a list of hosts in a RPC BOTNET, mostly 209.x.x.x,

Henry Linneweh hrlinneweh at sbcglobal.net
Wed Aug 6 15:53:28 UTC 2003


When looking at IRC and chat networks in general you have to look at them
from the internet since the attacks are launched from the internet outside
of any irc. The originators of the attacks use irc as a front to distract the
investigators effort to find their real points of origin.
 
In the past I have stated circa 1998 - 2000 time frame, that ISP's that 
fail to address the issue should be held liable for damages sustained
by other parties that fail to terminate clients for AUP violations, where
there is conclusive overwhelming proof as to the source of the attack,
(point of origin).

Drew Weaver <drew.weaver at thenap.com> wrote:

I've tried contacting abuse departments of several of these isps and none of them seem to care, so I figured I would post the info here, and maybe someone will let them know, the biggest offender is atlantech. These are all hosts that have been compromised by the same person, they're being used to SYN flood 65.110.34.100

 

If you want to see this glorious channel for your self its called #!LPOL! on Undernet.

 

Basically the way this works is your box gets attacked, then it sits on this irc channel and waits for commands, in this case the command is !SYN 65.110.34 1000 6667 9999 -s

 

Anyways here is the list, and every 30 seconds or so 2 or 3 more jump into this room.. the botnet is growing!

 

#!LPOL! Jessica74 H Peter90 at adsl-209-204-181-32.sonic.net :3 Jessica743071

#!LPOL! Claire272 H ~Claire272 at 80-192-182-73.cable.ubr05.wi.blueyonder.co.uk

#!LPOL! Sophia554 H ~Sophia554 at 209.195.200.6 :3 Sophia554325

#!LPOL! Chloe9013 H Karolina80 at 209.202.78.152 :3 Chloe901312

#!LPOL! Sydney542 H Mariah0494 at 209.191.9.227 :3 Sydney542199

#!LPOL! Elsa12423 H Angelina42 at 15.shnt4.xdsl.nauticom.net :3 Elsa124230

#!LPOL! Minki7099 H Zoe756815 at 209.194.190.16 :3 Minki709990

#!LPOL! Makayla57 H Natalie572 at 209.195.218.54 :3 Makayla574543

#!LPOL! Leslie525 H Svala28188 at pppoe-64-91-70-20.rb.lax.centurytel.net :3 Leslie525606

#!LPOL! Autumn319 H Grace99989 at AC9F6DA8.ipt.aol.com :3 Autumn319583

#!LPOL! Samantha3 H Autumn9932 at host25.brooksml-2.cust.sover.net :3 Samantha394828

#!LPOL! Yamilla15 H Claire4282 at host26.brooksml-2.cust.sover.net :3 Yamilla150205

#!LPOL! Grace2018 H Adriana488 at 8.svnf1.xdsl.nauticom.net :3 Grace201892

#!LPOL! Lujan7794 H Josie11923 at a5.c3bed1.client.atlantech.net :3 Lujan779454

#!LPOL! Minki7888 H Victoria72 at ep190.ips.PaulBunyan.net :3 Minki788839

#!LPOL! Briana185 H Alyssa5638 at 209.205.172.43 :3 Briana185975

#!LPOL! Angela274 H Laura15269 at host33.brooksml-2.cust.sover.net :3 Angela274842

#!LPOL! Anna79907 H Madeline32 at user-101.city.urbana.il.us :3 Anna799072

#!LPOL! Sung42146 H ~Sung42146 at 216.13.67.57 :3 Sung421466

#!LPOL! Estella68 H Daniela968 at 209.198.126.76 :3 Estella680044

#!LPOL! Jenna5293 H Adriana023 at 209.202.78.179 :3 Jenna529394

#!LPOL! Courtney6 H Chloe43907 at 209.190.200.152 :3 Courtney697581

#!LPOL! Caroline5 H Melissa162 at d-191-144-nospr3.i-55.com :3 Caroline527031

#!LPOL! Shannon50 H ~Shannon50 at 209.201.28.156 :3 Shannon505552

#!LPOL! Beyonce82 H Olivia5920 at 209.189.232.237 :3 Beyonce828929

#!LPOL! Kelsey198 H Alyssa5678 at 209.203.75.134 :3 Kelsey198278

#!LPOL! Nicole203 H Julia74311 at 209.189.250.214 :3 Nicole203361

#!LPOL! Jasmine27 H Andrea3792 at dsl-132-ndcr2.i-55.com :3 Jasmine270357

#!LPOL! Niki68912 H Grace06891 at 9.e1bed1.client.atlantech.net :3 Niki689129

#!LPOL! Bailey427 H ~Bailey427 at d3.e8bed1.client.atlantech.net :3 Bailey427581

#!LPOL! Emily9352 H Morena9837 at a4.e3bed1.client.atlantech.net :3 Emily935216

#!LPOL! Nicole893 H Isabella19 at pc66.cbk.gov.kw :3 Nicole893482

#!LPOL! Hannah294 H ~Hannah294 at 209.189.244.252 :3 Hannah294622

#!LPOL! Savannah7 H Sierra3410 at d-174-51-nospr3.i-55.com :3 Savannah707812

#!LPOL! Marissa29 H ~Marissa29 at host210.terransolutions.com :3 Marissa298910

#!LPOL! Marissa89 H Laura07290 at www.bdrtransport.com :3 Marissa898535

#!LPOL! Shakira76 H user14 at 209.202.78.118 :3 Shakira762665

#!LPOL! Jenna8438 H ~Jenna8438 at d-173-32-nospr2.i-55.com :3 Jenna843871

#!LPOL! Ashley377 H Faith87547 at 19.crcr6.xdsl.nauticom.net :3 Ashley377799

#!LPOL! Andrea434 H Elizabeth9 at 209.202.78.59 :3 Andrea434270

#!LPOL! Jessica49 H Yamilla634 at cp209-202-78-157.cp.telus.net :3 Jessica494079

#!LPOL! Caitlin83 H Mackenzie6 at 5a.e1bed1.client.atlantech.net :3 Caitlin835383

#!LPOL! Denise777 H Molly48369 at df.ebbed1.client.atlantech.net :3 Denise777131

#!LPOL! Nicole948 H Aaliyah253 at 209.183.203.7 :3 Nicole948345

#!LPOL! Haley0390 H Leslie5962 at b5.e2bed1.client.atlantech.net :3 Haley039010

#!LPOL! Samantha1 H Lauren9830 at 209.178.193.220 :3 Samantha151353

#!LPOL! Niki13026 H Kimberly97 at a7.c8bed1.client.atlantech.net :3 Niki130268

 

I hope this isn't off topic.

 

-Drew

 


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nanog.org/pipermail/nanog/attachments/20030806/a4b1e4d0/attachment.html>


More information about the NANOG mailing list