[nsp-sec] ACK AS3356 Re: zbot infected IPs

[David Rossbach]

Thanks Dirk..

ACK AS3356


Dave Rossbach
Level3 Communications





--------------------------------------------------
From: "Dirk Stander" <dst+nsp-sec at glaskugel.org>
Sent: Tuesday, October 27, 2009 1:09 PM
To: "To at enantiodromie.de:NSP-SEC List" <nsp-security at puck.nether.net>
Subject: [nsp-sec] zbot infected IPs

> ----------- nsp-security Confidential --------
>
>



> Hi,
>
> please find attached a list of ~5k IPs taken from a ZeuS C&C (proxy).
> The domain aplikapublicidad.es (87.106.193.251:80) has been abused to
> proxy requests to http://xxxdessert.name/glk/gt.php
> It's ok to use the IP in the reports to your clients.  The timestamps
> are in GMT.
>
>    kind regards,
>    Dirk Stander (1&1) :.
>



>
>
> _______________________________________________
> nsp-security mailing list
> nsp-security at puck.nether.net
> https://puck.nether.net/mailman/listinfo/nsp-security
>
> Please do not Forward, CC, or BCC this E-mail outside of the nsp-security
> community. Confidentiality is essential for effective Internet security 
> counter-measures.
> _______________________________________________