[nsp-sec] Multiple DDoS attacks (More outbound bot IP calls)
Dave Mitchell
davem at yahoo-inc.com
Thu Jul 9 00:57:09 EDT 2009
Hey all,
I've attached a total of 128k bot sources over since 7/4.
Format of the files is:
YYYYMMDDTHH IP COUNT ASN COUNTRY
uniq ips:
135 DE
366 JP
606 CA
771 CN
2172 US
123343 KR
128744 total
-dave
On Wed, Jul 08, 2009 at 03:05:43PM -0700, Dave Mitchell wrote:
> ----------- nsp-security Confidential --------
>
> Here are some more IP's that the bot talks to. These are more likely a
> C&C layer than the previous 3 IP's. Lets get some intel on these! :)
>
> 11.67.208.29.9500 tcp korea wizsolution co.,Ltd
>
> 116.125.35.71.8010 tcp korea skbroadband
>
> 116.42.196.95 on 33333 tcp inbound (nothing listening.... unrelated?) LG
> Powercom
>
> 118.216.107.28.8010 tcp korea skbroadband
>
> 118.216.107.31.8010 tcp korea skbroadband.... some sort of controller.
> see XML
>
> 118.223.190.117.33333 tcp korea sk
>
> 121.144.118.242.50001 tcp korea kornet.net ... tons of encrypted data
>
> 121.146.11.139.33333 tcp kornet.net
>
> 125.189.29.34.33333 tcp korea powercomm.com
>
> 168.126.68.145 on 33333 tcp inbound (nothing listening.... unrelated?)
> kornet.net
>
> 203.234.132.71.80 tcp kortnet.net
>
> 220.87.59.29.33333 tcp kortnet.net
>
> 222.122.176.56.80 tcp kortnet.net
>
> 94.75.253.209.80 tcp. tons and tons of traffic going to LeaseWeb in the
>
> Netherlands. LeaseWeb is getting to be
> +pretty notorious for hosting malware
>
> 221.139.107.248 www.auction.co.kr
> 222.122.51.92 blog.naver.com
> 121.156.115.2 www.auction.co.kr
> 121.157.108.31 banking.nonghyup.com
> 114.111.32.220 mail.naver.com
> 211.61.51.101 www.president.go.kr
> 61.110.198.149 www.auction.co.kr
> 61.110.198.25 www.auction.co.kr
> 61.74.67.111 www.hannara.or.kr
> 61.74.71.110 blog.naver.com
>
> -dave
>
> On Wed, Jul 08, 2009 at 09:23:11PM +0000, John Fraizer wrote:
> > ----------- nsp-security Confidential --------
> >
> > I'm capturing flows on 216.199.83.203.
> >
> >
> > On Wed, Jul 8, 2009 at 4:03 AM, Dave Mitchell <davem at yahoo-inc.com> wrote:
> >
> > > ----------- nsp-security Confidential --------
> > >
> > >
> > > Anyone gathering intel on?
> > >
> > > Remote Host Port Number
> > > 213.33.116.41 53
> > > 216.199.83.203 80
> > > 213.23.243.210 443
> > >
> > >
> > > http://www.threatexpert.com/report.aspx?md5=0f394734c65d44915060b36a0b1a972d
> > >
> > > The malware in those droppers seems to speak to it and I verified in a
> > > sandbox.
> > >
> > > -dave
> > >
> > >
> >
> >
> > _______________________________________________
> > nsp-security mailing list
> > nsp-security at puck.nether.net
> > https://puck.nether.net/mailman/listinfo/nsp-security
> >
> > Please do not Forward, CC, or BCC this E-mail outside of the nsp-security
> > community. Confidentiality is essential for effective Internet security counter-measures.
> > _______________________________________________
>
>
> _______________________________________________
> nsp-security mailing list
> nsp-security at puck.nether.net
> https://puck.nether.net/mailman/listinfo/nsp-security
>
> Please do not Forward, CC, or BCC this E-mail outside of the nsp-security
> community. Confidentiality is essential for effective Internet security counter-measures.
> _______________________________________________