IRC Bot traffic?
eltra1n <[email protected]> Wed, 23 Mar 2005 11:37:52 -0600
| Newsgroups | gmane.comp.security.intrusions |
|---|---|
| Message-ID | <[email protected]> |
I found some IRC traffic on port 4500 with my IDS. I grabbed some pcaps and it looks like an IRC bot...(?) Has anyone seen something like this before? [email protected] JOIN :#101-FREEDOMXDCC PING XDCC.101-Freedom :XDCC.101-Freedom PONG XDCC.101-Freedom :[101]14667 :[CrooK][email protected] QUIT :Ping timeout - Oxygen.101-Freedom PING XDCC.101-Freedom :XDCC.101-Freedom PONG XDCC.101-Freedom :[101]14667 PING XDCC.101-Freedom :XDCC.101-Freedom PONG XDCC.101-Freedom :[101]14667 :[email protected] JOIN :#101-FREEDOMXDCC :LastMetalWarrior!LastMetalWar@101Freedom-3A40D27A.sunsh1.vic.optusnet.com.au JOIN :#101-FREEDOMXDCC :[email protected] QUIT :Connection reset by peer NICK [101]14667 PING XDCC.101-Freedom :XDCC.101-Freedom PONG XDCC.101-Freedom :[101]14667 :[email protected] QUIT :Ping timeout - Oxygen.101-Freedom :[email protected] QUIT :loek :[email protected] JOIN :#101-FREEDOMXDCC PING XDCC.101-Freedom :XDCC.101-Freedom PONG XDCC.101-Freedom :[101]14667 :[email protected] QUIT :Ping timeout - Switch.Bladez.101-Freedom PING XDCC.101-Freedom :XDCC.101-Freedom PONG XDCC.101-Freedom :[101]14667 PING XDCC.101-Freedom :XDCC.101-Freedom PONG XDCC.101-Freedom :[101]14667 NICK [101]14667 PING XDCC.101-Freedom :XDCC.101-Freedom PONG XDCC.101-Freedom :[101]14667 :[email protected] QUIT :Ping timeout - Oxygen.101-Freedom :[email protected] QUIT :Ping timeout - Oxygen.101-Freedom PING XDCC.101-Freedom :XDCC.101-Freedom PONG XDCC.101-Freedom :[101]14667 :[101][email protected] PRIVMSG #101-FREEDOMXDCC :.**. ..15...14::: .8XDCC Bot Online .14:::.15.. .**. :[101][email protected] PRIVMSG #101-FREEDOMXDCC :.**. 1 pack .**. 0 of 2 slots open, Queue: 6/30, Record: 81.9KB/s :[101][email protected] PRIVMSG #101-FREEDOMXDCC :.**. Bandwidth Usage .**. Current: 77.4KB/s, Record: 89.0KB/s :[101][email protected] PRIVMSG #101-FREEDOMXDCC :.**. To request a file, type "/msg [101]00111 xdcc send #x" .**. :[101][email protected] PRIVMSG #101-FREEDOMXDCC :.**. To request details, type "/msg [101]00111 xdcc info #x" .**. :[101][email protected] PRIVMSG #101-FREEDOMXDCC :.#1 . 7x [1.1G] ..4,8 MoViE .1,1 .12,11 Hostage.TS-LRC :[101][email protected] PRIVMSG #101-FREEDOMXDCC :.**. ..15...14::: .4Rooted By The Best - Leeched By The Rest .14:::.15.. .**. PING XDCC.101-Freedom :XDCC.101-Freedom PONG XDCC.101-Freedom :[101]14667 :[101][email protected] PRIVMSG #101-FREEDOMXDCC :Total Offered: 1076.0 MB Total Transferred: 12.45 GB :[email protected] JOIN :#101-FREEDOMXDCC PING XDCC.101-Freedom :XDCC.101-Freedom PONG XDCC.101-Freedom :[101]14667 :[email protected] JOIN :#101-FREEDOMXDCC :[email protected] QUIT :Ping timeout - Switch.Bladez.101-Freedom :[email protected] JOIN :#101-FREEDOMXDCC NICK [101]14667 PING XDCC.101-Freedom -- _______________________________________________ Intrusions mailing list [email protected] http://www.dshield.org/mailman/listinfo/intrusions