[nsp-sec] Adding Destination Address to Conficker C Reports

[Nicholas Ianelli]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


> Will we see destination addresses in Mebroot reports to in the near
> future? We are having the same problems with NAT users. And Mebroot is a
> lot more difficult to detect on systems.

Here are a number of the IPs Mebroot domains have used in the very
recent past:

65.60.42.26
65.60.34.186
69.64.75.66
67.212.179.130
66.240.243.155
206.225.86.123

Nick

- --
Nicholas Ianelli: NeuStar, Inc.
Security Operations

46000 Center Oak Plaza Sterling, VA 20166
+1 571.434.4691 - http://www.neustar.biz

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)

iEYEARECAAYFAkooRaMACgkQi10dJIBjZIBulgCfSW+r2h1V/wRQz8kO6JR4X658
0xkAn2AwuPBsC1MXJjuZVG3Nt9yk9N21
=SgGo
-----END PGP SIGNATURE-----