[nsp-sec] ZeuS/Zbot logs.

[Ståhl Jouni]

 ACK AS 719

Jouni Ståhl
Elisa Ltd

>-----Original Message-----
>From: nsp-security-bounces at puck.nether.net
>[mailto:nsp-security-bounces at puck.nether.net] On Behalf Of
>Scott A. McIntyre
>Sent: Tuesday, November 03, 2009 2:48 PM
>To: NSP nsp-security
>Subject: [nsp-sec] ZeuS/Zbot logs.
>
>----------- nsp-security Confidential --------
>
>Hi all,
>
>With the help of one of my customers I gained access to an Apache
>server log of a box which was being used as a ZeuS-redirector.
>Looking at the content, about 22K IPs visited in the last day or so
>from a pretty healthy list of ASNs, which is below.
>
>Since it's not likely I'll be able to get these logs on an ongoing
>basis, I've uploaded what I can, including the Apache server
>timestamp
>(+0100 offset, please note) to:
>
>https://asn.cymru.com/nsp-sec/upload/1257252136.whois.txt
>
>Happy hunting!
>
>Scott A. McIntyre
>XS4ALL Internet B.V.
>
>
>ASNs:
>
>AS
>18
>27
>55
>81
>137
>156
>174
>209
>286
>577
>594
>701
>702
>719
>766
>786
>812
>852
>855
>1103
>1134
>1221
>1237
>1239
>1241
>1248
>1257
>1267
>1290
>1294
>1312
>1547
>1659
>1668
>1680
>1715
>1781
>1785
>1790
>1835
>1836
>1887
>1955
>1967
>2012
>2031
>2037
>2042
>2055
>2110
>2116
>2119
>2200
>2259
>2379
>2510
>2514
>2516
>2518
>2519
>2527
>2529
>2547
>2578
>2607
>2609
>2614
>2634
>2686
>2687
>2706
>2819
>2828
>2847
>2848
>2852
>2854
>2856
>2860
>2873
>3209
>3215
>3216
>3218
>3219
>3221
>3239
>3242
>3243
>3244
>3249
>3253
>3255
>3262
>3265
>3269
>3277
>3292
>3300
>3301
>3302
>3303
>3307
>3308
>3312
>3320
>3330
>3339
>3340
>3352
>3356
>3462
>3549
>3605
>3737
>3758
>3770
>3786
>3790
>3816
>3839
>3999
>4058
>4134
>4181
>4230
>4323
>4355
>4515
>4589
>4618
>4621
>4628
>4663
>4668
>4670
>4713
>4716
>4732
>4739
>4741
>4747
>4750
>4755
>4760
>4761
>4765
>4766
>4771
>4773
>4775
>4780
>4788
>4795
>4802
>4804
>4808
>4812
>4837
>4854
>4922
>4961
>5078
>5089
>5384
>5386
>5388
>5390
>5391
>5396
>5400
>5407
>5410
>5416
>5429
>5430
>5432
>5433
>5462
>5466
>5467
>5479
>5483
>5511
>5513
>5515
>5522
>5523
>5537
>5550
>5563
>5578
>5583
>5591
>5600
>5603
>5607
>5610
>5615
>5617
>5628
>5650
>5668
>5713
>5769
>5778
>6057
>6079
>6128
>6147
>6167
>6181
>6222
>6306
>6327
>6332
>6360
>6389
>6400
>6412
>6458
>6471
>6478
>6503
>6568
>6619
>6648
>6656
>6661
>6678
>6690
>6697
>6703
>6706
>6711
>6712
>6713
>6714
>6730
>6739
>6740
>6746
>6769
>6785
>6789
>6790
>6799
>6801
>6805
>6828
>6830
>6848
>6849
>6850
>6851
>6854
>6855
>6856
>6863
>6866
>6868
>6871
>6876
>6877
>6886
>6939
>7011
>7015
>7017
>7018
>7029
>7132
>7303
>7418
>7430
>7459
>7470
>7472
>7473
>7482
>7543
>7545
>7552
>7557
>7562
>7565
>7616
>7621
>7643
>7654
>7665
>7679
>7693
>7725
>7738
>7757
>7849
>7908
>7992
>8039
>8048
>8065
>8151
>8163
>8167
>8192
>8201
>8220
>8226
>8239
>8251
>8256
>8265
>8267
>8291
>8308
>8323
>8331
>8334
>8342
>8343
>8345
>8358
>8359
>8364
>8369
>8371
>8374
>8376
>8386
>8400
>8402
>8404
>8412
>8416
>8427
>8434
>8439
>8445
>8447
>8448
>8452
>8461
>8462
>8468
>8470
>8477
>8486
>8492
>8508
>8512
>8514
>8517
>8535
>8542
>8551
>8559
>8570
>8585
>8592
>8595
>8612
>8615
>8629
>8657
>8661
>8675
>8697
>8708
>8732
>8737
>8755
>8764
>8767
>8771
>8778
>8779
>8841
>8865
>8866
>8877
>8881
>8897
>8905
>8920
>8926
>8938
>8953
>8954
>8968
>8970
>8990
>8997
>9021
>9038
>9050
>9080
>9085
>9105
>9112
>9116
>9121
>9127
>9137
>9141
>9143
>9145
>9146
>9155
>9158
>9177
>9198
>9208
>9269
>9274
>9299
>9304
>9316
>9318
>9319
>9326
>9329
>9371
>9416
>9443
>9452
>9457
>9476
>9484
>9498
>9499
>9524
>9531
>9534
>9543
>9562
>9569
>9576
>9578
>9583
>9590
>9609
>9614
>9628
>9644
>9647
>9658
>9674
>9680
>9686
>9689
>9691
>9694
>9695
>9697
>9698
>9703
>9729
>9737
>9753
>9756
>9768
>9824
>9829
>9839
>9842
>9845
>9848
>9874
>9919
>9924
>9930
>9931
>9943
>9968
>9971
>9976
>9997
>10013
>10024
>10026
>10030
>10036
>10037
>10045
>10049
>10051
>10052
>10055
>10062
>10069
>10081
>10088
>10091
>10139
>10143
>10154
>10155
>10162
>10164
>10175
>10176
>10185
>10186
>10189
>10191
>10199
>10201
>10217
>10227
>10292
>10299
>10318
>10421
>10481
>10507
>10617
>10620
>10796
>10834
>10838
>11060
>11081
>11172
>11232
>11260
>11315
>11338
>11351
>11398
>11426
>11427
>11456
>11492
>11509
>11521
>11524
>11556
>11606
>11664
>11745
>11814
>11830
>11955
>12066
>12262
>12271
>12297
>12301
>12302
>12310
>12322
>12324
>12332
>12334
>12338
>12346
>12353
>12357
>12358
>12365
>12389
>12392
>12400
>12403
>12406
>12414
>12418
>12426
>12430
>12452
>12476
>12479
>12486
>12507
>12513
>12524
>12530
>12552
>12555
>12569
>12570
>12576
>12578
>12594
>12615
>12618
>12626
>12644
>12670
>12684
>12695
>12705
>12714
>12715
>12716
>12724
>12730
>12735
>12739
>12741
>12742
>12768
>12772
>12773
>12777
>12788
>12843
>12872
>12874
>12876
>12877
>12880
>12883
>12912
>12946
>12958
>12963
>12968
>12970
>12975
>12978
>12990
>12998
>13000
>13036
>13045
>13046
>13062
>13069
>13091
>13104
>13105
>13110
>13118
>13119
>13124
>13127
>13143
>13165
>13174
>13184
>13188
>13189
>13194
>13205
>13222
>13254
>13272
>13280
>13285
>13304
>13307
>13343
>13367
>13381
>13489
>13609
>13672
>13673
>13674
>13675
>13778
>13787
>13999
>14051
>14187
>14522
>14566
>14669
>14751
>14988
>15084
>15091
>15125
>15146
>15206
>15227
>15290
>15311
>15320
>15377
>15399
>15417
>15425
>15433
>15435
>15461
>15467
>15468
>15488
>15500
>15502
>15525
>15527
>15542
>15557
>15582
>15589
>15595
>15621
>15652
>15670
>15683
>15694
>15704
>15706
>15723
>15732
>15734
>15802
>15829
>15855
>15857
>15869
>15895
>15924
>15934
>15935
>15941
>15962
>15997
>16019
>16020
>16039
>16043
>16083
>16086
>16117
>16135
>16160
>16175
>16178
>16206
>16232
>16246
>16276
>16295
>16299
>16300
>16301
>16302
>16322
>16338
>16340
>16342
>16345
>16347
>16360
>16366
>16367
>16629
>16718
>16735
>16753
>16787
>16810
>16814
>17069
>17184
>17379
>17401
>17425
>17451
>17465
>17483
>17486
>17488
>17494
>17552
>17557
>17565
>17574
>17577
>17583
>17586
>17598
>17608
>17622
>17676
>17762
>17769
>17771
>17785
>17803
>17808
>17809
>17813
>17839
>17841
>17849
>17854
>17858
>17864
>17871
>17877
>17887
>17908
>17917
>17924
>17974
>18004
>18028
>18034
>18101
>18171
>18182
>18207
>18209
>18229
>18252
>18291
>18298
>18302
>18310
>18313
>18324
>18359
>18373
>18396
>18403
>18415
>18678
>18712
>18779
>18809
>18881
>18941
>19009
>19037
>19108
>19114
>19262
>19429
>19723
>20001
>20115
>20207
>20214
>20252
>20299
>20453
>20485
>20510
>20552
>20581
>20597
>20632
>20676
>20714
>20723
>20731
>20754
>20771
>20793
>20804
>20815
>20825
>20838
>20845
>20852
>20853
>20858
>20910
>20911
>20921
>20922
>20931
>20938
>20946
>20959
>20960
>20971
>20985
>21003
>21010
>21017
>21019
>21021
>21031
>21040
>21050
>21062
>21070
>21088
>21109
>21151
>21188
>21211
>21215
>21219
>21221
>21229
>21261
>21277
>21284
>21327
>21334
>21335
>21341
>21353
>21404
>21418
>21430
>21435
>21446
>21453
>21466
>21479
>21480
>21483
>21487
>21497
>21502
>21508
>21595
>21826
>22047
>22080
>22085
>22192
>22258
>22351
>22368
>22394
>22689
>22724
>22773
>22794
>22833
>22907
>22927
>23138
>23201
>23216
>23262
>23383
>23563
>23577
>23578
>23584
>23674
>23688
>23700
>23752
>23772
>23889
>23908
>23944
>23966
>23974
>24028
>24068
>24105
>24124
>24157
>24160
>24163
>24186
>24218
>24244
>24321
>24326
>24378
>24389
>24456
>24514
>24525
>24554
>24560
>24589
>24608
>24631
>24634
>24641
>24651
>24663
>24671
>24710
>24718
>24731
>24739
>24740
>24744
>24748
>24762
>24783
>24814
>24822
>24827
>24863
>24872
>24873
>24936
>24945
>24955
>24962
>25008
>25019
>25025
>25036
>25041
>25100
>25124
>25133
>25144
>25159
>25165
>25169
>25176
>25216
>25229
>25233
>25248
>25272
>25308
>25330
>25373
>25386
>25388
>25394
>25405
>25408
>25424
>25436
>25438
>25441
>25468
>25474
>25490
>25496
>25500
>25512
>25513
>25515
>25521
>25620
>26105
>26546
>26599
>26611
>26642
>27672
>27680
>27695
>27699
>27702
>27717
>27734
>27738
>27747
>27751
>27773
>27813
>27829
>27833
>27839
>27851
>27877
>27881
>27925
>27927
>27947
>27953
>27983
>27995
>28006
>28015
>28024
>28038
>28049
>28126
>28145
>28153
>28199
>28202
>28220
>28232
>28235
>28270
>28276
>28292
>28534
>28536
>28548
>28552
>28554
>28556
>28573
>28576
>28590
>28615
>28679
>28683
>28685
>28702
>28716
>28719
>28725
>28727
>28736
>28738
>28751
>28785
>28787
>28802
>28809
>28812
>28824
>28840
>28851
>28858
>28878
>28885
>28890
>28891
>28909
>28968
>28972
>28982
>28994
>29000
>29007
>29021
>29036
>29049
>29086
>29103
>29107
>29113
>29119
>29124
>29126
>29128
>29154
>29180
>29194
>29208
>29209
>29226
>29229
>29231
>29232
>29259
>29276
>29277
>29278
>29286
>29300
>29314
>29319
>29321
>29323
>29328
>29355
>29386
>29396
>29405
>29442
>29470
>29497
>29512
>29518
>29549
>29553
>29556
>29562
>29571
>29573
>29596
>29625
>29644
>29645
>29684
>29688
>29690
>29695
>29859
>29877
>30043
>30452
>30619
>30689
>30703
>30722
>30728
>30733
>30764
>30768
>30779
>30784
>30793
>30799
>30824
>30833
>30838
>30851
>30886
>30890
>30904
>30922
>30953
>30955
>31036
>31062
>31094
>31106
>31129
>31133
>31143
>31200
>31203
>31207
>31213
>31219
>31242
>31246
>31250
>31255
>31257
>31261
>31272
>31286
>31291
>31304
>31306
>31323
>31334
>31343
>31359
>31388
>31423
>31460
>31480
>31513
>31514
>31549
>31558
>31581
>31585
>31608
>31615
>31646
>31662
>31679
>31685
>32098
>32448
>32580
>32855
>33287
>33363
>33490
>33491
>33497
>33650
>33651
>33652
>33657
>33662
>33668
>33774
>33797
>33840
>33852
>33863
>33868
>33911
>33919
>33932
>33936
>33947
>33951
>33997
>34006
>34030
>34049
>34056
>34058
>34075
>34080
>34093
>34121
>34139
>34143
>34145
>34177
>34187
>34201
>34221
>34226
>34244
>34245
>34248
>34250
>34266
>34267
>34275
>34311
>34325
>34337
>34339
>34352
>34369
>34377
>34397
>34398
>34400
>34402
>34426
>34449
>34456
>34494
>34513
>34533
>34550
>34567
>34569
>34584
>34588
>34594
>34602
>34610
>34661
>34687
>34688
>34692
>34700
>34711
>34718
>34743
>34757
>34779
>34786
>34797
>34814
>34820
>34857
>34867
>34875
>34892
>34898
>34937
>34977
>34984
>35063
>35112
>35123
>35129
>35141
>35154
>35179
>35191
>35199
>35228
>35233
>35239
>35274
>35297
>35306
>35310
>35311
>35320
>35357
>35362
>35366
>35377
>35378
>35434
>35473
>35475
>35499
>35510
>35521
>35530
>35531
>35533
>35539
>35567
>35598
>35612
>35638
>35645
>35686
>35699
>35706
>35736
>35737
>35750
>35760
>35790
>35795
>35805
>35807
>35810
>35819
>35908
>36505
>36874
>36884
>36925
>36935
>36947
>36992
>36996
>37019
>38056
>38091
>38097
>38120
>38137
>38148
>38203
>38266
>38267
>38322
>38390
>38397
>38399
>38402
>38404
>38407
>38444
>38457
>38547
>38548
>38550
>38592
>38616
>38660
>38661
>38666
>38669
>38684
>38861
>38913
>38922
>38923
>38942
>38944
>38951
>38964
>38984
>38987
>39005
>39007
>39015
>39054
>39065
>39120
>39125
>39145
>39211
>39229
>39230
>39261
>39301
>39309
>39349
>39362
>39376
>39388
>39392
>39407
>39410
>39412
>39434
>39435
>39439
>39463
>39496
>39501
>39512
>39536
>39582
>39591
>39598
>39603
>39608
>39612
>39651
>39660
>39696
>39706
>39760
>39780
>39785
>39792
>39821
>39834
>39862
>39869
>39906
>39922
>40127
>40188
>40285
>40307
>40314
>40315
>40336
>41025
>41096
>41176
>41201
>41202
>41273
>41279
>41314
>41349
>41356
>41387
>41440
>41462
>41588
>41589
>41627
>41642
>41661
>41668
>41676
>41703
>41704
>41709
>41733
>41802
>41809
>41824
>41852
>41865
>41881
>41900
>41931
>41947
>41952
>41959
>41966
>42003
>42005
>42081
>42084
>42086
>42104
>42141
>42148
>42192
>42232
>42239
>42266
>42270
>42291
>42298
>42318
>42322
>42336
>42386
>42395
>42396
>42428
>42431
>42440
>42448
>42484
>42490
>42494
>42501
>42504
>42526
>42532
>42574
>42610
>42644
>42654
>42666
>42673
>42682
>42683
>42705
>42717
>42727
>42739
>42748
>42754
>42763
>42825
>42833
>42841
>42864
>42894
>42896
>42908
>42935
>42961
>42968
>42974
>42998
>43010
>43030
>43060
>43092
>43118
>43132
>43139
>43148
>43203
>43234
>43266
>43273
>43275
>43310
>43318
>43402
>43447
>43468
>43478
>43487
>43506
>43507
>43529
>43530
>43554
>43555
>43557
>43637
>43708
>43709
>43754
>43806
>43826
>43882
>43898
>43918
>43922
>43967
>44002
>44027
>44033
>44034
>44038
>44056
>44061
>44070
>44082
>44094
>44171
>44176
>44178
>44224
>44249
>44278
>44281
>44290
>44300
>44375
>44397
>44419
>44420
>44451
>44454
>44489
>44514
>44558
>44631
>44668
>44714
>44724
>44727
>44728
>44743
>44769
>44775
>44874
>44895
>44911
>44957
>45043
>45128
>45194
>45237
>45271
>45356
>45442
>45488
>45528
>45543
>45629
>45669
>45758
>46426
>46841
>47027
>47111
>47114
>47119
>47159
>47164
>47193
>47229
>47232
>47241
>47252
>47262
>47269
>47286
>47323
>47373
>47377
>47384
>47395
>47440
>47450
>47452
>47456
>47493
>47507
>47522
>47524
>47645
>47702
>47868
>47897
>47909
>47914
>47995
>48102
>48128
>48142
>48146
>48149
>48166
>48209
>48245
>48253
>48321
>48371
>48373
>48416
>48424
>48428
>48431
>48437
>48464
>48474
>48523
>48524
>48573
>48624
>48694
>48699
>48730
>48781
>48832
>48917
>48940
>48965
>49000
>49013
>49102
>49160
>49170
>49171
>49368
>49403
>49417
>49559
>49715
>49816
>196705
>196829
>
>
>
>_______________________________________________
>nsp-security mailing list
>nsp-security at puck.nether.net
>https://puck.nether.net/mailman/listinfo/nsp-security
>
>Please do not Forward, CC, or BCC this E-mail outside of the
>nsp-security
>community. Confidentiality is essential for effective Internet
>security counter-measures.
>_______________________________________________
>