[nsp-sec] HTTP Bot C&C Hits - 2009-06-15

Tue Jun 16 11:47:12 EDT 2009

ACK 8426 (one of these is known as bifrose infection) , 

------------------------------------------------
David Freedman
Group Network Engineering 
Claranet Limited
http://www.clara.net

-----Original Message-----
From: nsp-security-bounces at puck.nether.net on behalf of Tim Wilde
Sent: Tue 6/16/2009 14:31
To: NSP-SEC List
Subject: [nsp-sec] HTTP Bot C&C Hits - 2009-06-15

----------- nsp-security Confidential --------

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Greetings everyone!

We have received a list of approximately 120,000 IPs that were seen
fetching a page of encrypted command and control content via HTTP from a
major hosting provider within an approximately 36 hour period ending
yesterday afternoon.  That provider does not want to be named, but has
asked us to distribute this data to our contacts so that they can
identify the bots within their networks.

We have a considerable degree of certainty that any IP hitting the page
in question is a bot, and though the actual C&C content was disabled
some time ago, it is likely that these IPs are continuing to hit the
page in question.  The requests would be standard HTTP on TCP/80.

You can find individual lists of IPs for each ASN that had hits at the
following URL:

	https://www.cymru.com/nsp-sec/Owned/httpbot-20090615/

The column after the IP address is the timestamp of the last hit seen
from that IP at the time the sample was taken, in UTC.

Below my .signature you will find a list of the ASNs included, along
with the number of hits for each ASN (first column is ASN, second is
number of hits).  This file can also be found here:

	https://www.cymru.com/nsp-sec/Owned/httpbot-20090615/asnlist.txt

Please take a look at the hits for your ASN(s) and take whatever actions
you deem appropriate.  Please let us know if you have any questions, or
if we can attempt to get any further data from the provider in question
that would make these reports more useful.

Best Regards,
Tim Wilde

- -- 
Tim Wilde, Senior Software Engineer, Team Cymru, Inc.
twilde at cymru.com | +1-630-230-5433 | http://www.team-cymru.org/

NA	4
52	1
111	1
125	1
137	5
158	1
174	4
209	10
271	1
286	7
299	1
557	3
577	17
594	3
665	1
701	16
702	5
703	3
719	1
766	1
786	45
803	1
812	7
852	7
855	2
1103	4
1128	1
1213	3
1221	9
1226	1
1239	2
1251	10
1257	5
1267	8
1273	1
1290	1
1659	41
1668	1
1678	4
1680	2
1751	1
1785	2
1798	12
1853	2
1916	111
1930	5
2018	57
2042	32
2108	2
2110	2
2116	2
2119	20
2152	8
2200	25
2379	1
2385	1
2386	2
2497	1
2516	3
2527	1
2529	3
2544	1
2549	1
2571	2
2572	5
2609	709
2611	3
2646	1
2647	2
2686	2
2688	2
2697	8
2706	1
2715	21
2716	7
2764	2
2819	1
2828	2
2852	1
2856	16
2860	4
2905	1
2907	1
2914	1
2920	3
3208	2
3209	6
3215	60
3216	2
3225	27
3243	16
3248	1
3255	1
3257	1
3259	1
3261	1
3265	6
3267	1
3269	26
3292	5
3301	19
3302	1
3303	3
3304	1
3308	1
3313	2
3320	20
3324	1
3352	52
3356	5
3382	2
3449	1
3454	1
3462	689
3484	8
3491	5
3549	28
3561	2
3571	2
3593	1
3633	4
3737	1
3741	14
3758	8
3786	14
3790	12
3813	1
3816	18
3839	1
3848	1
3900	1
3911	1
3912	1
4004	1
4007	1
4134	11556
4181	1
4190	1
4230	256
4237	1
4265	1
4274	1
4323	6
4352	1
4355	1
4470	1
4515	11
4538	332
4569	1
4589	17
4604	3
4609	6
4613	1
4618	6
4621	12
4637	1
4648	1
4657	6
4668	7
4670	2
4671	49
4685	1
4713	14
4716	2
4725	3
4732	4
4739	2
4741	13
4747	1
4750	25
4755	81
4758	1
4760	20
4761	40
4762	1
4765	3
4766	82
4768	1
4771	2
4773	6
4775	18
4776	1
4780	23
4782	14
4787	16
4788	264
4795	50
4800	10
4802	2
4804	7
4808	1464
4809	20
4812	2827
4832	1
4837	4706
4847	349
4862	1
4913	1
5056	1
5080	2
5089	9
5377	5
5384	8725
5390	2
5391	1
5397	1
5400	1
5408	1
5410	1
5413	1
5416	502
5425	1
5432	2
5462	13
5474	1
5486	1
5503	19
5511	5
5515	1
5532	4
5536	4
5602	1
5606	1
5610	2
5615	3
5617	5
5618	9
5626	1
5639	7
5668	1
5690	1
5713	8
5718	1
5719	1
5769	3
5772	1
5786	1
6057	2
6079	1
6099	1
6128	7
6147	49
6163	3
6167	1
6189	1
6222	1
6306	5
6325	1
6327	12
6332	5
6389	14
6400	3
6412	21
6429	33
6453	182
6458	2
6471	40
6503	35
6505	3
6535	1
6539	2
6568	4
6619	8
6621	3
6648	13
6678	2
6691	1
6697	2
6713	34
6724	1
6730	1
6736	22
6739	12
6746	1
6762	2
6785	1
6789	1
6799	2
6805	3
6822	1
6830	10
6849	2
6866	7
6871	1
6939	12
6983	1
7011	1
7015	21
7018	4
7029	2
7066	2
7132	23
7137	2
7184	5
7303	9
7325	6
7337	1
7385	1
7418	20
7465	6
7470	101
7482	4
7491	5
7494	1
7496	1
7497	36
7540	1
7543	1
7545	6
7552	63
7579	1
7590	3
7602	6
7616	6
7629	4
7630	1
7633	10
7641	11
7642	2
7643	399
7654	8
7693	11
7700	1
7725	4
7727	3
7738	286
7922	1
7925	3
7965	1
7992	3
8001	1
8047	1
8048	24
8065	4
8103	1
8140	2
8148	1
8151	252
8163	2
8167	292
8190	2
8217	2
8220	7
8228	3
8285	1
8308	1
8318	1
8342	5
8359	3
8365	1
8374	5
8376	23
8386	24
8400	1
8402	1
8404	1
8422	1
8426	2
8447	5
8452	87
8468	1
8485	1
8505	5
8513	12
8514	1
8517	27
8551	7
8584	1
8612	4
8657	1
8659	1
8672	1
8685	2
8697	5
8705	4
8708	2
8721	1
8732	2
8737	11
8764	1
8767	1
8781	16
8813	1
8814	5
8818	3
8841	2
8881	2
8895	10
8897	1
8928	1
8934	18
8953	11
8968	5
8971	1
8972	1
9000	1
9003	1
9021	2
9038	2
9050	1
9051	10
9104	1
9105	2
9117	2
9121	1695
9143	4
9155	33
9198	7
9199	1
9216	1
9228	2
9229	1
9237	1
9238	8
9244	2
9260	9
9264	1
9269	23
9274	2
9293	4
9298	1
9299	36
9304	14
9308	7
9316	22
9318	29
9321	1
9326	4
9329	18
9340	6
9341	8
9381	2
9386	1
9389	5
9394	386
9411	1
9416	3
9419	1
9425	1
9430	5
9464	1
9486	1
9488	1
9489	1
9497	5
9498	60
9506	5
9519	1
9524	9
9530	1
9534	26
9541	4
9546	1
9557	1
9562	1
9583	24
9584	1
9625	4
9638	1
9647	1
9658	9
9674	4
9680	51
9684	1
9689	2
9694	1
9695	1
9699	1
9703	1
9706	3
9707	2
9728	1
9729	1
9732	1
9737	83
9762	1
9768	2
9794	10
9800	37
9802	3
9803	6
9806	4
9808	210
9811	29
9812	218
9814	33
9829	238
9830	1
9832	1
9842	1
9848	2
9875	2
9903	1
9905	3
9908	3
9911	1
9919	11
9924	25
9927	4
9929	30
9930	20
9931	25
9939	3
9954	1
9964	1
9971	1
9988	4
9989	1
10026	3
10029	8
10030	13
10032	1
10036	1
10049	1
10055	1
10056	1
10077	4
10081	2
10091	11
10094	1
10096	1
10111	1
10118	2
10126	1
10139	12
10143	1
10154	1
10176	1
10185	1
10194	1
10199	6
10201	13
10204	1
10212	1
10215	1
10217	1
10223	4
10227	1
10242	1
10269	3
10292	1
10297	20
10311	1
10318	4
10396	6
10412	3
10429	111
10430	8
10474	1
10481	2
10507	5
10586	1
10620	7
10670	9
10706	1
10715	10
10778	2
10796	2
10838	2
10881	8
10929	1
10938	6
10954	95
10975	3
10994	1
11003	1
11020	1
11060	1
11071	1
11081	1
11084	1
11087	2
11139	3
11172	18
11271	3
11300	2
11338	1
11340	1
11351	7
11419	7
11426	4
11427	11
11431	1
11432	2
11486	2
11489	1
11534	5
11556	5
11581	1
11647	1
11664	1
11686	3
11696	1
11700	1
11706	1
11719	1
11776	1
11802	5
11814	1
11830	12
11845	1
11888	5
11908	2
11921	1
11992	2
12021	3
12066	3
12127	1
12134	1
12135	1
12252	12
12260	1
12271	1
12301	1
12322	17
12334	4
12338	4
12353	1
12357	4
12361	1
12389	2
12390	2
12392	1
12414	150
12440	3
12444	2
12476	1
12486	471
12491	2
12513	1
12524	3
12530	1
12542	2
12601	1
12611	1
12653	5
12660	297
12670	2
12705	1
12708	2
12709	2
12714	1
12715	1
12732	1
12735	4
12773	1
12777	1
12779	1
12861	2
12871	3
12874	13
12876	4
12880	10899
12891	1
12895	1
12926	1
12946	4
12968	1
12975	1619
12978	31
13009	1
13037	3
13077	1
13092	2
13126	2
13156	2
13161	1
13184	4
13193	1
13207	1
13213	1
13263	4
13272	1
13285	4
13287	1
13343	1
13353	3
13381	2
13385	2
13424	1
13432	1
13489	3
13490	1
13579	2
13591	4
13645	1
13646	1
13682	1
13878	2
13946	2
13999	11
14000	8
14074	2
14080	8
14117	6
14155	1
14234	1
14241	2
14259	24
14265	1
14361	1
14366	1
14416	1
14420	4
14456	1
14464	12
14522	2
14551	1
14559	1
14571	1
14618	2
14828	1
14840	1
14868	5
14898	1
14905	2
14938	1
15024	11
15083	1
15084	6
15146	1
15149	1
15180	14
15288	1
15290	4
15305	1
15311	6
15372	1
15399	1
15406	2
15417	1
15418	3
15425	1
15435	1
15475	10
15491	1
15525	12
15542	2
15557	21
15611	140
15621	2
15641	1
15659	2
15685	3
15694	1
15696	318
15706	72
15709	3
15723	1
15732	2
15765	2
15769	1
15770	1
15785	1
15802	202
15804	2
15808	3
15829	3
15834	1
15857	3
15892	1
15897	1
15924	6
15935	1
15964	3
15975	2
16026	1
16050	1
16086	1
16130	2
16135	8
16220	1
16243	1
16246	1
16265	1
16276	2
16284	1
16322	7173
16338	9
16397	1
16422	5
16473	1
16527	1
16531	2
16626	1
16629	22
16637	1
16685	2
16735	49
16762	2
16796	3
16814	1
16874	1
16891	1
16906	1
16949	2
16983	1
16988	1
17003	1
17031	1
17126	1
17147	5
17222	2
17232	3
17379	28
17421	3
17425	4
17426	2
17429	67
17430	11
17431	9
17439	1
17445	1
17447	3
17451	22
17454	1
17464	1
17465	3
17483	5
17488	8
17490	2
17494	1
17499	1
17506	1
17536	1
17538	1
17547	2
17557	90
17563	2
17564	9
17565	4
17574	3
17583	1
17609	2
17620	18
17621	105
17622	103
17623	76
17625	5
17633	206
17638	44
17639	6
17648	1
17658	1
17660	1
17670	5
17671	2
17672	197
17676	8
17712	1
17716	1
17727	2
17739	2
17754	1
17762	2
17770	2
17771	1
17773	4
17775	18
17781	1
17785	161
17787	1
17793	2
17799	142
17811	1
17813	23
17816	309
17817	1
17818	1
17819	1
17820	8
17826	1
17827	1
17828	1
17858	12
17864	2
17883	61
17884	2
17885	17
17895	2
17896	54
17897	55
17908	10
17911	1
17913	2
17917	21
17923	30
17962	110
17964	108
17968	14
17969	5
17970	1
17971	23
17974	215
17988	1
17995	2
17996	2
18001	8
18002	4
18004	9
18022	4
18042	4
18051	5
18056	1
18059	2
18092	1
18101	110
18103	7
18105	2
18106	1
18114	1
18118	7
18126	1
18127	1
18156	4
18182	4
18187	1
18206	2
18207	7
18216	1
18227	1
18231	2
18239	4
18241	2
18302	4
18305	1
18359	1
18379	6
18393	1
18395	2
18399	12
18403	72
18409	1
18413	2
18415	1
18420	2
18424	2
18429	1
18488	1
18558	1
18566	2
18734	1
18747	1
18809	1
18840	2
18846	3
18881	65
18990	1
19037	1
19090	22
19108	1
19114	2
19159	1
19180	2
19182	6
19262	19
19271	1
19429	9
19593	1
19618	1
19686	7
19752	1
19863	1
19892	1
19893	3
19963	1
20001	2
20088	1
20115	6
20116	6
20161	2
20214	1
20255	1
20299	3
20372	2
20453	2
20473	6
20484	1
20485	1
20500	1
20507	2
20533	1
20623	1
20707	1
20719	1
20746	1
20773	2
20776	1
20838	9
20858	9
20870	1
20875	1
20928	14
20929	1
20959	1
20978	2
21003	15
21010	1
21050	27
21062	1
21069	1
21088	2
21175	1
21193	2
21219	1
21277	3
21280	1
21284	1
21296	1
21327	3
21341	872
21378	1
21452	1
21455	1
21491	4
21502	2
21506	2
21545	1
21548	3
21571	2
21595	1
21612	6
21694	1
21704	5
21708	1
21788	4
21844	8
21852	2
21928	1
21996	1
22011	1
22047	12
22056	2
22085	18
22315	1
22351	6
22364	1
22442	4
22515	1
22566	6
22689	2
22693	7
22717	1
22724	1
22739	2
22742	4
22764	1
22773	5
22803	1
22833	4
22845	1
22882	2
22908	4
22920	12
22927	6
22995	1
23002	1
23024	3
23078	1
23106	4
23148	1
23184	2
23201	2
23216	2
23307	2
23329	1
23383	2
23487	4
23559	1
23563	1
23577	2
23578	1
23581	1
23582	1
23606	1
23649	7
23666	3
23671	1
23674	9
23678	3
23679	1
23682	3
23693	20
23698	1
23700	11
23703	1
23721	2
23724	10
23756	1
23771	1
23839	13
23841	3
23844	6
23846	9
23850	17
23851	7
23853	3
23860	5
23862	2
23888	1
23889	2
23923	1
23930	4
23946	1
23949	2
23951	2
23953	3
23966	12
23974	7
23982	2
24020	25
24028	2
24068	2
24084	2
24086	47
24090	10
24134	3
24138	13
24139	103
24141	5
24143	1
24147	1
24154	4
24157	2
24158	1
24164	1
24173	2
24176	5
24179	1
24186	10
24187	1
24206	1
24207	6
24213	2
24244	1
24300	1
24321	5
24322	1
24326	58
24342	2
24373	2
24378	13
24389	5
24397	1
24399	8
24400	25
24403	1
24416	42
24422	8
24427	1
24432	1
24435	3
24436	1
24444	44
24445	11
24454	1
24456	1
24515	1
24518	5
24520	1
24521	2
24523	1
24525	1
24530	1
24531	1
24532	1
24535	2
24536	4
24540	21
24545	1
24547	8
24550	1
24558	3
24560	69
24608	1
24631	187
24634	7
24698	1
24722	1
24731	98
24744	1
24757	27
24814	1228
24835	8
24863	50
24915	1
24916	1
24940	1
24955	1
25003	1
25019	2465
25039	1
25074	1
25124	3042
25125	1
25135	3
25144	1
25145	1
25163	1
25169	1
25184	1557
25186	1
25233	536
25242	2
25249	4
25250	1
25306	36
25320	1
25346	3
25389	1
25395	1
25432	1
25438	17
25472	1
25543	1
25576	2
25607	2
25636	1
25709	1
25784	2
25818	1
25832	4
25933	1
25935	4
25983	1
25984	1
26105	1
26210	4
26218	1
26230	26
26317	1
26592	1
26599	23
26606	5
26607	1
26609	6
26611	2
26615	3
26617	1
26622	1
26642	17
26675	2
26677	7
27336	1
27364	2
27474	1
27553	1
27652	1
27659	2
27664	1
27665	5
27673	2
27680	4
27699	196
27704	1
27717	1
27724	5
27725	1
27729	1
27735	2
27738	1
27742	1
27747	1
27750	1
27757	1
27759	1
27761	2
27763	1
27768	2
27773	1
27774	4
27782	2
27791	1
27795	1
27837	1
27843	6
27844	1
27862	1
27866	1
27874	1
27896	3
27921	3
27925	2
27947	6
27995	1
28021	1
28171	1
28172	1
28175	1
28193	1
28198	1
28201	1
28214	1
28219	1
28220	7
28263	1
28280	1
28285	1
28287	1
28291	1
28292	2
28296	1
28301	1
28302	1
28303	2
28310	1
28311	1
28328	1
28333	1
28347	1
28359	1
28362	1
28472	2
28477	3
28479	1
28503	4
28509	1
28517	2
28518	1
28521	1
28526	6
28556	1
28571	11
28573	73
28576	5
28580	1
28583	1
28590	5
28591	1
28595	1
28602	3
28613	2
28616	2
28620	2
28635	1
28637	24
28647	1
28648	2
28651	2
28667	1
28668	1
28679	1
28683	2
28685	21
28703	1
28708	1
28812	1
28845	1
28862	1
28885	301
28891	1
28929	1
28938	2
28968	1
28982	1
29029	1
29031	1
29049	1
29068	408
29077	3
29079	2
29091	6
29113	2
29131	3
29160	16
29170	1
29208	1
29212	27
29226	1
29255	8
29256	1819
29259	7
29286	1
29328	7
29340	3
29357	11
29372	3
29384	1
29386	2934
29465	1
29470	1
29518	3
29544	2
29550	1
29571	17
29577	1
29578	5
29614	8
29664	2
29674	2
29684	16
29689	1
29690	9
29802	17
30058	1
30147	2
30193	64
30198	1
30217	1
30490	1
30653	1
30713	1
30721	6
30722	1
30740	2
30847	1
30902	1382
30981	6
30983	5
30986	2
30990	2
30991	1
30995	1
30998	3
31005	1
31027	1
31065	2
31103	2
31117	1
31126	5
31147	1
31213	1
31245	4
31303	25
31334	3
31408	2
31452	88
31468	1
31476	1338
31492	1
31549	7879
31619	1
31638	1
31643	1
31689	1
31704	1
31732	413
31950	2
32034	1
32073	2
32097	1
32148	1
32181	1
32529	4
32613	5
32656	1
32754	1
32806	1
33287	1
33480	1
33491	4
33562	1
33588	1
33650	3
33651	3
33657	1
33662	1
33668	3
33724	1
33770	1
33774	12
33776	26
33780	1
33783	1
33788	13
33800	1
33944	2
33983	1
34058	1
34104	1
34105	2
34170	1
34285	3
34311	1
34341	2
34369	1037
34397	187
34400	11
34426	7
34511	1
34513	1222
34550	1
34560	1
34569	1
34636	681
34699	1
34718	1
34736	1
34756	1
34779	1
34818	1
34918	952
34984	15
35074	2
35207	1
35228	3
35313	1
35388	2
35499	305
35566	1
35592	1
35612	1
35656	6
35706	1
35730	1
35753	15
35805	1
35819	6
35832	4
35908	2
35911	1
35916	1
35985	1
35998	23
36011	1
36052	2
36165	1
36300	2
36351	1
36423	1
36727	1
36750	1
36873	1
36881	1
36884	11
36887	2
36911	6
36912	1
36923	3
36925	1
36947	26
36954	18
36992	2
36998	15
37000	1
37004	3
37019	3
37030	3
37054	1
37903	2
37933	1
37934	1
37963	3
37965	2
37967	1
37981	20
37986	10
37995	1
38017	1
38019	3
38027	1
38044	12
38056	1
38058	1
38069	1
38071	1
38098	1
38149	1
38150	2
38163	1
38188	1
38193	1
38199	4
38203	1
38229	1
38235	2
38261	1
38264	3
38266	1
38278	1
38285	1
38286	1
38307	1
38310	2
38320	1
38322	4
38331	1
38342	2
38356	29
38379	2
38387	1
38392	1
38393	2
38397	1
38399	1
38400	2
38406	1
38414	2
38444	36
38484	1
38496	5
38506	5
38511	2
38546	1
38552	2
38553	2
38564	1
38566	1
38567	1
38710	2
38712	2
38721	1
38742	3
38755	1
38771	1
38779	1
38794	1
38811	1
38858	2
38861	4
38868	1
38874	2
38896	1
38973	1
39010	5
39015	125
39074	2469
39095	1
39151	6
39228	2
39229	1
39273	5
39308	1176
39353	2
39386	20
39400	1
39410	1
39432	4
39501	7627
39545	2
39554	1
39559	2
39571	3
39651	10
39811	1
39847	2
39863	1
39919	1
40188	4
40252	1
40309	1
40313	1
41152	810
41176	115
41275	1
41417	1
41451	1
41472	3
41545	1
41572	1
41581	1
41589	17
41620	48
41689	232
41775	1
41810	2
41833	1
41864	1
41881	498
41900	1653
41942	2
42003	12
42109	1
42147	2
42163	789
42178	1
42298	243
42314	2
42337	1578
42428	2
42440	551
42601	573
42606	1
42715	2
42732	2
42752	1
42769	1
42852	1
42863	3
42907	6
42925	16
42943	8
42961	87
42988	1
43234	1
43242	2
43266	1
43275	1
43279	1
43343	458
43373	3
43395	175
43413	1
43444	353
43447	1
43485	1
43754	1769
43766	2
43818	1
43824	2
43838	1
43965	96
44034	9
44038	4
44176	1
44178	3
44208	412
44285	1064
44369	7
44375	303
44389	1
44403	1
44410	1
44466	1
44498	138
44558	2
44787	1
44889	1003
44972	1
45114	1
45180	1
45218	1
45224	2
45227	1
45237	1
45271	10
45284	3
45287	1
45289	1
45304	2
45340	1
45344	1
45356	1
45377	1
45469	2
45514	4
45533	1
45536	1
45543	1
45575	1
45582	1
45596	1
45609	41
45779	1
46376	1
46435	1
46621	1
47206	1
47262	783
47452	1
47524	5
47589	19
47794	25
47796	91
47806	1
47817	1
47843	352
47887	2
47956	1
47965	1
48109	10
48309	149
48359	680
48431	373
48434	4
48501	92
48555	20
48575	4
48592	30
48739	1
48821	1
48832	10
48944	164
49065	15
49103	537
49344	65
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iD8DBQFKN56lluRbRini9tgRAm/CAJ9EYXlW7hZOKZEreqeRL07U/qRspwCggWfF
RVssWCAmx9otoiaQOvNbsz0=
=0wt8
-----END PGP SIGNATURE-----

_______________________________________________
nsp-security mailing list
nsp-security at puck.nether.net
https://puck.nether.net/mailman/listinfo/nsp-security

Please do not Forward, CC, or BCC this E-mail outside of the nsp-security
community. Confidentiality is essential for effective Internet security counter-measures.
_______________________________________________