Botnet Traffic


Can anyone on this list provide botnet network traffic for analysis, or Ip’s which have been infected.

Have you considered contacting Team Cymru or Shadowserver? As far as I
know, they are the two major groups who collect this sort of
information on a non-local scale. I believe Team Cymru at least has
someone who follows NANOG..

The largest issue here is going to be trust -- it is highly unlikely
your just going to get huge dumps of useful information, especially if
your intentions are for-profit.

Best of luck.

Hi James,

Normally few people are going to be unwilling to provide such a thing,
at least for live or recently active botnets to the general public. In
essence, few people like to spread that sort of dirty laundry around to
anyone who comes asking in a public forum.

However, there is some public data available in various locations. For
instance, the Dragon Research Group (DRG) provides some public data it
sees on the well known HTTP, VNC and SSH ports. The SSH report is
primarily compiled from random SSH brute force spreading worms.


Note, I'm one of the DRG volunteers.

You can browse around the SANS ISC reports and get an idea of what they
see from various hosts and networks too.


I'm not involved with that organization.

Lenny Zeltser has a page detailing where you might get some sample
malware to research:


There are likely many other sources of info if you dig around,
but you may be better off asking in another forum where security,
rather than networking is the major theme. Feel free to contact me off
list and I'll see if I can help introduce you to the appropriate venues.


Thank you, this will be helpful.