ngrBot hosted in United States Chicago Steadfast Networks)

Thanks to anonymous guy here for finding this botnet. Resolved : [] To [] Resolved : [] To [] Other domains:, Thnx to Userbased for this and for server and channel pass Server : PASS sulxx Channel : #m PASS sul111 Now talking in #m Topic On: [ #m ] [ !mod usbi hosted in Ukraine Odessa Tehnologii Budushego Llc)

Botnet found by rolls Server: Server Password: Username: uiswnri Nickname: n{DE|XPa}uiswnri Channel: #moon (Password: 4m3r1k) Channeltopic: :.up hxxp:// b2790c7513a2efbf7cb34f64c4f49ff0 Inactive domain hosting infos: (Ngrbot irc botnet hosted by Chinanet)

Resolved to,,,,,, Server: Port:  6512 Server password:  smart Channel:  #dpi 332 n[US{XPu{pwvvvwa #dpi :!mdns hxxp:// !dl hxxp:// !dl hxxp:// !dl hxxp:// Channel:  #tar Channel password:  smart A modified ircd is used, making it difficult to connect using a regular irc client. Related md5s (search on (ngrBot irc botnet hosted by

Resolved to, Server: Port:  80 Server password:  666666 Channel:  ##Rox-x01## Topic for ##Rox-x01## is: !m on !s -n !mod usbi on !NAZEL hxxp:// !NAZEL hxxp:// !NAZEL hxxp:// Topic for ##Rox-x01## set by xXx at Mon May 27 14:47:02 2013 The server requires SSL to connect Alternate domains: hosted in China Changsha Chinanet Hunan Province Network)

Resolved : [] To [] Resolved : [] To [] Resolved : [] To [] Resolved : [] To [] Resolved : [] To [] TCP Traffic: PASS smart Data received: :Fax! ppppmsg n[US{XPa{jikgbsd!jikgbsd@ JOIN :#dpi [US{XPa{jikgbsd3a2f #dpi :!dl hxxp:// !dl hxxp:// !dl hxxp:// !mdns hxxp:// n[US{XPa{jikgbsd!jikgbsd@64.31. JOIN :#mss n[US{XPa{jikgbsd @ #mss  so channels hosted in Germany Karlsruhe 1&1 Internet Ag)

Resolved : [] To []Resolved : [] To [] Resolved : [] To []Resolved : [] To []Resolved : [] To [] Server: Password:Username: cemomcbNickname: n{DEU-XPx86a}rxibehmdChannel: #sp (Password: yap)Channeltopic: :!wBHv0JQ4frCCAfQ1ausiPUf+8V+7lwXPGIyAUdmor0CO5CSlmlrNT0sLhs1byIa5Qf+YnMhtBmCBtEOb6hI= Server: Password:Username: pqellooNickname: {DEU-XPx86a}pqelloovChannel: #sp (Password: yap)Channeltopic: :!wBHv0JQ4frCCAfQ1ausiPUf+8V+7lwXPGIyAUdmor0CO5CSlmlrNT0sLhs1byIa5Qf+YnMhtBmCBtEOb6hI= Samples: hxxp:// hxxp:// Thanx to aLiSs for samples and for finding this net hosting infos: (ngrbot irc botnet hosted by China Hefei Chinanet Anhui Province Network)

Resolved to   Server: Port:  7384 Server password:  smart Channel:  #spd Channel password:  smart Channel topic #spd:  !mod pdef on !mdns hxxp:// !dl hxxp:// !dl hxxp:// !s -o !j #1,#2 !dl hxxps:// Channel topic #1:  !dl hxxp:// !dl hxxp:// !dl hxxp:// !dl hxxp:// Channel topic #2:  !dl hxxp:// !dl hxxp:// !dl hxxp:// (ngrbot irc botnet hosted by

Resolved to,, Server: (alternate domains: Port:  1863 Server password:  jobs Channel:  #jobs Topic for #jobs is: !dl hxxp:// Topic for #jobs set by x at Fri Mar 29 13:40:52 2013 SSL is required to connect to this server This is the same guy as these previous posts. hosted by Czech Republic Zlin

Resolved : [] To [] Resolved : [] To [] Resolved : [] To [] not active now Server: Server Password: Username: jhdkutg Nickname: n{DE|XPa}jhdkutg Channel: #bon2 (Password: speedd) Channeltopic: :~pu hxxp:// f931d3eb10db2822e2f5d0b989e2a5b4 ~s -o ~s Download URLs hxxp:// ( hxxp:// ( hxxp:// ( hxxp:// ( hxxp:// ( hosting infos: