This is a periodic public report from the ISOTF's affiliated group 'DA' (Drone Armies (botnets) research and mitigation mailing list / TISF DA) with the ISOTF affiliated ASreport project (TISF / RatOut). For this report it should be noted that we base our analysis on the data we have accumulated from various sources, which may be incomplete. Any responsible party that wishes to receive reports of botnet command and control servers on their network(s) regularly and directly, feel free to contact us. For purposes of this report we use the following terms open the host completed the TCP handshake closed No activity detected reset issued a RST This month's survey is of 5621 unique, domains (or IPs) with port suspect C&Cs. This list is extracted from the BBL which has a historical base of 8182 reported C&Cs. Of the suspect C&Cs surveyed, 674 reported as Open, 3507 reported as closed, and 678 issued resets to the survey instrument. Of the C&Cs listed by domain name in the our C&C database, 1739 are mitigated. Top 20 ASNes by Total suspect domains mapping to a host in the ASN. These numbers are determined by counting the number of domains which resolve to a host in the ASN. We do not remove duplicates and some of the ASNs reported have many domains mapping to a single IP. Note the Percent_resolved figure is calculated using only the Total and Open counts and does not represent a mitigation effectiveness metric. Percent_ ASN Responsible Party Total Open Resolved 14744 PNAP Internap Network Services 118 17 86 10913 PNAP Internap Network Services 96 0 100 3356 Level 3 Communications, LLC 72 0 100 30058 FDCSE FDCservers.net LLC 65 9 86 25761 STAMIN-2 Staminus Communications 64 18 72 19318 AIC-81 Albany International Corp. 61 21 66 13301 UNITEDCOLO-AS Autonomous System of 57 35 39 14779 INKT Inktomi Corporation 56 0 100 4766 KIXS-AS-KR 46 8 83 12182 PNAP Internap Network Services 44 0 100 21844 THE PLANET 40 0 100 30315 Everyones Internet 34 10 71 13790 PNAP Internap Network Services 33 0 100 8972 INTERGENIA-ASN intergenia autonomou 30 17 43 21840 SAGONE Sago Networks 29 3 90 27595 ATRIV Atrivo 29 4 86 8560 SCHLUND-AS 28 4 86 3561 Savvis 27 2 93 8220 COLT COLT Telecommunications 26 14 46 6981 FDN.com 25 15 40 Top 20 ASNes by number of active suspect C&Cs. These counts are determined by the number of suspect domains or IPs located within the ASN completed a connection request. Percent_ ASN Responsible Party Total Open Resolved 13301 UNITEDCOLO-AS Autonomous System of 57 35 39 19318 AIC-81 Albany International Corp. 61 21 66 25761 STAMIN-2 Staminus Communications 64 18 72 14744 PNAP Internap Network Services 118 17 86 8972 INTERGENIA-ASN intergenia autonomou 30 17 43 30407 Velcom.com 19 17 11 6981 FDN.com 25 15 40 8220 COLT COLT Telecommunications 26 14 46 19875 IPWORL IPWorld Networks 23 13 43 702 MCI EMEA - Commercial IP 22 13 41 23522 CIT-FOONET 18 12 33 15083 IIS-129 Infolink Information Servic 18 11 39 3462 HINET 24 10 58 9318 HANARO-AS 25 10 60 30315 Everyones Internet 34 10 71 174 Cogent Communications 14 10 29 30058 FDCSE FDCservers.net LLC 65 9 86 29073 COLINKS-AS Colinks web and game hos 9 9 0 19166 Alpha Red, INC 12 8 33 4766 KIXS-AS-KR 46 8 83 Randal Vaughn Gadi Evron Professor ge at linuxbox.org Baylor University Waco, TX (254) 710 4756 randy_vaughn at baylor.edu