On Jun 15, 2010, at 23:31, Peter Schwindt wrote:
Martin (of hot-chilli.*) was the first to publicly (on jadmin-ML,
about
2 weeks ago) mention a bunch of weird registrations. The accounts to
be
considered all look nearly the same: A posix timestamp + ("LOP" or
"LMC") + server part (i.e. [email protected]). And there
were lots of them. Right now I (administering jabber.ccc.de) see about
1k of them on my server.
Maybe I'm stating the obvious here, but this really sounds like a
virus-originated botnet using XMPP as the control channel.
Regards,
Andreas
