Interesting article on botnets...

[Ankara23]

http://www.honeynet.org/papers/bots/

one of the things that caught my eye was this though...
from: http://www.honeynet.org/papers/bots/botnet-vendors.html

here they are *gathering intel* on the botnet operators
and we find this:

/stats V
-!- vhost i.hate.microsefrs.com stskeeps *@*.image.dk
-!- V End of /STATS report
// we saw similar named vhost some time ago
// seems a known network

someone should explain to them that this *operator* simply
was lazy in his config file (much less that /stats was availible at all)

[Syzop]

LOL :).
I'll have a look (&mail them) ;p.