[nsp-sec] 30K (Openish) Resolvers

[Gabriel Iovino]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 4/9/2013 10:20 PM, Krista Hickey wrote:
> Attached is just shy of 30k resolvers used to attack a customer
> playing XBOX. Attack was earlier today,

We reached out to the following:

> 3       | 18.70.0.160
> 17      | 128.210.124.129
> 27      | 128.8.164.126
> 46      | 128.6.237.25
> 52      | 164.67.7.11
> 73      | 128.95.9.14
> 73      | 140.142.5.214
> 88      | 128.112.176.204
> 195     | 198.202.75.26
> 209     | 192.101.135.209
> 209     | 192.101.135.9
> 237     | 198.111.37.18
> 237     | 35.8.2.45
> 557     | 169.244.134.66
> 600     | 157.134.160.1
> 600     | 192.148.251.86
> 600     | 192.148.251.93
> 600     | 192.88.193.144
> 600     | 192.88.195.10
> 1249    | 128.119.240.1
> 1312    | 198.82.142.122
> 1312    | 198.82.160.249
> 1312    | 198.82.247.34
> 1998    | 199.17.236.1
> 2037    | 129.8.52.2
> 2152    | 130.150.102.100
> 2572    | 150.243.160.161
> 2698    | 129.186.142.200
> 2900    | 129.219.17.5
> 3112    | 192.148.251.86
> 3112    | 192.148.251.93
> 3592    | 157.252.10.132
> 4385    | 129.21.160.22
> 4385    | 129.21.160.24
> 5078    | 156.110.99.67
> 5661    | 131.247.250.125
> 5718    | 209.80.153.110
> 5719    | 130.245.126.1
> 5719    | 130.245.127.1
> 6192    | 169.237.207.91
> 6325    | 216.124.232.131
> 6325    | 216.124.45.130
> 6356    | 128.227.8.88
> 7377    | 132.239.152.114
> 7925    | 129.71.208.249
> 10430   | 216.186.27.15
> 10430   | 68.179.203.94
> 10546   | 192.208.128.229
> 11131   | 130.85.1.3
> 11442   | 152.1.1.161
> 11442   | 152.1.1.206
> 11442   | 152.1.1.248
> 11442   | 152.1.2.22
> 11686   | 165.138.28.20
> 11686   | 165.139.133.20
> 11686   | 165.139.161.1
> 11714   | 162.127.9.4
> 11995   | 129.95.71.1
> 11995   | 129.95.72.65
> 14325   | 198.7.241.23
> 16461   | 129.108.202.35
> 19718   | 152.48.208.61
> 19856   | 206.40.176.2
> 23323   | 192.235.14.2
> 25773   | 198.111.209.249
> 26554   | 153.106.116.5
> 36223   | 158.91.236.4
> 36223   | 160.7.240.20
> 36850   | 152.2.4.21
> 36850   | 152.2.5.16
> 36850 | 152.2.5.40 53695 | 146.163.130.251
> 53695   | 146.163.133.254
> 54032   | 72.233.151.2

Hopefully we'll see some number of these closed in the next few weeks.

Thank you!

Gabe

- --
Gabriel Iovino
Principal Security Engineer, REN-ISAC
http://www.ren-isac.net
24x7 Watch Desk +1(317)278-6630
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)

iEYEARECAAYFAlFlmvcACgkQwqygxIz+pTvl5wCgktwqJiKUfHbu2o+G8u5me+Z2
cgkAn1BYKz7p8aOXGhgPsL+nk2W8rGrw
=oiCF
-----END PGP SIGNATURE-----