Assuming it is not a futile/wasted effort, where is the current best place/resource to report an active botnet C&C to?
On Feb 8, 2012, at 10:20 AM, Ryan Rawdon wrote:
Assuming it is not a futile/wasted effort, where is the current best place/resource to report an active botnet C&C to?
Probably the abuse contact for the network in question, if contact info is available. ----------------------------------------------------------------------- Roland Dobbins <rdobbins@arbor.net> // <http://www.arbornetworks.com> The basis of optimism is sheer terror. -- Oscar Wilde
It may be worth reporting it to Shadow Server: http://www.shadowserver.org/wiki/pmwiki.php/Contact/ContactUs On Wed, Feb 8, 2012 at 11:23 AM, Dobbins, Roland <rdobbins@arbor.net> wrote:
On Feb 8, 2012, at 10:20 AM, Ryan Rawdon wrote:
Assuming it is not a futile/wasted effort, where is the current best place/resource to report an active botnet C&C to?
Probably the abuse contact for the network in question, if contact info is available.
----------------------------------------------------------------------- Roland Dobbins <rdobbins@arbor.net> // <http://www.arbornetworks.com>
The basis of optimism is sheer terror.
-- Oscar Wilde
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 2/7/2012 10:20 PM, Ryan Rawdon wrote:
Assuming it is not a futile/wasted effort, where is the current best place/resource to report an active botnet C&C to?
Team Cymru is always happy to hear about C&Cs, your best bet for sending to us is to use support@cymru.com. Thanks, Tim Wilde - -- Tim Wilde, Software Engineer, Team Cymru, Inc. twilde@cymru.com | +1-847-378-3333 | http://www.team-cymru.org/ -----BEGIN PGP SIGNATURE----- iEYEARECAAYFAk8yqRQACgkQluRbRini9tiX9ACeOLiCon9Hz8TQ8MOdTbL5Jbvx Tl0AmgMu135iJScJwbx3kxbwMaqWuaBm =Hldr -----END PGP SIGNATURE-----
On Tue, Feb 07, 2012 at 10:20:07PM -0500, Ryan Rawdon wrote:
Assuming it is not a futile/wasted effort, where is the current best place/resource to report an active botnet C&C to?
I don't know if there's a single best option, but there are several good ones. In addition to Cymru I'd mention abuse.ch, which runs several public botnet C&C trackers. http://www.abuse.ch Nicolai
hi, On Feb 8, 2012, at 1:04 PM, Nicolai wrote:
On Tue, Feb 07, 2012 at 10:20:07PM -0500, Ryan Rawdon wrote:
Assuming it is not a futile/wasted effort, where is the current best place/resource to report an active botnet C&C to?
I don't know if there's a single best option, but there are several good ones. In addition to Cymru I'd mention abuse.ch, which runs several public botnet C&C trackers.
DroneBL does investigate and track C&Cs, or at least, did when I ran it. I would assume that it still does, so you may wish to contact them. William
participants (6)
-
Dobbins, Roland -
Nicolai -
Ryan Rawdon -
Tim Wilde -
toor -
William Pitcock