[Operators] Let's start some witch-hunt

Andreas Monitzer xmppoperator at monitzer.com
Tue Jun 15 16:37:45 CDT 2010


On Jun 15, 2010, at 23:31, Peter Schwindt wrote:

> Martin (of hot-chilli.*) was the first to publicly (on jadmin-ML,  
> about
> 2 weeks ago) mention a bunch of weird registrations. The accounts to  
> be
> considered all look nearly the same: A posix timestamp + ("LOP" or
> "LMC") + server part (i.e. 1275746522321lmc at jabber.ccc.de). And there
> were lots of them. Right now I (administering jabber.ccc.de) see about
> 1k of them on my server.

Maybe I'm stating the obvious here, but this really sounds like a  
virus-originated botnet using XMPP as the control channel.

Regards,
Andreas



More information about the Operators mailing list