Merit Network
Can't find what you're looking for? Search the Mail Archives.
  About Merit   Services   Network   Resources & Support   Network Research   News   Events   Home

Discussion Communities: Merit Network Email List Archives

North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

drone armies C&C report - Jan/2005

  • From: Gadi Evron
  • Date: Sun Jan 30 06:42:09 2005

Below is a periodic public report from the drone armies / botnets research and mitigation mailing list.
For this report it should be noted that we base our analysis on the data
we have accumulated from various sources.

According to our incomplete analysis of information we have thus far, we
now publish two reports.

The ISP's that are most often plagued with botnet C&C's (command &
control) are, by the order listed:
2. AS6517 YIPS Yipes Communications Inc
3. AS21840 SAGONE Sago Networks
4. AS4766 KIXS-AS-KR Korea Telecom
5. AS5731 ATTW AT&T WorldNet Services
6. AS25761 STAMIN-2 Staminus Communicatio
7. AS30083 SERVE-6 Server4You Inc.

* We would gladly like to establish a trusted relationship with
these and any organizations to help them in the future.

The Trojan horses most used in botnets:
1. Korgobot.
2. SpyBot.
3. Optix Pro.
4. rBot.
5. Other SpyBot variants and strains (AgoBot, PhatBot, actual SDbots,

Contact information:
Hank Nussbacher <>
Gadi Evron (as specified below)

Gadi Evron,
Information Security Manager, Project Tehila -
Israeli Government Internet Security.
Ministry of Finance, Israel.
Office: +972-2-5317890
Fax: +972-2-5317801

The opinions, views, facts or anything else expressed in this email message are not necessarily those of the Israeli Government.

Discussion Communities

About Merit | Services | Network | Resources & Support | Network Research
News | Events | Contact | Site Map | Merit Network Home

Merit Network, Inc.