xD.a7aneek.net(80-100k ngrBotnet hosted in France Paris Gandi)

Same lamer with big net and still hosting with Gandi.net Resolved : [xD.a7aneek.net] To [92.243.17.156] Resolved : [xD.a7aneek.net] To [92.243.25.164] Resolved : [xD.a7aneek.net] To [92.243.0.109] Resolved : [xD.a7aneek.net] To [92.243.27.72] Resolved : [xD.a7aneek.net] To [92.243.10.12] Other domain names used to control bots: xD.0dayx.com appupdate.org xD.0days.me 92.243.10.12 5900 PASS ngrBot 92.243.0.109 5900 PASS ngrBot 92.243.27.72 5900

shoe.mrkva.su(ngrBot hosted in Netherlands Dediserv Dedicated Servers Sp. Z O.o)

same guy as update.jebac.net he keep changing domains lol shoe.mrkva.su 212.7.214.129 Remote Host Port Number 199.15.234.7 80 212.7.214.129 2087 PASS carmex UPDATE: Resolved : [shoe.mrkva.su] To [212.7.214.3] Server: 212.7.214.3:2087 PASS carmex Server Password: Username: ztaisun Nickname: n{DE|XPa}ztaisun Channel: #!s! (Password: carmex) Channeltopic: :!mod usbi on UPDATE: Server:shoe.mrkva.su:2086 channel:#!proxy! Local users: Current Local Users: 563 Max:

67.202.92.95(irc botnet hosted in United States Steadfast Networks)

Remote Host Port Number 67.202.92.95 2345 NICK New[USA|00|P|58651] PRIVMSG #!loco! :[M]: Thread Disabled. PRIVMSG #!loco! :[M]: Thread Activated: Sending Message With Email. USER XP-8084 * 0 :COMPUTERNAME MODE New[USA|00|P|58651] -ix JOIN #!loco! PONG 22 MOTD hosting infos: http://whois.domaintools.com/67.202.92.95

212.7.214.6(ngrBot hosted in Netherlands Dediserv Dedicated Servers Sp. Z O.o)

Remote Host Port Number 212.7.214.6 2345 NICK New[USA|00|P|78577] PRIVMSG #!loco! :[M]: Thread Disabled. PRIVMSG #!loco! :[M]: Thread Activated: Sending Message With Email. USER XP-6642 * 0 :COMPUTERNAME MODE New[USA|00|P|78577] -ix JOIN #!loco! PONG 22 MOTD hosting infos: http://whois.domaintools.com/212.7.214.6

mlsksfkajsfsa.com(ngrBot hosted in Netherlands Amsterdam Dediserv Dedicated Servers Sp. Z O.o)

Domains used to control bots: mlsksfkajsfsa.com 212.7.203.231 scfafsbfs.com NONE scfafsbfs.com.local NONE djesibonajeb.com NONE djesibonajeb.com.local NONE Resolved : [mlsksfkajsfsa.com] To [212.7.203.231] Remote Host Port Number 173.245.61.83 80 199.15.234.7 80 212.7.203.231 1866 PASS secret PRIVMSG #!x! :[DNS]: Blocked 1310 domain(s) – Redirected 0 domain(s) NICK n{US|XPa}hkiqwul USER hkiqwul 0 0 :hkiqwul JOIN #!x! secret PRIVMSG #!x! :[MSN]:

204.45.122.66(irc botnet hosted in United States Chicago Fdcservers.net)

Remote Host Port Number 204.45.122.66 6061 PASS m3l0s1p0y0 MODE {M3|USA|00|P|00029} -ixd JOIN ####bmw-m3# n4d4d4d4m3 PRIVMSG ####bmw-m3# : Activado: enviando . PONG Tan.Sec.CSC.Com NICK {M3|USA|00|P|00029} USER XP-4625 * 0 :COMPUTERNAME Now talking in ####bmw-m3# Topic On: [ ####bmw-m3# ] [ -sprmsg Lo hermoso merece ser visto! para muestra un boton http://www.softwarearpbolivar.com/fotografias/paisajes/DSC-00572.JPG ] Topic By: [ Coupe

ngr.dns02.ns2.name(7k ngrBots hosted in United States Franklin Wisconsin Cyberlynk Network Inc)

DNS Requests: api.wipmania.com 199.15.234.7 niidea.net 66.96.160.142 ngr.hostname.ns1.name NONE ngr.hostname.ns1.name.local NONE ngrnd.scrapping.cc NONE ngrnd.scrapping.cc.local NONE ngrnd.zapto.org 199.102.236.233 ngr.dns02.ns2.name 199.102.236.233 Remote Host Port Number 199.102.236.233 1590 PASS 44640151 199.15.234.7 80 Local users: Current Local Users: 7446 Max: 12732 Global users: Current Global Users: 7446 Max: 7485 NICK n{US|XPa}ufcvtzo USER ufcvtzo 0 0 :ufcvtzo PONG :C475B42B JOIN #rndbot

irc.selocell.com(irc botnet hosted in United States Monstercommerce Llc)

Remote Host Port Number 206.188.205.6 7985 NICK KCA[XP][3][55][45875][67470] PRIVMSG KCA[XP][3][55][45875][67470] : PING 1321617332 NOTICE KCA[XP][3][55][45875][67470] : NICK KCA[XP][3][55][860][56512] USER KCA “” “irc.selocell.com” :Coded y KCA USERHOST KCA[XP][3][55][860][56512] MODE KCA[XP][3][55][860][56512] +iR-x JOIN #XP +a+s+d+f MODE #XP PRIVMSG #XP : 2 Topic Okuma Aktif USERHOST KCA[XP][3][55][45875][67470] MODE KCA[XP][3][55][45875][67470] +iR-x Now talking in #XP Topic On: [ #XP