Hunting Waledac Botnet Fast Flux IP Addresses

Ruby Oneliner

ruby -e '1000.times {|i| print `nslookup #{"smsclubnet.com"}`}' | grep Address | grep -v \#53 | awk '{print $2}'>> waledac_list-IP

Resultant Product

cat waledac_list-IP | wc -l
1000

 cat waledac_list-IP | sort -u | wc -l
185

185 Fast Flux IP Addresses Sampling

112.76.132.115
113.131.247.137
115.23.21.130
115.43.127.170
115.88.199.200
115.88.229.37
115.92.199.45
116.12.40.99
116.41.12.69
118.129.47.130
118.218.233.130
118.232.218.209
118.32.88.41
118.35.41.130
118.43.5.51
119.204.10.150
119.246.58.44
119.77.227.84
119.77.244.133

Reverse Look up of sample

ruby -e 'File.foreach("sample_list") {|i| print `nslookup #{i}`}'

** server can't find 51.5.43.118.in-addr.arpa.: NXDOMAIN

Server:        208.67.222.222
Address:    208.67.222.222#53

** server can't find 150.10.204.119.in-addr.arpa.: NXDOMAIN

Server:        208.67.222.222
Address:    208.67.222.222#53

** server can't find 44.58.246.119.in-addr.arpa.: NXDOMAIN

Server:        208.67.222.222
Address:    208.67.222.222#53

** server can't find 84.227.77.119.in-addr.arpa.: NXDOMAIN

Server:        208.67.222.222
Address:    208.67.222.222#53

** server can't find 133.244.77.119.in-addr.arpa.: NXDOMAIN