On Thu, 10 Feb 2005, Jim Popovitch wrote:
I don't know how relevant this is to your question, but since it was part of the Subject here it goes: The botlist MUST have been interesting to a sizable number of NANOG'ers. At least 305 people (different IPs) downloaded the version that I posted here last night.
Yes, there are number of good netadmins who want to make sure they don't have one of these bots on their network (and number of bad guys who want to see entire list), but if you consider total number of networks in the world, 305 is not all that many and I doubt most of the bots on that list were killed because people found the list at nanog... However since there was shown enough of the interest from people on nanog@ to help in killing bots and knowing about it, may I suggest that people who are doing the tracking setup the following: 1. Website where person can come and enter ip address block or domain and see number of bots on that network (but not actual ip addresses). 2. After that the person should be able to register (entering full name and contact data and company he/she works) and can than get access to see entire list of ip addresses for particular company (and possibly even do more and mark ips that have been taken care of). 3. Additionally there could be regular post on nanog@ (once/week or once/month depending how much nanog can tolerate) reminding of the website and with summary including total number of botnet ip addresses listed in the database, plus possibly list of 10 networks that have largest number of unhandled bots. So, Gadi, are you taking notes? -- William Leibzon Elan Networks william@elan.net