[AusNOG] Botnet C&Cs at AS2907, AS7066, AS9929, AS4134, AS3786, AS29550, AS33651, AS39582 (AUSCERT#2007722cb)
matthew at auscert.org.au
matthew at auscert.org.au
Thu Apr 5 16:29:18 EST 2007
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Greetings AusNOG,
* Please let me know if this sort of information is useful / appropriate
for the list *
We've had a report of some bot-compromised hosts connecting to C&Cs on
port 8080 on:
AS | IP | AS Name
2907 | 133.46.244.25 | ERX-SINET-AS National Center for Science Information Systems
7066 | 208.29.54.102 | NETWORK-VIRGINIA-AS - Network Virginia
9929 | 210.83.210.252 | CNCNET-CN China Netcom Corp.
4134 | 211.148.154.130 | CHINANET-BACKBONE No.31,Jin-rong Street
3786 | 211.43.206.127 | LGDACOM LG DACOM Corporation
29550 | 217.112.95.162 | EUROCONNEX-AS Euroconnex Networks LLP
33651 | 69.181.7.244 | DNEO-OSP7 - Comcast Cable Communications, Inc.
39582 | 89.106.24.99 | GRID Grid Bilisim Teknolojileri A.S.
It may well be worth looking for flows to these IPs. Some details to
support this (sorry if it wraps badly) data in order of oldest to latest:
channels with per host stats:
channel
ip_src tmsg tjoin tping tpong tprivmsg maxchans maxworm Server? sport/dport first_ts
#wkd
133.46.244.25 6760 0 3015 3164 581 1 57 S 8080/1092 Tue_Apr__3_00:03:33_EST_2007.irc.txt
208.29.54.102 71 0 27 29 15 1 25 S 8080/1225 Tue_Apr__3_15:25:33_EST_2007.irc.txt
210.83.210.252 65 0 32 27 6 1 50 S 8080/1175 Tue_Apr__3_15:43:34_EST_2007.irc.txt
211.148.154.130 410 0 187 184 39 1 50 S 8080/1723 Tue_Apr__3_13:56:03_EST_2007.irc.txt
217.112.95.162 2455 0 1097 1010 348 1 50 S 8080/1075 Tue_Apr__3_03:06:33_EST_2007.irc.txt
69.181.7.244 79 0 39 34 6 1 6 S 8080/1853 Tue_Apr__3_02:28:35_EST_2007.irc.txt
89.106.24.99 112 0 57 41 14 1 50 S 8080/1194 Tue_Apr__3_14:17:03_EST_2007.irc.txt
#wkd
133.46.244.25 7063 0 3257 3376 430 1 55 S 8080/2007 Wed_Apr__4_00:00:35_EST_2007.irc.txt
211.43.206.127 920 0 465 421 34 1 50 S 8080/1185 Wed_Apr__4_07:11:33_EST_2007.irc.txt
217.112.95.162 3428 0 1694 1609 125 1 66 S 8080/1120 Wed_Apr__4_00:57:02_EST_2007.irc.txt
#afx
133.46.244.25 447 0 199 246 2 1 66 S 8080/1174 Thu_Apr__5_03:40:01_EST_2007.irc.txt
208.29.54.102 171 8 81 82 0 1 0 S 8080/1039 Thu_Apr__5_00:16:33_EST_2007.irc.txt
210.83.210.252 33 0 18 13 2 1 7 S 8080/1500 Thu_Apr__5_10:11:32_EST_2007.irc.txt
89.106.24.99 112 0 48 47 17 1 36 S 8080/1211 Thu_Apr__5_10:08:01_EST_2007.irc.txt
#atw
89.106.24.99 112 0 48 47 17 1 36 S 8080/1211 Thu_Apr__5_10:31:34_EST_2007.irc.txt
At least 69.181.7.244 and 211.43.206.127 have quite an interesting past:
x.anti-viral.us has address 69.181.7.244
x.anti-viral.us has address 211.43.206.127
is.wayne.brady.gonna.have.to.chokeabitch.us has address 69.181.7.244
is.wayne.brady.gonna.have.to.chokeabitch.us has address 211.43.206.127
x.rofflewaffles.us has address 69.181.7.244
x.rofflewaffles.us has address 211.43.206.127
Hope this helps,
- -- Matthew McGlashan --
Coordination Centre Team Leader | Hotline: +61 7 3365 4417
Australian Computer Emergency Response Team | Direct: +61 7 3365 7924
(AusCERT) | Fax: +61 7 3365 7031
The University of Queensland | WWW: www.auscert.org.au
Qld 4072 Australia | Email: auscert at auscert.org.au
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (FreeBSD)
Comment: http://www.auscert.org.au/render.html?it=1967
Comment: http://www.auscert.org.au/render.html?it=1967
iQCVAwUBRhR1ECh9+71yA2DNAQL1JgP9E1EeZCIEVki4O9uH0KN4vXXWJdJBeAdg
RzwRytOKoQv1J3NkE9RVd8UJgXbqa/7TJHhOe4lItVQC2CBPX8wGsaY3LTuY/oNj
W9jM89i1ehggwx1i9YxMt3hK5cbSVx4gHlXJs4jAaE5hHlEBZeHTVj1L9locKXtU
/5AlUzp3fl8=
=7TWs
- -----END PGP SIGNATURE-----
_______________________________________________
nsp-security mailing list
nsp-security at puck.nether.net
https://puck.nether.net/mailman/listinfo/nsp-security
Please do not Forward, CC, or BCC this E-mail outside of the nsp-security
community. Confidentiality is essential for effective Internet security counter-measures.
_______________________________________________
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (FreeBSD)
Comment: http://www.auscert.org.au/render.html?it=1967
Comment: http://www.auscert.org.au/render.html?it=1967
iQCVAwUBRhSXPSh9+71yA2DNAQJu4QP8Cs1w4t/IiMHQ3vi6RfeJ7avRMbZbnDHG
fMuZE0q3SZiys7WoFHPW3XDL69sFR7MJ/rMdk6nQHys9uNBo7q4k2ycIuOc5dHFE
LJGAN5Bsq/hGacTAFfDwOMdLOVz0HdIbFe7CWxHO4s52xNvCBG8sU2Z90RFpbb8N
B7NPsvUZmxE=
=M8kj
-----END PGP SIGNATURE-----
More information about the AusNOG
mailing list