[nsp-sec] AS27595 (Intercage) Their back - implications..

[Dave Mitchell]

I sent out a graph yesterday, but somehow it never made it. I've
attached a graph of the last weeks application traffic coming from
_27595$. 

Interesting that after a bit spike in HTTP, DNS started trickling into
our network again. Wonder if the bots got updated to use new dns
resolvers...

-dave

On Wed, Sep 24, 2008 at 12:55:56PM -0500, Rob Thomas wrote:
> ----------- nsp-security Confidential --------
> 
> We're graphing global traffic stats to those netblocks now.  Does anyone
> have any other Intercage/Atrivo related netblocks we should track?
> 
> I'll post the graphs in the nsp-sec section of our website shortly.
> 
> 
> -- 
> Rob Thomas
> Team Cymru
> http://www.team-cymru.org/
> cmn_err(CEO_PANIC, "Out of coffee!");
> 
> 
> 
> _______________________________________________
> nsp-security mailing list
> nsp-security at puck.nether.net
> https://puck.nether.net/mailman/listinfo/nsp-security
> 
> Please do not Forward, CC, or BCC this E-mail outside of the nsp-security
> community. Confidentiality is essential for effective Internet security counter-measures.
> _______________________________________________
-------------- next part --------------
A non-text attachment was scrubbed...
Name: graph395ae266f51870e51db094e44abced35.png
Type: image/png
Size: 5110 bytes
Desc: not available
URL: <https://puck.nether.net/mailman/private/nsp-security/attachments/20080924/4f8ba592/attachment-0001.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 186 bytes
Desc: not available
URL: <https://puck.nether.net/mailman/private/nsp-security/attachments/20080924/4f8ba592/attachment-0001.sig>