427 Botnet fm qxd

www.syngress.com
138
Chapter 5 • Botnet Detection: Tools and Techniques
427_Botnet_05.qxd 1/9/07 9:59 AM Page 138

---

T
IP
WHOIS information can be looked up on the Web at sites provided by
the various registries. For example, see:
www.arin.net, for North America for the most part
www.apnic.net, for the Asian Pacific region
www.ripe.net, for Europe
http://lacnic.net, for Latin America
www.afrinic.net, for Africa 
Arin has a Web page discussing the ins and outs of abuse handling
at www.arin.net/abuse.html. Also visit www.abuse.net. 
Spam and Abuse
We are not going to say a lot about spam in this chapter other than to point
out a few things. If you get abuse e-mail that is from the outside world telling
you that you are sending spam, you should carefully check it out. It might be
evidence of botnet activity.There are a number of considerations here:
1. If you have a machine sending spam, your entire domain or subdo-
main could end up blacklisted, which is not helpful. It can be very
costly in terms of downtime vis-à-vis normal business. Preventive
security measures against exploits are always a good thing in the first
place. Repair of boxes infected with spambots is, of course, also
needed.
2. Be wary of open proxies on your site. An open proxy is a site that
accepts connections from an IP address and then resends the connec-
tion back to another IP address. Spammers commonly search for such
systems.They are also created by spammers via malware, to serve as
laundering sites for spam. An open proxy can indicate an infected
host. Hosts that have equal but high volumes of network traffic both
to and from them should be regarded with some suspicion.
www.syngress.com
Botnet Detection: Tools and Techniques • Chapter 5