[nsp-sec] Koobface infected machines - 653 ips

[Anders Hardangen]

Greetings nsp-sec,

We received reports of a Koobface proxy hosted in Norway and was able to
get some logs off the server. Attached you will find a CSV file
containing IPs who has made a connection to this proxy, along with the
HTTP request that was made.

The proxy was up at www.bislettgames.com (213.158.233.142), and was shut
down at november 6th. Requests being made to this server was proxied to
capthcabreak.com (67.212.69.230).

Best regards
Anders Hardangen
NorCERT