RE: [gnso-ff-pdp-may08] fast flux numbers lately

[Jose Nazario <jose@xxxxxxxxx>]

On Wed, 19 Nov 2008, Greg Aaron wrote:

> Can you comment on how many FF domains were you seeing before November 
> 4, and now?
we had been tracking ~2000 live (1800-2200 solidly) distinct fflux domains 
a day for a few months (steady state had been reached with our collection 
methods, etc) prior to the early november crash. now we're seeing ~750-800 
solidly a day.
bot counts are down slightly, so this COULD be the fact that only a 
handful of botnets were affected and that many more remain up and running.
-------------------------------------------------------------
jose nazario, ph.d.             <jose@xxxxxxxxx>
manager of security research    arbor networks
v: (734) 821 1427               http://asert.arbornetworks.com/