[unisog] DCC Botnet at 69.31.65.245

Eric Pancer epancer at security.depaul.edu
Thu Aug 26 18:00:05 GMT 2004


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

There's a growing botnet offering copyrighted files at
69.31.65.245:6667. You might want to check if you have flows to this
destination and validate your end-hosts are not compromised. We've
seen FTP servers on 3000/tcp on each host connecting to the network.

- -- 
Eric Pancer :.: Computer Security Response Team :.: DePaul University
http://security.depaul.edu/ .:`:.:':.:`:. epancer at security.depaul.edu
pgp: 1024D/7ACBCFF3 C022 4991 41E5 51E7 683C F765 62F7 7F8E 7ACB CFF3

-----BEGIN PGP SIGNATURE-----

iQEVAwUBQS4lIRg79iScdnghAQIJGAf/f8pbGqITAT3eQI0JriH+92mBhdf7bA/E
OhF4mLYwPIyE3gxYdsvkxRLJmlcdedmWZsUw6L+iKQdrzlNuJa8DHBaark85PhKa
UK0eSYOb4VyPOUUg0EBrJjS9ywj1/CM3p1l8YiiuyLEVFD0NGWWWsPUrO3tXgJbe
DJbreAuaAyucNidkGsWhLem9i7LoA8W1kt46Z18qd9mxbROehN3bgFuy9AmYJlns
72/acSDz3Ti2Cn2EPIRiKG9JKUr6ONF9O7sPWYjzKgCIir/iwkQ9TUIjcNcLBFFa
hammdqeL3cBGmQQsS/J3s2zY43jZovDfQHcowZi4+O6FncOsdFn7Sg==
=rbso
-----END PGP SIGNATURE-----



More information about the unisog mailing list