yes again this hoster and again buterfly boter hosted in USA they prob dont know that the buterfly botnet creator was arrested by FBI IP Location: United States Woodstock Fdcservers.net Resolve Host: sys-047.leeware.com IP Address: 208.53.131.135 exe file hosted with fdcservers.net: http://74.63.78.13/bdnu.exe IP Location: United States Woodstock Fdcservers.net Resolve Host: roa.ecuaideas3.net IP Address: 74.63.78.13 ResolvedRead more...
gutyeaz.com
DNS Lookup Host Name IP Address dell-d3e62f7e26 10.1.6.2 gutyeaz.com 184.106.247.215 kadds.ru 91.211.117.127 rapidshare.com rapidshare.com 195.122.131.4 rs286l34.rapidshare.com rs286l34.rapidshare.com 62.67.1.87 UDP Connections Remote IP Address: 184.106.247.215 Port: 2727 Send Datagram: packet(s) of size 21 Recv Datagram: 3000 packet(s) of size 0 Remote IP Address: 184.106.247.215 Port: 2727 Send Datagram: packet(s) of size 21 Recv Datagram: 3000 packet(s)Read more...
limon4ik.com(E-mail worm hosted with http://www.interserver.net/ US hosting)
DNS Lookup Host Name IP Address ssl.aukro.ua 193.23.48.228 ir.kagoshima-u.ac.jp 163.209.180.1 ss1.coressl.jp 202.172.28.253 www.billboxrecords.com.br 200.234.192.141 www.saredrogarias.com.br 74.52.66.226 forum.gryada.org.ua 193.169.188.64 loja.tray.com.br 201.20.35.20 masterkey.com.ua 212.82.216.42 isu2.tup.km.ua 212.111.198.59 www.stone.co.ua 67.15.97.220 www.mlh.co.jp 115.125.150.234 sou wow.merlin.org.ua 91.203.146.30 global-host.com.ua ex2.broadser form.cao.go.jp 203.180.136.89 bunker.org.ua 195.214.214.53 UDP Connections Remote IP Address: 10.1.1.1 Port: 53 Send Datagram: 2 packet(s) of size 37 Recv Datagram: packet(s)Read more...
ihax.sytes.net(CableLink109-243.telefonia.InterCable.net Mexico)
ihax.sytes.net: type A, class IN, addr 201.172.109.243 api.ipinfodb.com: type A, class IN, addr 67.212.74.82 Data: GET /v2/ip_query_country.php?key=86c9c734428c1230cba1356dcf99dc882bc229bf93fbd6491db4e8776d6d9a88&timezone=off HTTP/1.1 Raw: ..’.?…’..K..E..Jag@….q..o.C.JR.R.P..…8.”P.…C..GET /v2/ip_query_country.php?key=86c9c734428c1230cba1356dcf99dc882bc229bf93fbd6491db4e8776d6d9a88&timezone=off HTTP/1.1..Host: api.ipinfodb.com..Cache-Control: no-cache..User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1) Gecko/20090612 Firefox/3.5..Connection: closed….
91.203.146.65(Botnet hosted with http://goodnet.com.ua/ Ukraine)
Remote Host Port Number 173.193.205.116 8014 69.163.248.145 80 69.163.250.145 80 69.50.197.244 80 89.238.149.67 80 92.241.184.111 80 91.203.146.65 8878 port changed to 7276 USER duzlurcv duzlurcv duzlurcv :ajpenurz NICK ROIKiQGLO PONG :lols.nope.com MODE ROIKiQGLO +xi JOIN #maxi USERHOST ROIKiQGLO MODE #maxi +smntu Now talking in #maxi Topic On: [ #maxi ] [ =IxgN+TVR/M3693AU+b3Zymnqh7XjJ1xl8jRu0jdcrmWRb9Cr2BZAVxeyjwZ5PinlmrfYQ071m7u5f6tl0MGpVffGThs1UcXWLPEB2izDaRPHN8sxZILY/zc1b9ShwEHRBfKIZHRzdVWFQLUQ74SpuICbyIMK9U9yfLFnFvRV2Q1ry1d9NFrF1qzxS1kgf9/MG+tReUpUCS70eGoaIVQBELe+h1jgUQOlu6bKkas6aD8ro4e/ZSuWsr90pUDny6j8vHGNx99a/dFEw/gHLDmso9qbVB ] Topic By:Read more...
64.202.120.41(botnet hosted with hostforweb.com)
another botnet server hosted in US CHICAGO from www.hostforweb.com Remote Host Port Number 204.0.5.42 80 204.0.5.43 80 204.0.5.58 80 208.43.117.134 80 216.178.38.103 80 216.178.38.168 80 63.135.86.30 80 63.135.86.37 80 64.208.138.101 80 66.220.149.25 80 64.202.120.41 1234 PASS xxx ircd here NICK NEW-[USA|00|P|09511] USER XP-8613 * 0 :COMPUTERNAME MODE NEW-[USA|00|P|09511] -ix JOIN #!nn! test PONG 22 MOTDRead more...
bbg.moiservice.com
DNS Lookup Host Name IP Address bbg.moiservice.com 74.117.174.82 i3ED6DA76.versanet.de 62.214.218.118 Opened listening TCP connection on port: 55907 Opened listening TCP connection on port: 113 C&C Server: 74.117.174.82:16667 Server Password: Username: laMer Nickname: XP|Ubd2 Channel: #lbl# (Password: lam) Channeltopic: : Registry Changes by all processes Create or Open Changes HKEY_CURRENT_USERSoftwaremIRC “DateUsed” = 1264705554 HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallmIRC “DisplayName” =Read more...
gs.unicatz.com
Remote Host Port Number 74.117.174.82 2010 NICK XPUiw3 USER laMer “” “gs.unicatz.com” : You Think i aughty USERHOST XPUiw3 MODE XPUiw3 +i JOIN #tcp# d0s MODE #tcp# PONG :s11.cpe.netcabo.uk * The following ports were open in the system: Port Protocol Process 1052 TCP Winter.pif (%System%dllcacheWinter.pif) 32403 TCP Winter.pif (%System%dllcacheWinter.pif) Registry Modifications * The following RegistryRead more...
tux.shannen.cc( Ogard the lamer)
Resolved : [tux.shannen.cc] To [92.242.140.30] tux.shannen.cc 92.243.24.240 0 127.0.0.1 onlinewebdll.com onlinewebdll.com 66.197.218.184 mkm-libya.com mkm-libya.com 41.254.33.54 UDP Connections Remote IP Address: 127.0.0.1 Port: 1034 Send Datagram: 131 packet(s) of size 1 Recv Datagram: 131 packet(s) of size 1 Download URLs http://66.197.218.184/install.48691.exe (onlinewebdll.com) http://41.254.33.54/install.48755.exe (mkm-libya.com) C&C Server: 92.243.24.240:5900 Server Password: Username: VirUs Nickname: {NOVA}[DEU][XP-SP3]715708 JOIN ##Turb0-37## Channel:Read more...
ms.mobilerequests.com(Buterfly Bot very big server)
First domain: Resolved : [ms.mobilerequests.com] To [208.53.131.47] Resolved : [ms.mobilerequests.com] To [212.117.163.35] Resolved : [ms.mobilerequests.com To [89.149.223.140] Resolved : [ms.mobilerequests.com] To [208.53.131.135] Resolved : [ms.mobilerequests.com] To [188.72.230.153] Resolved : [ms.mobilerequests.com] To [208.53.131.50] Resolved : [ms.mobilerequests.com] To [89.149.223.136] Resolved : [ms.mobilerequests.com] To [212.95.32.187] Resolved : [ms.mobilerequests.com] To [188.72.230.154] Resolved : [ms.mobilerequests.com] To [188.72.230.89] Second domain: ResolvedRead more...