Silent noise - about spam, trojans and other nasty stuff

Only a small detail today, I don't know if this is significant at all.

I had a quick look for new domains on the Asprox botnet today.
Only one showed up: fnygfr.com. (A bit later fmhxqutvccr.org and gbrpn.orgshowed up:)
A bit different than the "naming pattern" of the Asprox domains.

Then I found both domains in this long list from F-Secure:
http://www.f-secure.com/weblog/archives/downadup_domain_blocklist_17_31.txt
More about the list

In short: fnygfr.com, fmhxqutvccr.org and gbrpn.org are domains expected to possibly show up in conjunction with the DownAdup worm. Expected to be registered between January 17 and 31.
They were registered on January 20, and showed up today. On the Asprox botnet.

A screenshot from bfk.de:

And they serve the usual asprox menu of javascript files.

Waledac? DownAdup/Conficker? Asprox?

I have earlier found a similar detail regarding Waledac:
Waledac? Storm? Or maybe it is Asprox?
And now a domain expected to show up as a DownAdup domain shows up as an Asprox domain.
Only a couple of small details.

But around the same time (the last few days) I haven't got any new greeting card or Obama spam linking to the socalled Waledac.
And F-Secure is asking today: "Where is Downadup?":
http://www.f-secure.com/weblog/archives/00001589.html
And notes a small decline.

In the same short period of time, the Asprox botnet wakes up again.

Again, this is only based on what I see from my little corner of the world, a pure amateurs world. Regard it as speculations based on very little facts.

And btw, I am getting some hits from this article on shadowserver:
http://www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20090122.
Interesting stuff. With further links to other Asprox writings on Shadowserver.

And totally unrelated:
The sun is back after the usual two months vacation, I saw it today! Happy!
That's always good, getting better and better each year.
And even more worse every year when it disappears again in November.