50.58.99.143(irc botnet hosted in United States Columbus Tw Telecom Holdings Inc)

Remote Host Port Number
46.17.97.83 80
46.17.97.85 80
50.58.99.143 3301

* The data identified by the following URLs was then requested from the remote web server:
o http://46.17.97.83/miner/mscoree.dll
o http://46.17.97.83/miner/openldap.dll
o http://46.17.97.83/miner/phoenix.exe
o http://46.17.97.85/miner/filelist.txt
o http://46.17.97.85/miner/license.txt
o http://46.17.97.85/miner/curllib.dll
o http://46.17.97.85/miner/gpl-2.0.txt
o http://46.17.97.85/miner/hstart.exe
o http://46.17.97.85/miner/libeay32.dll
o http://46.17.97.85/miner/libsasl.dll

NICK [USA-XP-x86]14651
USER unreal 8 * :unreal
JOIN #boats

hosting infos:
http://whois.domaintools.com/50.58.99.143

Categories: Uncategorized