427 Botnet fm qxd

Botnet Command and Control Servers Report
A report of botnet C&Cs (however defined) as counted in various net-
work routing domains (Autonomous Systems) is available at
www.syngress.com
436
Chapter 12 • Responding to Botnets
Continued
427_Botnet_12.qxd 1/9/07 3:08 PM Page 436

---

www.isotf.org. The report is also published publicly on the North
American Network Operators Group, located at www.merit.edu/
mail.archives/nanog/. The report ranks ISP routing domains in various
ways, including active C&Cs and C&Cs taken down. The report is sorted
various ways. The version here is sorted according to the ASN with the
most active C&Cs and is dated 30 Dec 2006.
Top 20 ASNs by number of active suspect C&Cs:
Percent_
ASN Responsible Party Total Open Resolved
13301 UNITEDCOLO-AS Autonomous System of 107 27 75
174 Cogent Communications 30 25 17
19318 NJIIX-AS-1 - NEW JERSEY INTERN 132 25 81
23522 CIT-FOONET 44 21 52
25761 STAMIN-2 Staminus Communications 31 18 42
8560 SCHLUND-AS 28 15 46
30058 FDCSE FDCservers.net LLC 51 15 71
16265 LEASEWEB AS 37 12 68
9318 HANARO-AS 35 11 69
21844 THE PLANET 15 11 27
4766 KIXS-AS-KR 49 10 80
3786 ERX-DACOMNET 22 10 55
29737 WideOpenWest LLC 14 7 50
7132 SBC Internet Services 33 6 82
4782 GSNET 6 6 0
1781 KAIST-DAEJEON-AS-KR Korea Advanced 9 6 33
21050 FAST-TELCO kw.fast-telco Autnomous 11 6 45
13213 UK2NET-AS UK-2 Ltd Autonomous Syste 32 6 81
19444 CHARTER COMMUNICATIONS 7 5 29
23966 Dancom Pakistan PVT) Limited 7 5 29
Fighting Back
No chapter on responses to botnets would be complete without a mention of
Blue Security and Blue Frog.
www.syngress.com
Responding to Botnets • Chapter 12