[nsp-sec] ACK: 2119 HTTP Bot C&C Hits - 2009-06-15
bjorn.jensen at telenor.com
bjorn.jensen at telenor.com
Wed Jun 17 03:53:21 EDT 2009
Ack for 2119,
/Bjorn
________________________________________
Fra: nsp-security-bounces at puck.nether.net [nsp-security-bounces at puck.nether.net] på vegne av Tim Wilde [twilde at cymru.com]
Sendt: 16. juni 2009 15:31
Til: NSP-SEC List
Emne: [nsp-sec] HTTP Bot C&C Hits - 2009-06-15
----------- nsp-security Confidential --------
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Greetings everyone!
We have received a list of approximately 120,000 IPs that were seen
fetching a page of encrypted command and control content via HTTP from a
major hosting provider within an approximately 36 hour period ending
yesterday afternoon. That provider does not want to be named, but has
asked us to distribute this data to our contacts so that they can
identify the bots within their networks.
We have a considerable degree of certainty that any IP hitting the page
in question is a bot, and though the actual C&C content was disabled
some time ago, it is likely that these IPs are continuing to hit the
page in question. The requests would be standard HTTP on TCP/80.
You can find individual lists of IPs for each ASN that had hits at the
following URL:
https://www.cymru.com/nsp-sec/Owned/httpbot-20090615/
The column after the IP address is the timestamp of the last hit seen
from that IP at the time the sample was taken, in UTC.
Below my .signature you will find a list of the ASNs included, along
with the number of hits for each ASN (first column is ASN, second is
number of hits). This file can also be found here:
https://www.cymru.com/nsp-sec/Owned/httpbot-20090615/asnlist.txt
Please take a look at the hits for your ASN(s) and take whatever actions
you deem appropriate. Please let us know if you have any questions, or
if we can attempt to get any further data from the provider in question
that would make these reports more useful.
Best Regards,
Tim Wilde
- --
Tim Wilde, Senior Software Engineer, Team Cymru, Inc.
twilde at cymru.com | +1-630-230-5433 | http://www.team-cymru.org/
NA 4
52 1
111 1
125 1
137 5
158 1
174 4
209 10
271 1
286 7
299 1
557 3
577 17
594 3
665 1
701 16
702 5
703 3
719 1
766 1
786 45
803 1
812 7
852 7
855 2
1103 4
1128 1
1213 3
1221 9
1226 1
1239 2
1251 10
1257 5
1267 8
1273 1
1290 1
1659 41
1668 1
1678 4
1680 2
1751 1
1785 2
1798 12
1853 2
1916 111
1930 5
2018 57
2042 32
2108 2
2110 2
2116 2
2119 20
2152 8
2200 25
2379 1
2385 1
2386 2
2497 1
2516 3
2527 1
2529 3
2544 1
2549 1
2571 2
2572 5
2609 709
2611 3
2646 1
2647 2
2686 2
2688 2
2697 8
2706 1
2715 21
2716 7
2764 2
2819 1
2828 2
2852 1
2856 16
2860 4
2905 1
2907 1
2914 1
2920 3
3208 2
3209 6
3215 60
3216 2
3225 27
3243 16
3248 1
3255 1
3257 1
3259 1
3261 1
3265 6
3267 1
3269 26
3292 5
3301 19
3302 1
3303 3
3304 1
3308 1
3313 2
3320 20
3324 1
3352 52
3356 5
3382 2
3449 1
3454 1
3462 689
3484 8
3491 5
3549 28
3561 2
3571 2
3593 1
3633 4
3737 1
3741 14
3758 8
3786 14
3790 12
3813 1
3816 18
3839 1
3848 1
3900 1
3911 1
3912 1
4004 1
4007 1
4134 11556
4181 1
4190 1
4230 256
4237 1
4265 1
4274 1
4323 6
4352 1
4355 1
4470 1
4515 11
4538 332
4569 1
4589 17
4604 3
4609 6
4613 1
4618 6
4621 12
4637 1
4648 1
4657 6
4668 7
4670 2
4671 49
4685 1
4713 14
4716 2
4725 3
4732 4
4739 2
4741 13
4747 1
4750 25
4755 81
4758 1
4760 20
4761 40
4762 1
4765 3
4766 82
4768 1
4771 2
4773 6
4775 18
4776 1
4780 23
4782 14
4787 16
4788 264
4795 50
4800 10
4802 2
4804 7
4808 1464
4809 20
4812 2827
4832 1
4837 4706
4847 349
4862 1
4913 1
5056 1
5080 2
5089 9
5377 5
5384 8725
5390 2
5391 1
5397 1
5400 1
5408 1
5410 1
5413 1
5416 502
5425 1
5432 2
5462 13
5474 1
5486 1
5503 19
5511 5
5515 1
5532 4
5536 4
5602 1
5606 1
5610 2
5615 3
5617 5
5618 9
5626 1
5639 7
5668 1
5690 1
5713 8
5718 1
5719 1
5769 3
5772 1
5786 1
6057 2
6079 1
6099 1
6128 7
6147 49
6163 3
6167 1
6189 1
6222 1
6306 5
6325 1
6327 12
6332 5
6389 14
6400 3
6412 21
6429 33
6453 182
6458 2
6471 40
6503 35
6505 3
6535 1
6539 2
6568 4
6619 8
6621 3
6648 13
6678 2
6691 1
6697 2
6713 34
6724 1
6730 1
6736 22
6739 12
6746 1
6762 2
6785 1
6789 1
6799 2
6805 3
6822 1
6830 10
6849 2
6866 7
6871 1
6939 12
6983 1
7011 1
7015 21
7018 4
7029 2
7066 2
7132 23
7137 2
7184 5
7303 9
7325 6
7337 1
7385 1
7418 20
7465 6
7470 101
7482 4
7491 5
7494 1
7496 1
7497 36
7540 1
7543 1
7545 6
7552 63
7579 1
7590 3
7602 6
7616 6
7629 4
7630 1
7633 10
7641 11
7642 2
7643 399
7654 8
7693 11
7700 1
7725 4
7727 3
7738 286
7922 1
7925 3
7965 1
7992 3
8001 1
8047 1
8048 24
8065 4
8103 1
8140 2
8148 1
8151 252
8163 2
8167 292
8190 2
8217 2
8220 7
8228 3
8285 1
8308 1
8318 1
8342 5
8359 3
8365 1
8374 5
8376 23
8386 24
8400 1
8402 1
8404 1
8422 1
8426 2
8447 5
8452 87
8468 1
8485 1
8505 5
8513 12
8514 1
8517 27
8551 7
8584 1
8612 4
8657 1
8659 1
8672 1
8685 2
8697 5
8705 4
8708 2
8721 1
8732 2
8737 11
8764 1
8767 1
8781 16
8813 1
8814 5
8818 3
8841 2
8881 2
8895 10
8897 1
8928 1
8934 18
8953 11
8968 5
8971 1
8972 1
9000 1
9003 1
9021 2
9038 2
9050 1
9051 10
9104 1
9105 2
9117 2
9121 1695
9143 4
9155 33
9198 7
9199 1
9216 1
9228 2
9229 1
9237 1
9238 8
9244 2
9260 9
9264 1
9269 23
9274 2
9293 4
9298 1
9299 36
9304 14
9308 7
9316 22
9318 29
9321 1
9326 4
9329 18
9340 6
9341 8
9381 2
9386 1
9389 5
9394 386
9411 1
9416 3
9419 1
9425 1
9430 5
9464 1
9486 1
9488 1
9489 1
9497 5
9498 60
9506 5
9519 1
9524 9
9530 1
9534 26
9541 4
9546 1
9557 1
9562 1
9583 24
9584 1
9625 4
9638 1
9647 1
9658 9
9674 4
9680 51
9684 1
9689 2
9694 1
9695 1
9699 1
9703 1
9706 3
9707 2
9728 1
9729 1
9732 1
9737 83
9762 1
9768 2
9794 10
9800 37
9802 3
9803 6
9806 4
9808 210
9811 29
9812 218
9814 33
9829 238
9830 1
9832 1
9842 1
9848 2
9875 2
9903 1
9905 3
9908 3
9911 1
9919 11
9924 25
9927 4
9929 30
9930 20
9931 25
9939 3
9954 1
9964 1
9971 1
9988 4
9989 1
10026 3
10029 8
10030 13
10032 1
10036 1
10049 1
10055 1
10056 1
10077 4
10081 2
10091 11
10094 1
10096 1
10111 1
10118 2
10126 1
10139 12
10143 1
10154 1
10176 1
10185 1
10194 1
10199 6
10201 13
10204 1
10212 1
10215 1
10217 1
10223 4
10227 1
10242 1
10269 3
10292 1
10297 20
10311 1
10318 4
10396 6
10412 3
10429 111
10430 8
10474 1
10481 2
10507 5
10586 1
10620 7
10670 9
10706 1
10715 10
10778 2
10796 2
10838 2
10881 8
10929 1
10938 6
10954 95
10975 3
10994 1
11003 1
11020 1
11060 1
11071 1
11081 1
11084 1
11087 2
11139 3
11172 18
11271 3
11300 2
11338 1
11340 1
11351 7
11419 7
11426 4
11427 11
11431 1
11432 2
11486 2
11489 1
11534 5
11556 5
11581 1
11647 1
11664 1
11686 3
11696 1
11700 1
11706 1
11719 1
11776 1
11802 5
11814 1
11830 12
11845 1
11888 5
11908 2
11921 1
11992 2
12021 3
12066 3
12127 1
12134 1
12135 1
12252 12
12260 1
12271 1
12301 1
12322 17
12334 4
12338 4
12353 1
12357 4
12361 1
12389 2
12390 2
12392 1
12414 150
12440 3
12444 2
12476 1
12486 471
12491 2
12513 1
12524 3
12530 1
12542 2
12601 1
12611 1
12653 5
12660 297
12670 2
12705 1
12708 2
12709 2
12714 1
12715 1
12732 1
12735 4
12773 1
12777 1
12779 1
12861 2
12871 3
12874 13
12876 4
12880 10899
12891 1
12895 1
12926 1
12946 4
12968 1
12975 1619
12978 31
13009 1
13037 3
13077 1
13092 2
13126 2
13156 2
13161 1
13184 4
13193 1
13207 1
13213 1
13263 4
13272 1
13285 4
13287 1
13343 1
13353 3
13381 2
13385 2
13424 1
13432 1
13489 3
13490 1
13579 2
13591 4
13645 1
13646 1
13682 1
13878 2
13946 2
13999 11
14000 8
14074 2
14080 8
14117 6
14155 1
14234 1
14241 2
14259 24
14265 1
14361 1
14366 1
14416 1
14420 4
14456 1
14464 12
14522 2
14551 1
14559 1
14571 1
14618 2
14828 1
14840 1
14868 5
14898 1
14905 2
14938 1
15024 11
15083 1
15084 6
15146 1
15149 1
15180 14
15288 1
15290 4
15305 1
15311 6
15372 1
15399 1
15406 2
15417 1
15418 3
15425 1
15435 1
15475 10
15491 1
15525 12
15542 2
15557 21
15611 140
15621 2
15641 1
15659 2
15685 3
15694 1
15696 318
15706 72
15709 3
15723 1
15732 2
15765 2
15769 1
15770 1
15785 1
15802 202
15804 2
15808 3
15829 3
15834 1
15857 3
15892 1
15897 1
15924 6
15935 1
15964 3
15975 2
16026 1
16050 1
16086 1
16130 2
16135 8
16220 1
16243 1
16246 1
16265 1
16276 2
16284 1
16322 7173
16338 9
16397 1
16422 5
16473 1
16527 1
16531 2
16626 1
16629 22
16637 1
16685 2
16735 49
16762 2
16796 3
16814 1
16874 1
16891 1
16906 1
16949 2
16983 1
16988 1
17003 1
17031 1
17126 1
17147 5
17222 2
17232 3
17379 28
17421 3
17425 4
17426 2
17429 67
17430 11
17431 9
17439 1
17445 1
17447 3
17451 22
17454 1
17464 1
17465 3
17483 5
17488 8
17490 2
17494 1
17499 1
17506 1
17536 1
17538 1
17547 2
17557 90
17563 2
17564 9
17565 4
17574 3
17583 1
17609 2
17620 18
17621 105
17622 103
17623 76
17625 5
17633 206
17638 44
17639 6
17648 1
17658 1
17660 1
17670 5
17671 2
17672 197
17676 8
17712 1
17716 1
17727 2
17739 2
17754 1
17762 2
17770 2
17771 1
17773 4
17775 18
17781 1
17785 161
17787 1
17793 2
17799 142
17811 1
17813 23
17816 309
17817 1
17818 1
17819 1
17820 8
17826 1
17827 1
17828 1
17858 12
17864 2
17883 61
17884 2
17885 17
17895 2
17896 54
17897 55
17908 10
17911 1
17913 2
17917 21
17923 30
17962 110
17964 108
17968 14
17969 5
17970 1
17971 23
17974 215
17988 1
17995 2
17996 2
18001 8
18002 4
18004 9
18022 4
18042 4
18051 5
18056 1
18059 2
18092 1
18101 110
18103 7
18105 2
18106 1
18114 1
18118 7
18126 1
18127 1
18156 4
18182 4
18187 1
18206 2
18207 7
18216 1
18227 1
18231 2
18239 4
18241 2
18302 4
18305 1
18359 1
18379 6
18393 1
18395 2
18399 12
18403 72
18409 1
18413 2
18415 1
18420 2
18424 2
18429 1
18488 1
18558 1
18566 2
18734 1
18747 1
18809 1
18840 2
18846 3
18881 65
18990 1
19037 1
19090 22
19108 1
19114 2
19159 1
19180 2
19182 6
19262 19
19271 1
19429 9
19593 1
19618 1
19686 7
19752 1
19863 1
19892 1
19893 3
19963 1
20001 2
20088 1
20115 6
20116 6
20161 2
20214 1
20255 1
20299 3
20372 2
20453 2
20473 6
20484 1
20485 1
20500 1
20507 2
20533 1
20623 1
20707 1
20719 1
20746 1
20773 2
20776 1
20838 9
20858 9
20870 1
20875 1
20928 14
20929 1
20959 1
20978 2
21003 15
21010 1
21050 27
21062 1
21069 1
21088 2
21175 1
21193 2
21219 1
21277 3
21280 1
21284 1
21296 1
21327 3
21341 872
21378 1
21452 1
21455 1
21491 4
21502 2
21506 2
21545 1
21548 3
21571 2
21595 1
21612 6
21694 1
21704 5
21708 1
21788 4
21844 8
21852 2
21928 1
21996 1
22011 1
22047 12
22056 2
22085 18
22315 1
22351 6
22364 1
22442 4
22515 1
22566 6
22689 2
22693 7
22717 1
22724 1
22739 2
22742 4
22764 1
22773 5
22803 1
22833 4
22845 1
22882 2
22908 4
22920 12
22927 6
22995 1
23002 1
23024 3
23078 1
23106 4
23148 1
23184 2
23201 2
23216 2
23307 2
23329 1
23383 2
23487 4
23559 1
23563 1
23577 2
23578 1
23581 1
23582 1
23606 1
23649 7
23666 3
23671 1
23674 9
23678 3
23679 1
23682 3
23693 20
23698 1
23700 11
23703 1
23721 2
23724 10
23756 1
23771 1
23839 13
23841 3
23844 6
23846 9
23850 17
23851 7
23853 3
23860 5
23862 2
23888 1
23889 2
23923 1
23930 4
23946 1
23949 2
23951 2
23953 3
23966 12
23974 7
23982 2
24020 25
24028 2
24068 2
24084 2
24086 47
24090 10
24134 3
24138 13
24139 103
24141 5
24143 1
24147 1
24154 4
24157 2
24158 1
24164 1
24173 2
24176 5
24179 1
24186 10
24187 1
24206 1
24207 6
24213 2
24244 1
24300 1
24321 5
24322 1
24326 58
24342 2
24373 2
24378 13
24389 5
24397 1
24399 8
24400 25
24403 1
24416 42
24422 8
24427 1
24432 1
24435 3
24436 1
24444 44
24445 11
24454 1
24456 1
24515 1
24518 5
24520 1
24521 2
24523 1
24525 1
24530 1
24531 1
24532 1
24535 2
24536 4
24540 21
24545 1
24547 8
24550 1
24558 3
24560 69
24608 1
24631 187
24634 7
24698 1
24722 1
24731 98
24744 1
24757 27
24814 1228
24835 8
24863 50
24915 1
24916 1
24940 1
24955 1
25003 1
25019 2465
25039 1
25074 1
25124 3042
25125 1
25135 3
25144 1
25145 1
25163 1
25169 1
25184 1557
25186 1
25233 536
25242 2
25249 4
25250 1
25306 36
25320 1
25346 3
25389 1
25395 1
25432 1
25438 17
25472 1
25543 1
25576 2
25607 2
25636 1
25709 1
25784 2
25818 1
25832 4
25933 1
25935 4
25983 1
25984 1
26105 1
26210 4
26218 1
26230 26
26317 1
26592 1
26599 23
26606 5
26607 1
26609 6
26611 2
26615 3
26617 1
26622 1
26642 17
26675 2
26677 7
27336 1
27364 2
27474 1
27553 1
27652 1
27659 2
27664 1
27665 5
27673 2
27680 4
27699 196
27704 1
27717 1
27724 5
27725 1
27729 1
27735 2
27738 1
27742 1
27747 1
27750 1
27757 1
27759 1
27761 2
27763 1
27768 2
27773 1
27774 4
27782 2
27791 1
27795 1
27837 1
27843 6
27844 1
27862 1
27866 1
27874 1
27896 3
27921 3
27925 2
27947 6
27995 1
28021 1
28171 1
28172 1
28175 1
28193 1
28198 1
28201 1
28214 1
28219 1
28220 7
28263 1
28280 1
28285 1
28287 1
28291 1
28292 2
28296 1
28301 1
28302 1
28303 2
28310 1
28311 1
28328 1
28333 1
28347 1
28359 1
28362 1
28472 2
28477 3
28479 1
28503 4
28509 1
28517 2
28518 1
28521 1
28526 6
28556 1
28571 11
28573 73
28576 5
28580 1
28583 1
28590 5
28591 1
28595 1
28602 3
28613 2
28616 2
28620 2
28635 1
28637 24
28647 1
28648 2
28651 2
28667 1
28668 1
28679 1
28683 2
28685 21
28703 1
28708 1
28812 1
28845 1
28862 1
28885 301
28891 1
28929 1
28938 2
28968 1
28982 1
29029 1
29031 1
29049 1
29068 408
29077 3
29079 2
29091 6
29113 2
29131 3
29160 16
29170 1
29208 1
29212 27
29226 1
29255 8
29256 1819
29259 7
29286 1
29328 7
29340 3
29357 11
29372 3
29384 1
29386 2934
29465 1
29470 1
29518 3
29544 2
29550 1
29571 17
29577 1
29578 5
29614 8
29664 2
29674 2
29684 16
29689 1
29690 9
29802 17
30058 1
30147 2
30193 64
30198 1
30217 1
30490 1
30653 1
30713 1
30721 6
30722 1
30740 2
30847 1
30902 1382
30981 6
30983 5
30986 2
30990 2
30991 1
30995 1
30998 3
31005 1
31027 1
31065 2
31103 2
31117 1
31126 5
31147 1
31213 1
31245 4
31303 25
31334 3
31408 2
31452 88
31468 1
31476 1338
31492 1
31549 7879
31619 1
31638 1
31643 1
31689 1
31704 1
31732 413
31950 2
32034 1
32073 2
32097 1
32148 1
32181 1
32529 4
32613 5
32656 1
32754 1
32806 1
33287 1
33480 1
33491 4
33562 1
33588 1
33650 3
33651 3
33657 1
33662 1
33668 3
33724 1
33770 1
33774 12
33776 26
33780 1
33783 1
33788 13
33800 1
33944 2
33983 1
34058 1
34104 1
34105 2
34170 1
34285 3
34311 1
34341 2
34369 1037
34397 187
34400 11
34426 7
34511 1
34513 1222
34550 1
34560 1
34569 1
34636 681
34699 1
34718 1
34736 1
34756 1
34779 1
34818 1
34918 952
34984 15
35074 2
35207 1
35228 3
35313 1
35388 2
35499 305
35566 1
35592 1
35612 1
35656 6
35706 1
35730 1
35753 15
35805 1
35819 6
35832 4
35908 2
35911 1
35916 1
35985 1
35998 23
36011 1
36052 2
36165 1
36300 2
36351 1
36423 1
36727 1
36750 1
36873 1
36881 1
36884 11
36887 2
36911 6
36912 1
36923 3
36925 1
36947 26
36954 18
36992 2
36998 15
37000 1
37004 3
37019 3
37030 3
37054 1
37903 2
37933 1
37934 1
37963 3
37965 2
37967 1
37981 20
37986 10
37995 1
38017 1
38019 3
38027 1
38044 12
38056 1
38058 1
38069 1
38071 1
38098 1
38149 1
38150 2
38163 1
38188 1
38193 1
38199 4
38203 1
38229 1
38235 2
38261 1
38264 3
38266 1
38278 1
38285 1
38286 1
38307 1
38310 2
38320 1
38322 4
38331 1
38342 2
38356 29
38379 2
38387 1
38392 1
38393 2
38397 1
38399 1
38400 2
38406 1
38414 2
38444 36
38484 1
38496 5
38506 5
38511 2
38546 1
38552 2
38553 2
38564 1
38566 1
38567 1
38710 2
38712 2
38721 1
38742 3
38755 1
38771 1
38779 1
38794 1
38811 1
38858 2
38861 4
38868 1
38874 2
38896 1
38973 1
39010 5
39015 125
39074 2469
39095 1
39151 6
39228 2
39229 1
39273 5
39308 1176
39353 2
39386 20
39400 1
39410 1
39432 4
39501 7627
39545 2
39554 1
39559 2
39571 3
39651 10
39811 1
39847 2
39863 1
39919 1
40188 4
40252 1
40309 1
40313 1
41152 810
41176 115
41275 1
41417 1
41451 1
41472 3
41545 1
41572 1
41581 1
41589 17
41620 48
41689 232
41775 1
41810 2
41833 1
41864 1
41881 498
41900 1653
41942 2
42003 12
42109 1
42147 2
42163 789
42178 1
42298 243
42314 2
42337 1578
42428 2
42440 551
42601 573
42606 1
42715 2
42732 2
42752 1
42769 1
42852 1
42863 3
42907 6
42925 16
42943 8
42961 87
42988 1
43234 1
43242 2
43266 1
43275 1
43279 1
43343 458
43373 3
43395 175
43413 1
43444 353
43447 1
43485 1
43754 1769
43766 2
43818 1
43824 2
43838 1
43965 96
44034 9
44038 4
44176 1
44178 3
44208 412
44285 1064
44369 7
44375 303
44389 1
44403 1
44410 1
44466 1
44498 138
44558 2
44787 1
44889 1003
44972 1
45114 1
45180 1
45218 1
45224 2
45227 1
45237 1
45271 10
45284 3
45287 1
45289 1
45304 2
45340 1
45344 1
45356 1
45377 1
45469 2
45514 4
45533 1
45536 1
45543 1
45575 1
45582 1
45596 1
45609 41
45779 1
46376 1
46435 1
46621 1
47206 1
47262 783
47452 1
47524 5
47589 19
47794 25
47796 91
47806 1
47817 1
47843 352
47887 2
47956 1
47965 1
48109 10
48309 149
48359 680
48431 373
48434 4
48501 92
48555 20
48575 4
48592 30
48739 1
48821 1
48832 10
48944 164
49065 15
49103 537
49344 65
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iD8DBQFKN56lluRbRini9tgRAm/CAJ9EYXlW7hZOKZEreqeRL07U/qRspwCggWfF
RVssWCAmx9otoiaQOvNbsz0=
=0wt8
-----END PGP SIGNATURE-----
_______________________________________________
nsp-security mailing list
nsp-security at puck.nether.net
https://puck.nether.net/mailman/listinfo/nsp-security
Please do not Forward, CC, or BCC this E-mail outside of the nsp-security
community. Confidentiality is essential for effective Internet security counter-measures.
_______________________________________________
More information about the nsp-security
mailing list