[nsp-sec] Shopify (204.15.199.4) under fire, got C&C?

Tue Mar 24 13:46:36 EDT 2009

Hi Florian,

On Mar 24, 2009, at 18:13 , Florian Weimer wrote:

> * Scott A. McIntyre:
>
>> The folks over at Shopify are catching a reasonable sized 80/tcp
>> synflood.  Target is 204.15.199.4.  We've been seeing a fair bit of
>> backscatter here, starting around 2009-03-24 15:54:37.075 UTC+0100.
>
> Do they know which shopping site is being targeted?

They are not 100% certain, but, are *pretty* sure it is www.gogreensolar.com

Cheers!

Scott