[nsp-sec] Anyone seeing any "packet love/DOS" heading for 64.75.15.144?

Rob Thomas robt at cymru.com
Wed May 6 18:31:08 EDT 2009


Hey, Barry.

> 8.18.65.21
> 8.5.245.39

Akamai, are these yours or related to you at all?

> 129.176.151.25

129.176.151.25 has been a Mebroot/Torpig bot since at least 2009-02-24
03:21:48 UTC.

It may be a NAT gateway or (possibly hacked) proxy.

> 12.36.123.2

12.36.123.2 has been a Conficker bot off and on since at least
2009-01-17 08:06:21 UTC.

> 130.13.10.227

Bupkes on 130.13.10.227, sorry.

Unfortunately no clear picture of the C&C(s) involved.

Thanks,
Rob.
-- 
Rob Thomas
Team Cymru
http://www.team-cymru.org/
cmn_err(CEO_PANIC, "Out of coffee!");




More information about the nsp-security mailing list