You search a fast-flux domain e.g www.eastevening.com
	The NameServer of this domain change the A record for www.eastevening.com
	every minutes to a different IP-Address.
	This hosts are hosting a copy of the spammer domain content.
	Now you can write a tool which checks the A record of www.eastevening.com
	(or a different domain which is using the fast-flux technic) every minute
	and log the IP-Address where the A record points to. Normaly, the host which
	the A record points to is infected with malware which can be removed by
	Spybot Search & Destroy or Microsoft's Malicious Software Removal Tool (MSRT).
  More info: http://subnets.ru/blog/
  More info: http://www.honeynet.org/papers/ff/fast-flux.html
  More info: http://spamtrackers.eu/wiki/index.php?title=Fast-flux
  More info: http://www.spamhaus.org/faq/answers.lasso?section=ISP%20Spam%20Issues#164
  More info: http://www.youtube.com/watch?v=NTNX0vMH2Xg

  Simple perl script for detect bot computers: bot-dns.pl  [current domain-list-file.txt]

Active fast-flux domain list
#DomainInsert date
1jkoodzu.cn24.10.2008 08:51
2www.aqua-keeper.ru02.10.2008 19:50
3www.chehoffdom.ru02.10.2008 18:12
4www.tripforme.ru02.10.2008 17:43
5mountcompare.com19.09.2008 14:03
6startmany.com19.09.2008 14:03
7aboveto.com17.09.2008 14:24
8necklocate.com10.09.2008 11:29
9usebroad.com10.09.2008 11:29
10workmay.com09.09.2008 13:52
11southspread.com09.09.2008 13:52
12appreciationbat.com09.09.2008 13:52
13www.cornerapple.com09.09.2008 13:52
14VISITCOLOR.COM28.08.2008 18:47
15guessquart.com18.08.2008 08:38
16sensewait.com18.08.2008 08:38
17beautyeither.com18.08.2008 08:38
18numbereach.com18.08.2008 08:38
19girlguess.com18.08.2008 08:38
20suddentool.com18.08.2008 08:38
21adjzw.whetherthus.com18.08.2008 08:38
22whetherthus.com18.08.2008 08:38
23ueuag.pitchinclude.com18.08.2008 08:38
24pitchinclude.com18.08.2008 08:38
25countrybroad.com18.08.2008 08:38
26substancesolve.com18.08.2008 08:38
27earthlink.net18.08.2008 08:38
28ruskahs.tk06.06.2008 12:58
29rx444.org29.11.2007 19:17