The article quoted is: http://voices.washingtonpost.com/securityfix/2008/11/srizbi_botnet_re-emerges_despi.html http://voices.washingtonpost.com/securityfix/200

The article quoted is: http://voices.washingtonpost.com/securityfix/2008/11/srizbi_botnet_re-emerges_despi.html http://voices.washingtonpost.com/securityfix/2008/11/srizbi_... The important bit for me was: "The problem, FireEye quickly found, was that each variant was designed to seek out a different set of four rescue domains every 72 hours. To make matters worse, the company identified more than 50 variants of Srizbi in circulation, impacting 500,000 systems. Those that were deficient or ill-programmed in some way controlled fewer victims -- anywhere from a few hundred to a few thousand computers. The more virulent strains of Srizbi, however, controlled upward of 50,000 systems, FireEye found. That meant that to prevent the Srizbi authors from regaining control over their herd, FireEye would have to register more than 450 domains each week just to stay a step ahead of the bad guys. But each domain name registered costs money. FireEye spent $4,000 buying up future domains that might be sought by stranded Srizbi bots." It would be interesting to see what sort of intelligence they were able to gather while they were running this operation.