | CHARTER-LA - Charter Communications | US | 18381 hits seen
AS4804   | MPX-AS Microplex PTY LTD | AU | 18010 hits seen
AS852    | ASN852 - Telus Advanced Communications | CA | 17905 hits seen
AS12322  | PROXAD Free SAS | FR | 17869 hits seen
AS6830   | UPC UPC Broadband | AT | 17797 hits seen
AS5617   | TPNET Telekomunikacja Polska S.A. | PL | 17409 hits seen
AS11955  | SCRR-11955 - Road Runner HoldCo LLC | US | 15005 hits seen
AS20001  | ROADRUNNER-WEST - Road Runner HoldCo LLC | US | 14408 hits seen
AS6147   | Telefonica del Peru S.A.A. | PE | 13635 hits seen
AS7738   | Telecomunicacoes da Bahia S.A. | BR | 12915 hits seen
AS13367  | COMCAST-13367 - Comcast Cable Communications Holdings, Inc | US | 11827 hits seen
AS10928  | CTI-NETRAX - CTI / Netrax | US | 11571 hits seen
AS8151   | Uninet S.A. de C.V. | MX | 11484 hits seen
AS7470   | ASIAINFO-AS-AP ASIA INFONET Co.,Ltd./ TRUE INTERNET Co.,Ltd. | TH | 11452 hits seen
AS3737   | PTD-AS - PenTeleData Inc. | US | 11287 hits seen
AS7545   | TPG-INTERNET-AP TPG Internet Pty Ltd | AU | 11108 hits seen
AS13343  | SCRR-13343 - Road Runner HoldCo LLC | US | 10773 hits seen
AS7303   | Telecom Argentina S.A. | AR | 10666 hits seen
AS9121   | TTNET Turk Telekomunikasyon Anonim Sirketi | TR | 10603 hits seen
AS10838  | OCEANIC-INTERNET-RR - Oceanic Internet | US | 10396 hits seen
AS7016   | CCCH-3 - Comcast Cable Communications Holdings, Inc | US | 10396 hits seen
AS17676  | GIGAINFRA Softbank BB Corp. | JP | 10387 hits seen
AS22927  | Telefonica de Argentina | AR | 10161 hits seen
AS855    | CANET-ASN-4 - Bell Aliant Regional Communications, Inc. | CA | 10084 hits seen
AS4713   | OCN NTT Communications Corporation | JP | 9875 hits seen
AS11492  | CABLEONE - CABLE ONE, INC. | US | 9821 hits seen
AS4766   | KIXS-AS-KR Korea Telecom | KR | 9693 hits seen
AS8048   | CANTV Servicios, Venezuela | VE | 9660 hits seen
AS27364  | ACS-INTERNET - Armstrong Cable Services | US | 9651 hits seen
AS4355   | ERMS-EARTHLNK - EARTHLINK, INC. | US | 9531 hits seen
AS29737  | WOW-INTERNET - WideOpenWest Finance LLC | US | 9306 hits seen
AS20231  | ROADRUNNER-CENTRAL - Road Runner HoldCo LLC | US | 9234 hits seen
AS7029   | WINDSTREAM - Windstream Communications Inc | US | 9210 hits seen
AS12083  | KNOLOGY-NET - Knology Holdings | US | 9160 hits seen
AS17813  | MTNL-AP Mahanagar Telephone Nigam Ltd. | IN | 8984 hits seen
AS27699  | TELECOMUNICACOES DE SAO PAULO S/A - TELESP | BR | 8640 hits seen
AS8167   | TELESC - Telecomunicacoes de Santa Catarina SA | BR | 8585 hits seen
AS6198   | BATI-MIA - BellSouth Network Solutions, Inc | US | 8561 hits seen
AS4788   | TMNET-AS-AP TM Net, Internet Service Provider | MY | 8415 hits seen
AS9105   | TISCALI-UK Tiscali UK | GB | 8401 hits seen
AS16338  | ONO-AS2 Cableuropa - ONO | ES | 8291 hits seen
AS5430   | FREENETDE freenet Datenkommunikations GmbH | DE | 8194 hits seen
AS6739   | ONO-AS Cableuropa - ONO | ES | 8050 hits seen
AS3462   | HINET Data Communication Business Group | TW | 8040 hits seen
AS11060  | NEO-RR-COM - Road Runner HoldCo LLC | US | 7899 hits seen
AS12262  | RR-CINCINNATI-ASN-01 - Road Runner HoldCo LLC | US | 7840 hits seen
AS3209   | VODANET Vodafone D2 GmbH | DE | 7500 hits seen
AS6568   | Ag para el Desarrollo de la Sociedad de la Inf en Bolivia - ADSIB | BO | 7412 hits seen
AS19444  | CHARTER-STL - CHARTER COMMUNICATIONS | US | 7282 hits seen
AS7418   | TELEFÓNICA CHILE S.A. | CL | 7184 hits seen
AS17232  | AT&T US | US | 7159 hits seen
AS13999  | Mega Cable, S.A. de C.V. | MX | 7105 hits seen
AS3301   | TELIANET-SWEDEN TeliaNet Sweden | EU | 7086 hits seen
AS10091  | SCV-AS-AP StarHub Cable Vision Ltd | SG | 6931 hits seen
AS11707  | SCRR-11707 - Road Runner HoldCo LLC | US | 6743 hits seen
AS11260  | EASTLINK-HSI - EastLink | CA | 6739 hits seen
AS11830  | Instituto Costarricense de Electricidad y Telecom. | CR | 6721 hits seen
AS3257   | TINET-BACKBONE Tinet SpA | EU | 6404 hits seen
AS3303   | SWISSCOM Swisscom (Switzerland) Ltd | CH | 6324 hits seen
AS13285  | OPALTELECOM-AS TalkTalk Communications Limited | GB | 6177 hits seen
AS5483   | HTC-AS Magyar Telekom plc. | HU | 6126 hits seen
AS15557  | LDCOMNET Societe Francaise du Radiotelephone S.A | FR | 6100 hits seen
AS8047   | GCI - GENERAL COMMUNICATION, INC. | US | 5997 hits seen
AS17974  | TELKOMNET-AS2-AP PT Telekomunikasi Indonesia | ID | 5903 hits seen
AS25346  | TISCALI-AS Tiscali UK Ltd | GB | 5800 hits seen
AS8452   | TE-AS TE-AS | IT | 5652 hits seen
AS5650   | FRONTIER-FRTR - Frontier Communications of America, Inc. | US | 5604 hits seen
AS35142  | NO_NAME |  | 5565 hits seen
AS5466   | EIRCOM Eircom | IE | 5564 hits seen
AS6197   | BATI-ATL - BellSouth Network Solutions, Inc | US | 5528 hits seen
AS684    | MTSAL-ASN - MTS Allstream Inc. | CA | 5464 hits seen
AS10311  | SCRR-10311 - Road Runner HoldCo LLC | US | 5426 hits seen
AS29895  | WOW-INTERNET-COL - WideOpenWest Finance LLC | US | 5391 hits seen
AS3243   | TELEPAC PT Comunicacoes, S.A. | EU | 5189 hits seen
AS21508  | COMCAST-21508 - Comcast Cable Communications Holdings, Inc | US | 5161 hits seen
AS2119   | TELENOR-NEXTEL Telenor Norge AS | NO | 5154 hits seen
AS11290  | RAPIDUS - COGECO Cable Canada Inc. | CA | 5097 hits seen
AS20960  | TKTELEKOM-AS TK Telekom sp. z o.o. | PL | 5080 hits seen
AS209    | ASN-QWEST - Qwest Communications Company, LLC | US | 5030 hits seen
AS9143   | ZIGGO Ziggo B.V. | NL | 4987 hits seen
AS5486   | SMILE-ASN Euronet Digital Communications, (1992) LTD, Israel | IL | 4884 hits seen
AS19115  | CHARTER-LEBANON - Charter Communications | US | 4861 hits seen
AS7643   | VNPT-AS-VN Vietnam Posts and Telecommunications (VNPT) | VN | 4838 hits seen
AS5432   | BELGACOM-SKYNET-AS Belgacom regional ASN | BE | 4832 hits seen
AS8737   | PT KPN Internet Solutions | EU | 4648 hits seen
AS2711   | SPIRITTEL-AS - Spirit Telecom | US | 4641 hits seen
AS4755   | TATACOMM-AS TATA Communications formerly VSNL is Leading ISP | IN | 4556 hits seen
AS6389   | BELLSOUTH-NET-BLK - BellSouth.net Inc. | US | 4544 hits seen
AS10318  | CABLEVISION S.A. | AR | 4515 hits seen
AS1239   | SPRINTLINK - Sprint | US | 4503 hits seen
AS9116   | GOLDENLINES-ASN 012 Smile Communications Main Autonomous System | IL | 4452 hits seen
AS8708   | RDSNET RCS & RDS S.A. | RO | 4369 hits seen
AS11232  | MIDCO-NET - Midcontinent Media, Inc. | US | 4354 hits seen
AS13490  | BUCKEYECABLEVISION - Buckeye Cablevision, Inc. | US | 4231 hits seen
AS9443   | INTERNETPRIMUS-AS-AP Primus Telecommunications | AU | 4041 hits seen
AS11683  | ELNK-CHARTER-CONN - Earthlink, Inc. | US | 4018 hits seen
AS5384   | EMIRATES-INTERNET Emirates Telecommunications Corporation | AE | 3994 hits seen
AS23184  | PERSONA - PERSONA COMMUNICATIONS INC. | CA | 3973 hits seen
AS6871   | PLUSNET PlusNet PLC | GB | 3906 hits seen
AS10507  | SPCS - Sprint Personal Communications Systems | US | 3800 hits seen
AS9229   | SPEEDCAST-AP SPEEDCAST Limited | HK | 3778 hits seen
AS8642   | B2 B2 Bredband AB (publ) | SE | 3759 hits seen
AS6181   | FUSE-NET - Cincinnati Bell Telephone | US | 3621 hits seen
AS7459   | GRANDECOM-AS1 - Grande Communications Networks, LLC | US | 3589 hits seen
AS6848   | TELENET-AS Telenet N.V. | BE | 3584 hits seen
AS29859  | WOW-INTERNET-ILL - WideOpenWest Finance LLC | US | 3547 hits seen
AS29695  | LYSE-AS Altibox AS | NO | 3406 hits seen
AS24863  | LINKdotNET-AS | EG | 3381 hits seen
AS174    | COGENT Cogent/PSI | US | 3381 hits seen
AS4837   | CHINA169-BACKBONE CNCGROUP China169 Backbone | CN | 3374 hits seen
AS9299   | IPG-AS-AP Philippine Long Distance Telephone Company | PH | 3365 hits seen
AS28573  | NET Servicos de Comunicao S.A. | BR | 3343 hits seen
AS2828   | XO-AS15 - XO Communications | US | 3277 hits seen
AS9318   | HANARO-AS Hanaro Telecom Inc. | KR | 3260 hits seen
AS9155   | QNET QualityNet General Trading & Contracting Co. | KW | 3205 hits seen
AS4323   | TWTC - tw telecom holdings, inc. | US | 3180 hits seen
AS8052   | SCRR-8052 - Road Runner HoldCo LLC | US | 3156 hits seen
AS19157  | CHARTER-TN - CHARTER COMMUNICATIONS | US | 3101 hits seen
AS6678   | ASN-NOOS NC Numericable S.A. | FR | 3099 hits seen
AS13030  | INIT7 Init7 Global Backbone | CH | 3095 hits seen
AS9808   | CMNET-GD Guangdong Mobile Communication Co.Ltd. | CN | 3040 hits seen
AS6621   | HNS-DIRECPC - Hughes Network Systems | US | 3012 hits seen
AS25994  | NPG-001 - NPG Cable, INC | US | 2998 hits seen
AS15659  | NEXTGENTEL NEXTGENTEL Autonomous System | NO | 2984 hits seen
AS10481  | Prima S.A. | AR | 2968 hits seen
AS12338  | EUSKALTEL Euskaltel S.A. | ES | 2965 hits seen
AS9790   | CALLPLUS-NZ-AP CallPlus Services Limited | NZ | 2962 hits seen
AS803    | SASKTEL - Saskatchewan Telecommunications | CA | 2905 hits seen
AS6140   | TWO-P - Two P | US | 2904 hits seen
AS4732   | DION KDDI CORPORATION | JP | 2897 hits seen
AS8551   | BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbone | IL | 2877 hits seen
AS30776  | CASEMAISP-AS Ziggo B.V. | NL | 2852 hits seen
AS6983   | ITCDELTA - ITC^Deltacom | US | 2796 hits seen
AS18566  | COVAD - Covad Communications Co. | US | 2788 hits seen
AS21522  | ROADRUNNER-MNPLS - Road Runner HoldCo LLC | US | 2779 hits seen
AS7017   | SCRR-7015 - Road Runner HoldCo LLC | US | 2743 hits seen
AS12741  | INTERNETIA-AS Netia SA | PL | 2712 hits seen
AS33490  | COMCAST-33490 - Comcast Cable Communications, Inc. | US | 2687 hits seen
AS7654   | SIAMGLOBE-AS-AP Internet Service Provider Co., Ltd. | TH | 2650 hits seen
AS4760   | HKTIMS-AP PCCW Limited | HK | 2647 hits seen
AS10396  | COQUI-NET - DATACOM CARIBE, INC. | PR | 2642 hits seen
AS2510   | INFOWEB FUJITSU LIMITED | JP | 2635 hits seen
AS13184  | HANSENET HanseNet Telekommunikation GmbH | DE | 2590 hits seen
AS3246   | TDCSONG TDC Finland | EU | 2561 hits seen
AS8341   | QUICKNET Ziggo B.V. | NL | 2542 hits seen
AS18881  | Global Village Telecom | BR | 2495 hits seen
AS5056   | INS-NET-2 - Iowa Network Services | US | 2479 hits seen
AS3292   | TDC TDC Data Networks | DK | 2466 hits seen
AS12097  | MASSCOM - Massillon Cable Communications | US | 2418 hits seen
AS6395   | LVLT-6395 - Level 3 Communications, Inc. | US | 2404 hits seen
AS15227  | WVFIBERNET - FiberNet of West Virginia | US | 2360 hits seen
AS8404   | CABLECOM UPC Cablecom GmbH | CH | 2315 hits seen

_____________________________
jose nazario, ph.d. jose at arbor.net
sr. manager of security research, arbor networks
blog:    http://asert.arbor.net/
twitter: @arbornetworks