Damballa: Tracking the IMDDOS Botnet

The newly discovered IMDDOS Botnet is a commercial DDoS service. The botnet grew large very quickly. Beginning testing in April 2010, it reached a production peak activity by the second week of August of 25,000 unique recursive DNS lookups/hour to the command-and-control (CnC) servers.This paper details the growth of the IMDDOS Botnet, the commercial aspects of its operation, the technical