Hello,
I was wondering if anyone had a comprehensive list of the actual mining addresses that pools use, I have been creating my own to work off IDS correlations in order to detect Bitcoin and Litecoin mining botnets but I've only got about 70 so far and was hoping that someone may have a similar list already I could utilize instead of having to investigate every btc and ltc pool website i can find to simply get their mining addresses / ports. Any help would be greatly appreciated. Proxified pools, proxies pointing to specific pools, private and p2p-pool's would be great too. Currently working on a User Agent pickup signature for Ufasoft since most of the botnets are based off it these days, though after locating the insidious bitcoin miner while researching it seems it actually utilizes stratum and cgminer. Anywho, most of the botnets we we have been discovering are being posted here "
http://www.exposedbotnets.com/search/label/Bitcoin%20Miner%20%20Botnet" with full details on them, worker names, proxies and pools being used. I have emailed almost every owner of pools that are being utilized by botnets with only about 30% removing their accounts and contacting me back. If anyone can help this overworked security analyst out it would be greatly appreciated.
Thanks,
detro
bitcoin security guy
