Re: [botnets] botnets Digest, Vol 24, Issue 1

2008-02-02 Thread Randy Mueller 
To report a botnet PRIVATELY please email: [EMAIL PROTECTED]
--
Hey thanks. That is nice info. Sad. But still nice.

Great!
Randy M
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] 
Sent: Saturday, February 02, 2008 12:00 PM
To: botnets@whitestar.linuxbox.org
Subject: botnets Digest, Vol 24, Issue 1

Send botnets mailing list submissions to
botnets@whitestar.linuxbox.org

To subscribe or unsubscribe via the World Wide Web, visit
http://www.whitestar.linuxbox.org/mailman/listinfo/botnets
or, via email, send a message with subject or body 'help' to
[EMAIL PROTECTED]

You can reach the person managing the list at
[EMAIL PROTECTED]

When replying, please edit your Subject line so it is more specific
than Re: Contents of botnets digest...


Today's Topics:

   1. botnets visualization (David Vorel)
   2. Re: botnets visualization (mark seiden-via mac)


--

Message: 1
Date: Fri, 1 Feb 2008 23:52:10 +0100
From: David Vorel [EMAIL PROTECTED]
Subject: [botnets] botnets visualization
To: botnets@whitestar.linuxbox.org
Message-ID: [EMAIL PROTECTED]
Content-Type: text/plain; charset=us-ascii

Hi all,

i made sample diagram from our database for IP/domain match, maybe
it'll be useful for somebody.


http://www.honeynet.cz/img/small.jpg

http://www.honeynet.cz/img/big.jpg


Cheers

David Vorel
-- next part --
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
Url :
http://www.whitestar.linuxbox.org/mailman/private/botnets/attachments/200802
01/9aa34781/attachment-0001.pgp 

--

Message: 2
Date: Fri, 1 Feb 2008 15:47:19 -0800
From: mark seiden-via mac [EMAIL PROTECTED]
Subject: Re: [botnets] botnets visualization
To: David Vorel [EMAIL PROTECTED]
Cc: botnets@whitestar.linuxbox.org
Message-ID: [EMAIL PROTECTED]
Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes

what software do you use to do this?

what is the meaning of a directed line from one node to another?   
(e.g. communication in the direction
of the arrow, or controlled by the thing the arrow points to...)

is there any way to make this searchable?

is there any way to try to cluster the machines which are close  
together (using any metric) to be physically close together?
i'm not sure what metrics you might want to use.  possibly just in  
the same AS.




On Feb 1, 2008, at 2:52 PM, David Vorel wrote:

 To report a botnet PRIVATELY please email: [EMAIL PROTECTED]
 --Hi all,

 i made sample diagram from our database for IP/domain match, maybe
 it'll be useful for somebody.


 http://www.honeynet.cz/img/small.jpg

 http://www.honeynet.cz/img/big.jpg


 Cheers

 David Vorel
 ___
 To report a botnet PRIVATELY please email: [EMAIL PROTECTED]
 All list and server information are public and available to law  
 enforcement upon request.
 http://www.whitestar.linuxbox.org/mailman/listinfo/botnets



--

___
botnets mailing list
botnets@whitestar.linuxbox.org
http://www.whitestar.linuxbox.org/mailman/listinfo/botnets


End of botnets Digest, Vol 24, Issue 1
**

___
To report a botnet PRIVATELY please email: [EMAIL PROTECTED]
All list and server information are public and available to law enforcement 
upon request.
http://www.whitestar.linuxbox.org/mailman/listinfo/botnets

Re: [botnets] botnets visualization

2008-02-02 Thread David Vorel 
To report a botnet PRIVATELY please email: [EMAIL PROTECTED]
--

As i wrote directly to to Mark, I'm sending comments to list.

 what software do you use to do this?

Graphviz and perl module.

 what is the meaning of a directed line from one node to another?   
 (e.g. communication in the direction
 of the arrow, or controlled by the thing the arrow points to...)

If cc domain use more IP, then there exists more edges to it. If
another different cc domain use any from matched IP's, then 
another edge span another group of IP's in this cc, etc..

 is there any way to make this searchable?

Not directly.

 is there any way to try to cluster the machines which are close  
 together (using any metric) to be physically close together?
 i'm not sure what metrics you might want to use.  possibly just in  
 the same AS.

It's good idea for future.


Btw: Here is small circle view, maybe better for quick structure
corelation.

http://www.honeynet.cz/img/small-circo.jpg





Cheers

David Vorel


signature.asc
Description: Digital signature
___
To report a botnet PRIVATELY please email: [EMAIL PROTECTED]
All list and server information are public and available to law enforcement 
upon request.
http://www.whitestar.linuxbox.org/mailman/listinfo/botnets

[botnets] SpamThru Spambot and Spam Cannon Technique

2008-02-02 Thread lanierwatkins 
To report a botnet PRIVATELY please email: [EMAIL PROTECTED]
--
Is there an indepth reference on the SpamThru Spambot and the Spam Cannon 
Technique?

Lanier
___
To report a botnet PRIVATELY please email: [EMAIL PROTECTED]
All list and server information are public and available to law enforcement 
upon request.
http://www.whitestar.linuxbox.org/mailman/listinfo/botnets