[dns-operations] Fwd: List of hosts that hit CIRA (.CA) with a x12 multiplier on queries ("spambot killer" / "MX Record Scanning")

[Jake Zack]

> This list of 8273 hosts hit CIRA's DNS servers exactly 12 times with
> the same MX query on more than 5 occasions and appears to fit the
> topic being discussed on dns-ops related to the large botnet hitting
> 'spambot killer' webpages.
>
> Also likely related to the .CL and .BE attacks, etc, and is being run
> by the alias 'Aleksej Iliin' as part of the RBN.
>
> I also have a 2.3Meg file containing the domains queried, in case
> anybody out there wants to compare strings there, hit me up off-list.
>
> -Jacob Zack
> DNS Administrator - CIRA (.CA TLD)
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: spambotkiller-iplist.txt.gz
Type: application/x-gzip
Size: 33861 bytes
Desc: not available
URL: <https://lists.dns-oarc.net/pipermail/dns-operations/attachments/20110516/31763f21/attachment.bin>
-------------- next part --------------

-------------- next part --------------