Merit Network
Can't find what you're looking for? Search the Mail Archives.
  About Merit   Services   Network   Resources & Support   Network Research   News   Events   Home

Discussion Communities: Merit Network Email List Archives

North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: a list of hosts in a RPC BOTNET, mostly 209.x.x.x,

  • From: Andy Smith
  • Date: Wed Aug 06 12:56:43 2003

On Wed, Aug 06, 2003 at 10:37:43AM -0500, neal rauhauser 402-301-9555 wrote:
> 
>    Someone has changed the channel topic to "CLOSED, Thanks for the post
> to NANOG :-("
> 
>   But I don't see hosts being k-lined - I imagine if IRCops took an
> interest in this they'd be lopping off heads. 

Lopping off whose heads?  Who exactly would you K: line?  The people
who own those machines who have no idea they even have a process
connecting to IRC?  Or thousands of K:lines for trojans on dynamic
IPs?  Not sure how either approach would really do anything useful,
I guess that Undernet will just render the channel unusable in the
hope that whoever is responsible will then be unable to gather/use
their trojans.

Unfortunately they will now just update their trojan to connect to
some other place, and start redistributing..  all chances of doing
further tracing of who is responsible probably ended with this being
reported in public here on nanog, and I guess that's why the topic
has a ":(" in it.




Discussion Communities


About Merit | Services | Network | Resources & Support | Network Research
News | Events | Contact | Site Map | Merit Network Home


Merit Network, Inc.