Server : irc.bejiyan.com Port:6667 Channel: #b4 m0nkey | #xp | #luke | #rek Pass: .giris 5063923 infos about hosting: http://whois.domaintools.com/209.59.223.245
64.202.120.43(botnet hosted in United States Chicago Hostforweb Inc)
Remote Host Port Number 174.37.200.82 80 216.178.39.11 80 63.135.80.224 80 64.211.162.72 80 66.220.149.25 80 64.202.120.43 1234 PASS xxx MODE NEW-[USA|00|P|39547] -ix JOIN #!nn! test PONG 22 MOTD NICK NEW-[USA|00|P|39547] USER XP-2882 * 0 :COMPUTERNAME infos about hosting: http://whois.domaintools.com/64.202.120.43
pd0x.kamii.us(linux bots hosted in United States Arlington Heights Ecomdevel Llc)
var $config = array(“server”=>”pd0x.kamii.us”, “port”=> “7777”, “pass”=>”puta”, // “prefix”=>””, “maxrand”=>7, “chan”=>”#pwnage#”, “key”=>”xxx”, // “modes”=>”-x+i”, “password”=>”puta”, // “trigger”=>”!”, “hostauth”=>”*” // * Now talking in #pwnage# Topic On: [ #pwnage# ] [ God bless Google! and yes…[23:03:25] [UDP]: Finished attack: 1312799 MB sented Attacked speed: 43760 MB/s …for you DEMO.. [UDP]: Finished attack: 2695744 MB sented AttackedRead more...
46.4.253.146(botnet hosted in Germany Dolorem Ipsum)
Remote Host Port Number 46.4.253.146 5337 72.233.89.199 80 91.198.22.70 80 NICK {iNF-00-USA-XP-COMP-2586} PONG irc.NaDe.gov USER blaze * 0 :COMP JOIN #go anal NICK {00-USA-XP-COMP-2179} infos about hosting: http://whois.domaintools.com/46.4.253.146
95.154.237.228(botnet hosted in United Kingdom London Idealhosting Managed Servers)
Remote Host Port Number 74.125.227.14 80 74.125.227.18 80 74.125.45.95 80 75.126.182.187 80 95.154.237.217 80 95.154.237.228 6667 PASS timu MODE USA|94511 -x+i JOIN #1 timu USERHOST USA|94511 PRIVMSG #debug# :- shell – File opened: http://www.google.com.tr/url?sa=t&source=web&cd=138&ved=0CDEQFjAHOIIB&url=http%3A%2F%2Fwww.sexvakti.net%2Findex.php&rct=j&q=sex&ei=kYfKTIOCEoPP4AaV7tGlAQ&usg=AFQjCNHhxjnrUoycbGAQF_KuQWXRUAgZzg&cad=rja PRIVMSG #1 :- psniff – No Carnivore thread found. NICK USA|94511 USER ckobptz 0 0 :USA|94511 infos about hosting: http://whois.domaintools.com/95.154.237.228
around 18 mb exe files
here u have another malwares package around 18mb most of them are banking trojans have fun Download: http://502ccd73.tinylinks.co
80.91.191.156(spyeye banking trojan hosted in Ukraine Kiev Webspace-datagroup)
Control Panel:http://80.91.191.156/boss/ exe here:http://80.91.191.156/boss/bin/jupdate.exe infos about hosting: http://whois.domaintools.com/80.91.191.156
us2.holdbaby.com( banking trojan hosted in United States Dallas Theplanet.com Internet Services Inc)
Resolved : [us2.holdbaby.com] To [174.121.110.122] Remote Host Port Number 174.121.110.122 8800 208.82.236.129 80 208.82.238.129 80 67.212.77.13 80 Registry Modifications * The newly created Registry Values are: o [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogon] + Taskman = “C:RECYCLERS-1-5-21-0243556031-888888379-781863308-1191wdfewi.exe” so that wdfewi.exe runs every time Windows starts o [HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun] + Bfwe = “C:RECYCLERS-1-5-21-0243556031-888888379-781863308-1191wdfewi.exe” so that wdfewi.exe runs every time Windows startsRead more...
a.bestplay2010.com(botnet hosted in Russian Federation Vline Ltd)
a.bestplay2010.com DNS_TYPE_A IP’s 109.196.142.66 109.196.142.58 port:5901 109.196.142.66:5901 PASS eee Data sent: 4b43 494b 2063 796d 7271 666a 6f0d 0a72 KCIK cymrqfjo..r 7373 7220 6d67 7670 6f79 6f79 2022 2220 ssr mgvpoyoy “” 2265 736d 2220 3a6d 6776 706f 796f 790d “esm” :mgvpoyoy. 0a . Data received: 3a49 5243 2149 5243 4068 7562 2e75 732e :IRC!IRC@hub.us.Read more...
p34s3.hmarhelo.com(bfbot hosted in Canada London Affilinet Corporation)
– DNS Queries:p34s3.hmarhelo.com Resolved : [p34s3.hmarhelo.com] To [209.90.137.221] Resolved : [p34s3.hmarhelo.com] To [209.90.137.222] Resolved : [p34s3.hmarhelo.com] To [209.90.137.224] Resolved : [p34s3.hmarhelo.com] To [209.90.137.223] port:1199 Anubis scan: http://anubis.iseclab.org/?action=result&task_id=16e217e8f63db0d846dcdfb341c870529&format=html infos about hosting: http://whois.domaintools.com/209.90.137.223