TABLE OF CONTENTS A public channel for reporting botnets is located at c2report@isotf.org. The e-mail address is kept by Evi Gadron, an information security manager for the Israel CERT. The ISOTF distributes a monthly command and control report listing the top 20 ASNs by total suspect domains mapping to a host in the ASN, and the top 20 ASNs by number of active suspect command and controls.
Gadron also runs a mailing list for people who are interested in discussions about botnets, located at www.whitestar.linuxbox.org/mailman/listinfo/botnets.
Botnet Command & Control Servers Report
These top 20 lists are extracted from the May 2006 Command and Control report produced from reports sent to csreport@isotf.org. The report is published publicly on the North American Network Operators Group, located at www.merit.edu/mail.archives/nanog/.
This month s survey is of 3,151 unique domains (or IPs) with port suspect C&Cs. This list is extracted from the BBL, which has a historical base of 10,115 reported C&Cs. Of the suspect C&Cs surveyed, 649 reported as open, 935 reported as closed, and 569 issued resets to the survey instrument. Of the C&Cs listed by domain name in the C&C database, 4,666 are mitigated.
Top 20 ASNs by total suspect domains mapping to a host in the ASN: These numbers are determined by counting the number of domains which resolve to a host in the ASN. We do not remove duplicates and some of the ASNs reported have many domains mapping to a single IP. Note that the Percent-resolved...
