95.143.193.118(irc botnet hosted in Sweden Hudiksvall Serverconnect Sweden Ab)

Remote Host Port Number
178.17.164.202 80
95.143.193.118 80

NICK qeoieyjx
USER a
PONG :i.
NICK jldmoscu
USER x

020501 . . :#00c
00000010 | 6431 6134 3038 2053 6572 7669 6365 2050 | d1a408 Service P
00000020 | 6163 6B20 320A 4A4F 494E 2023 2E33 3634 | ack 2.JOIN #.364
00000030 | 0A30 3230 3530 3120 2E20 2E20 3A23 3030 | .020501 . . :#00
00000040 | 6364 3161 3430 3820 5365 7276 6963 6520 | cd1a408 Service
00000050 | 5061 636B 2032 0A4A 4F49 4E20 232E 3336 | Pack 2.JOIN #.36
00000060 | 340A | 4.

* The data identified by the following URL was then requested from the remote web server:
o http://vetvetcom.com/tr9.txt

hosting infos:
http://whois.domaintools.com/95.143.193.118

Categories: Uncategorized