Resolved to ssl.pxnet.to to 109.163.234.180
Server: ssl.pxnet.to
Port: 8888
Current Local Users: 301 Max: 888
Channel: #Frank
Opers:
[Hitler] (Hitler@Tracert1): Hitler
[Hitler] #Frank
[Hitler] flow.streamscene.to :!
[Hitler] is a Network Administrator
[Hitler] is available for help.
[Hitler] idle 00:04:44, signon: Sat Sep 22 10:32:40
[Hitler] End of WHOIS list.
[Fl00der] (Fl00der@gehaxelt-4FBCF4E0.gigabit.perfect-privacy.com): …
[Fl00der] #Frank
[Fl00der] flow.streamscene.to :!
[Fl00der] idle 00:00:56, signon: Sun Sep 23 15:59:36
[Fl00der] End of WHOIS list.
[Don] (Fl00der@Tracert1): …
Seems to be mostly used for ddosing german carders. Lots of packeting going on.
Sep 22 10:43:39 <Hitler> .udp 95.130.10.66 80 600
Sep 22 15:52:52 <Fl0w> .http gay.de 80 120
Sep 22 15:56:50 <Fl0w> .http swissfaking.org 80 1800
Sep 23 15:11:07 <Fl0w> .arme 91.217.178.75 80 120
Sep 23 15:59:00 <Fl00der> .udp swissfaking.org 21 180
Sep 23 16:44:37 <Fl0w> .http ccshop.ws 80 900
Sep 23 20:51:10 <Fl00der> .http swissfaking.org 80 120
Sep 23 20:53:46 <Fl00der> .http swissfaking.org/calendar.php 80 180
Sep 23 21:11:52 <Fl00der> .http hartz4paradise.cc 80 7800
Sep 24 14:12:31 <Fl00der> .udp 91.211.119.54 22 60
Sep 24 15:47:37 <Fl00der> .http h2039112.stratoserver.net 80 20
Sep 24 15:48:56 <Fl00der> .http h2039112.stratoserver.net 80 240
Sep 24 17:17:09 <Fl00der> .http hartz4paradise.cc 80 9888
Sep 24 17:43:26 <Fl00der> .http www.solomid.net 80 360
Sep 24 17:49:40 <Fl0w> .http ccshop.ws 80 1800
Sep 24 18:03:42 <Fl00der> .http hartz4paradise.cc 80 7800
Sep 24 23:17:15 <Don> .http vic-socks.to 80 7600
Sep 24 23:26:36 <Don> .tcp 81.169.128.18 80 240
Sep 24 23:33:26 <Don> .http tv-stream.to 80 7800
Sep 25 17:45:18 <Fl00der> .http crdcc.cc 80 356
Sep 25 22:06:29 <Fl00der> .http allrounders.cc 80 30
Sep 25 22:17:57 <Fl00der> .slow allrounders.cc 80 120
Sep 26 14:54:09 <Fl00der> .http ccshop.ws 80 120
Sep 26 14:56:52 <Fl00der> .arme ccshop.ws 80 760
Sep 26 16:04:32 <Fl00der> .slow ccshop.ws 80 1200
Sep 26 16:18:01 <Fl00der> .udp 91.217.178.52 22 800
Some twitter spreading
Sep 24 19:42:20 <Fl00der> .twitter “HAHA looks this Funny Picture: hxxp://undercover.su/?33244”
All of the updates have come from http://vorgh.de/up/
Spreading comes from http://vorgh.de/private/
Some weird bots in #aykut |-JPN-|-Win7-|-ITJA3mXYdf
Hosting infos: http://whois.domaintools.com/109.163.234.180