Botnet IRC joins

A visualization about botnet C&C locations and activity during five days. White flashes are IRC channel joins made by infected hosts, red shows an approximation of overall area of the infection.

Category:

Science & Technology

Tags:

• botnet
• clarified
• networks
• f-secure

[Twardylikeatank]

Yeah, am I missing something here? I can see flashes, which I think are just an artifact, but no spreading.

Also, any ideas what's causing all the trafic at the flashing light seemingly situated above Adelaide? (South Central Australia.)

[clarifiednetworks]

The video isn't really about the spreading of the botnet, but the activity of different nodes belonging to it. A white flash means that an infected host has made an IRC channel join.

[Jleagle]

Wouldn't it be more useful to cover more than a few days?

[clarifiednetworks]

@Jleagle Yes it would. However, this was the data we had in our disposal. We can create visualizations for longer time period if the data is there. Also, we can sell our tools for cybercrime fighters so that they can create their own visualizations.

[pspheaven]

and how do they know this... eh its their botnet of course

[0xr00t]

нажатия таблетки для жизни

[IdentityTheftExperts]

Very interesting visual representation of IRC joins. Thanks for the great vid!

[emu163]

notice how all the infected users are central europeans or south americans, cough cough=I

[Chick6517]

Could you teach me how to make the video look like that? My video is always blurry and I feel like I&TBPSQUOm not uploading it right.