chat log

xjnhtraj.com (Athena irc botnet hosted by tatacommunications.com)

Server:  xjnhtraj.com Port:  6667 Channel:  #xjnhtraj Channel password:  xjnhtraj Opers: [dwa] (dada@chidaica123): Ä‘uawa[dwa] #xjnhtraj [dwa] irc.server.net :IRC server[dwa] is a Bot on IRC server[dwa] idle 00:01:17, signon: Mon Mar 11 15:15:07[dwa] End of WHOIS list. [Troc] (trocdsds@chidaica123): Troc[Troc] #xjnhtraj [Troc] irc.server.net :IRC server[Troc] is a Bot on IRC server[Troc] idle 00:02:11, signon: Mon Mar 11

mikimouse.net (ngrbot irc botnet hosted by yisp.nl)

Resolved mikimouse.net to 46.182.107.35 Server:  mikimouse.net (Alternate domains mikimouse.org mikispace.org) Port:  1863 Server password:  jobs Channel:  #jobs Topic for #jobs is: Topic for #jobs set by h at Sat Feb 23 19:28:30 2013 This is the same bot, port and spreading method as a previously posted botnet. However that had been sinkholed so it appears

androhosting.info (Athena irc botnet hosted by voxility.net)

Resolved androhosting.info to 37.221.170.211 Mystical is right back into the irc game, with a different server and domain. This is on the same ip as _Stoner’s Athena test server which was previously posted. Google indicates that the domain once hosted a blackhole exploit kit panel Server: androhosting.info Port:  44 Current global users 119, max 910

webhostingprotection.info (Betabot http botnet hosted by Santrex.net)

Resolved webhostingprotection.info to 46.166.163.131 Server:  webhostingprotection.info Gate file:  /icool/order.php This was from the closed beta of the betabot http bot. The server files have been taken down now so not much point visiting the site. There wasn’t much to see except evidence of the coder’s man crush on the steely gaze of Brian Krebs. For

w4hw5wg3488h.net (snk asper mod irc botnet hosted by Germany Karlsruhe 1&1 Internet Ag)

Resolved w4hw5wg3488h.net to 213.165.89.117 Server:  w4hw5wg3488h.net Port:  5050 Channel:  #oh Topic for #oh is: .d /100/97/111/124/120/46/47/39/99/103/96/69/126/115/101/62/113/111/115/62/100/124/57/61/39/57/60/23/40/61/47/33/12/63/52/35/42/41/17/103/8/85/63/104/127/118/39/98/107/73/77/ Topic for #oh set by s at Sat Dec 01 18:36:05 2012 Oper:  s!x@x Talking with snk <Userbased> hey <s> sup <Userbased> cool ircd mod <s> yea <Userbased> I like the link encryption as well <Userbased> is this an

134.255.234.22 (irc botnet hosted by Zap-Hosting.com)

Server:  134.255.234.22 Port:  6667 Channel:  #HabboParty Nickformat: Three different types DatLykosaSmexy811637 Lykosa10559 LykosaTEST10559 Oper:  zeeeeeeek1 [zeeeeeeek1] (chatzilla@Habbo-B9F45668.pools.arcor-ip.net): New Now Know How [zeeeeeeek1] #HabboParty [zeeeeeeek1] PiotreksHabboServer.net :PiotreksHabboServer [zeeeeeeek1] idle 00:29:17, signon: Mon Nov 19 09:37:31 [zeeeeeeek1] End of WHOIS list. Commands: Only ones I have seen are <zeeeeeeek1> !isoffline <DatLykosaSmexy811637> seems like site is back online

mostvideo2012.no-ip.info (AryaN and Barracuda irc botnets hosted by Russian Federation Beringovskiy Mediaserviceplus Ltd.)

Resolved mostvideo2012.no-ip.info to 192.162.102.212 Server:  mostvideo2012.no-ip.info Port:  4562 Server password:  leroumain49  Channel          Users   Topic  #plouque         41      [+nt]  #mafia           2       [+nt]  #arisauve        66      [+nt]  #bio             3       [+nt]  AryaN bots Channel:  #arisauve Channel password:  leroumain49 Channel: #bio Barracuda bots Channel:  #plouque Channel: #mafia Command nick is RutE94 RutE94 (~RutE94@User-CD7BBD3D.rev.numericable.fr) has joined #plouque RutE94 !botkill [CATALIN-PC]58632  Startup Cleaned,

chat.barracudasec.com (Barracuda ircbotnet hosted by Luxembourg Luxembourg Root Sa)

Resolved chat.barracudasec.com to 94.242.204.181 Server: chat.barracudasec.com Ports: 1337,4667 (bots connect on 4667) Channel: #xxploasion Channel passoword: Rebels2012 Channel: #hflove Channel passoword: inspiron Connects using the no-ip hflove.no-ip.org Channel: #gavin0hanson Channel password: hanson911  Channel          Users   Topic  #xxploasion      4       [+sntu]  #hflove          45      [+s]  #gavin0hanson    53      [+sntu]  This irc server is similar to cmjc.whhcd.info in that is it

123.gets-it.net (Ganja ircbot hosted by United States St. Louis Hosting Solutions International Inc)

Resolved 123.gets-it.net to 69.64.62.151 Server: 123.gets-it.net Port: 6697 * Current Local Users: 34  Max: 40 * Current Global Users: 34  Max: 40 Channel: #Ganja * Topic for #Ganja is: DO NOT USE THE SPEEDTEST COMMAND! * Topic for #Ganja set by Anxiety at Sat Oct 06 02:54:30 2012 Opers: * [Anxiety] (Anxiety@Test-5D47311C.bchsia.telus.net): Anxiety * [Anxiety]