[nsp-sec] ACK Re: 41,000+ likely Bifrose infections

[Taka Mizuguchi]

Ack for japanese ASNs.

2497,2503,2514,4694,4713,4716,4725,4732,7670,9619,10013,17511,17676,17958,23817


Paul Dokas wrote,on 09.6.2 2:31 AM:
> ----------- nsp-security Confidential --------
> 
> One of our users complained last Friday about an inbound DoS attack against
> one of their web servers (https://128.101.65.204/).  Looking over the logs,
> we found that tons of hosts from all over the world were hitting the HTTPS
> front page, but not trying to login at all.  Thanks to RobT and his remarkable
> malware database, he was able to tell me that there are variants of Bifrose
> that are using this site to check for Internet connectivity.
> 
> I pulled our flows for midnight -> 4am June 01 local time (GMT-5) and found
> the following list of 41,000+ IPs.  I suspect that there is a good chance that
> all of these hosts have some form of malware on them.
> 
>   https://asn.cymru.com/nsp-sec/upload/1243876952.whois.txt
> 
> Like I said, the times are all GMT-5 (Central US).  The number after the
> timestamp is the count of flows seen over that time period.
> 
> 
> Paul


-- 
Taka Mizuguchi