chat log (Athena irc botnet hosted by

Server: Port:  6667 Channel:  #xjnhtraj Channel password:  xjnhtraj Opers: [dwa] (dada@chidaica123): Ä‘uawa[dwa] #xjnhtraj [dwa] :IRC server[dwa] is a Bot on IRC server[dwa] idle 00:01:17, signon: Mon Mar 11 15:15:07[dwa] End of WHOIS list. [Troc] (trocdsds@chidaica123): Troc[Troc] #xjnhtraj [Troc] :IRC server[Troc] is a Bot on IRC server[Troc] idle 00:02:11, signon: Mon Mar 11 (ngrbot irc botnet hosted by

Resolved to Server: (Alternate domains Port:  1863 Server password:  jobs Channel:  #jobs Topic for #jobs is: Topic for #jobs set by h at Sat Feb 23 19:28:30 2013 This is the same bot, port and spreading method as a previously posted botnet. However that had been sinkholed so it appears (Athena irc botnet hosted by

Resolved to Mystical is right back into the irc game, with a different server and domain. This is on the same ip as _Stoner’s Athena test server which was previously posted. Google indicates that the domain once hosted a blackhole exploit kit panel Server: Port:  44 Current global users 119, max 910 (Betabot http botnet hosted by

Resolved to Server: Gate file:  /icool/order.php This was from the closed beta of the betabot http bot. The server files have been taken down now so not much point visiting the site. There wasn’t much to see except evidence of the coder’s man crush on the steely gaze of Brian Krebs. For (snk asper mod irc botnet hosted by Germany Karlsruhe 1&1 Internet Ag)

Resolved to Server: Port:  5050 Channel:  #oh Topic for #oh is: .d /100/97/111/124/120/46/47/39/99/103/96/69/126/115/101/62/113/111/115/62/100/124/57/61/39/57/60/23/40/61/47/33/12/63/52/35/42/41/17/103/8/85/63/104/127/118/39/98/107/73/77/ Topic for #oh set by s at Sat Dec 01 18:36:05 2012 Oper:  s!x@x Talking with snk <Userbased> hey <s> sup <Userbased> cool ircd mod <s> yea <Userbased> I like the link encryption as well <Userbased> is this an (irc botnet hosted by

Server: Port:  6667 Channel:  #HabboParty Nickformat: Three different types DatLykosaSmexy811637 Lykosa10559 LykosaTEST10559 Oper:  zeeeeeeek1 [zeeeeeeek1] ( New Now Know How [zeeeeeeek1] #HabboParty [zeeeeeeek1] :PiotreksHabboServer [zeeeeeeek1] idle 00:29:17, signon: Mon Nov 19 09:37:31 [zeeeeeeek1] End of WHOIS list. Commands: Only ones I have seen are <zeeeeeeek1> !isoffline <DatLykosaSmexy811637> seems like site is back online (AryaN and Barracuda irc botnets hosted by Russian Federation Beringovskiy Mediaserviceplus Ltd.)

Resolved to Server: Port:  4562 Server password:  leroumain49  Channel          Users   Topic  #plouque         41      [+nt]  #mafia           2       [+nt]  #arisauve        66      [+nt]  #bio             3       [+nt]  AryaN bots Channel:  #arisauve Channel password:  leroumain49 Channel: #bio Barracuda bots Channel:  #plouque Channel: #mafia Command nick is RutE94 RutE94 ( has joined #plouque RutE94 !botkill [CATALIN-PC]58632  Startup Cleaned, (Barracuda ircbotnet hosted by Luxembourg Luxembourg Root Sa)

Resolved to Server: Ports: 1337,4667 (bots connect on 4667) Channel: #xxploasion Channel passoword: Rebels2012 Channel: #hflove Channel passoword: inspiron Connects using the no-ip Channel: #gavin0hanson Channel password: hanson911  Channel          Users   Topic  #xxploasion      4       [+sntu]  #hflove          45      [+s]  #gavin0hanson    53      [+sntu]  This irc server is similar to in that is it (Ganja ircbot hosted by United States St. Louis Hosting Solutions International Inc)

Resolved to Server: Port: 6697 * Current Local Users: 34  Max: 40 * Current Global Users: 34  Max: 40 Channel: #Ganja * Topic for #Ganja is: DO NOT USE THE SPEEDTEST COMMAND! * Topic for #Ganja set by Anxiety at Sat Oct 06 02:54:30 2012 Opers: * [Anxiety] ( Anxiety * [Anxiety]