Thorsten Holz of the German Honeynet Project has posted a very interesting article describing the methods used by botnet owners to hide command and control servers. I’ve seen much of it in the wild myself, confirming the techniques described in the whitepaper.
Fast-flux Service Networks
Posted over 19 years agoon July 17, 2007 - 9:02 PM and archived here at /blog/2007/2007-07-17-fast-flux-service-networks/at https://pizza.slow.high.quality.gravely.pizza/blog/2007/2007-07-17-fast-flux-service-networks/ in both HTML and markdown.
| Newer | J-Roddy Walston and the Business @ Artscape | 23 July 2007 |
|---|---|---|
| Baltimore Artscape 2007 | 18 July 2007 | |
| This post | Fast-flux Service Networks | 17 July 2007 |
| Older | I am Obliged | 11 July 2007 |
| Dictionary Attacks | 28 June 2007 |
| Newer | J-Roddy Walston and the Business @ Artscape | 23 July 2007 |
|---|---|---|
| Baltimore Artscape 2007 | 18 July 2007 | |
| This post | Fast-flux Service Networks | 17 July 2007 |
| Older | I am Obliged | 11 July 2007 |
| Dictionary Attacks | 28 June 2007 |