Home page logo

nanog logo nanog mailing list archives

Re: a list of hosts in a RPC BOTNET, mostly 209.x.x.x,
From: neal rauhauser 402-301-9555 <neal () lists rauhauser net>
Date: Wed, 06 Aug 2003 10:37:43 -0500

   Someone has changed the channel topic to "CLOSED, Thanks for the post
to NANOG :-("

  But I don't see hosts being k-lined - I imagine if IRCops took an
interest in this they'd be lopping off heads. 

  The controlling node for this problem seems to be:

spaley   spale () le seul ircop a cul nu

  But the forward lookup on the name leads to RFC 1918 space.

  The nice folks in #hack seem to have taken an interest in this problem
... perhaps they have some secret t3kn33k for dealing with such things.

~I've tried contacting abuse departments of several of these isps and
none of them seem ~to care, so I figured I would post the info
~here, and maybe someone will let them know, the biggest offender is
atlantech. These ~are all hosts that have been compromised by
~the same person, they're being used to SYN flood


~If you want to see this glorious channel for your self its called
#!LPOL! on Undernet.

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]