Usually one domain..? More often than not, a domain generation algorithm with lots more than just one<div> </div><div>Beyond that, please do some more research. On Thursday, June 27, 2013, Frank Gadegast wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Suresh Ramasubramanian wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> On Thursday, June 27, 2013, Frank Gadegast wrote: Any nameserver has to be registered with the registry of the domain (is there another way DNS works, I dont know ?) So: you can always find the server running the nameserver for that domain. Take this server down. for fastflux, take it down and theres a fresh ns real soon. then what? </blockquote> The botnet has usually one domain wired into the bot. This domain "a" is running on a nameserver. The bot is asking the nameserver (wich isnt changed by the botnet owner) for a second domain "b" (wich might not be registrered at all, but configured) running fastflux for the IP of its control servers. But: you can find the domain "a" by reverse engeneering the bot. Find the nameservers for "a" and your done. And if the bot is doing only single fastflux, the botnet owner HAS to update the domain at the registry, makes it even easier. Take the first nameservers down, wait for the update at the registry, take the next two nameservers down aso until there is none left. Complaining about Registries isnt the right start, even if it would make things easy. Domains could change, even complaining about the nameservers on hacked servers isnt the right start (probably because they are hosted in countries where you have no chance to to find a legal argument to take them down). I would even argue that not only the domainname cannot harm anybody, the nameservers arent doing that too. A nameservice itself isnt something illegal even if it resolves IPs for a botnet (except it resides on a hacked und misused server and if that is illegal in the country where it resides). They are both only part of a system. The harmfull parts are the bots and the intruded and misused servers, if you delete the domainname, they are all still floating about and will be soon part of the next botnet ... I personally would start at the other end and force Microsoft legally to only have PCs connected to the Internet that have an AntiVirus solution installed and running ... But then you have the antitrust agencies arguing that Microsoft is not allowed to install a antivirus solutions because it wouldnt be that nice to their competitors ... And surely have laws in all countries to forbid to run servers delivering malware and force the ISPs to remove them after knowledge ... Kind regards, Frank <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> Lets say somebodies name is "John Doo". The name itself cannot harm anybody, the person "named" John Doo can. headdesk. -- --srs (iPad) </blockquote> </blockquote></div> -- --srs (iPad)