IRC Bot list (cross posting)

Thu Feb 10 08:09:48 UTC 2005

On Thu, 10 Feb 2005, Jim Popovitch wrote:

> I don't know how relevant this is to your question, but since it was
> part of the Subject here it goes:  The botlist MUST have been
> interesting to a sizable number of NANOG'ers.  At least 305 people
> (different IPs) downloaded the version that I posted here last night.

Yes, there are number of good netadmins who want to make sure they don't
have one of these bots on their network (and number of bad guys who
want to see entire list), but if you consider total number of networks 
in the world, 305 is not all that many and I doubt most of the bots
on that list were killed because people found the list at nanog...

However since there was shown enough of the interest from people on nanog@ 
to help in killing bots and knowing about it, may I suggest that people 
who are doing the tracking setup the following:
 1. Website where person can come and enter ip address block or domain 
    and see number of bots on that network (but not actual ip addresses).
 2. After that the person should be able to register (entering full
    name and contact data and company he/she works) and can than get
    access to see entire list of ip addresses for particular company
    (and possibly even do more and mark ips that have been taken care of).
 3. Additionally there could be regular post on nanog@ (once/week or 
    once/month depending how much nanog can tolerate) reminding of the 
    website and with summary including total number of botnet ip 
    addresses listed in the database, plus possibly list of 10 networks 
    that have largest number of unhandled bots.

So, Gadi, are you taking notes?

-- 
William Leibzon
Elan Networks
william at elan.net