[unisog] ET DROP Known Bot C&C Server Traffic --> 126.96.36.199
gillsr at cymru.com
Thu Jul 10 19:46:14 GMT 2008
> Since some weeks ago, we started getting many hits on rule
> "ET DROP Known Bot C&C Server Traffic (group 7)" (SID 2404006),
> with traffic going to 188.8.131.52 (ports 25, 80 and 443).
> The related packet is:
> 07/01/08-20:56:55.976724 XXX.XXX.XX.XX:2561 -> 184.108.40.206:80
> TCP TTL:127 TOS:0x0 ID:35416 IpLen:20 DgmLen:48 DF
> ******S* Seq: 0x74043F2B Ack: 0x0 Win: 0xFFFF TcpLen: 28
> TCP Options (4) => MSS: 1460 NOP NOP SackOK
> I run some antivirus online on a few machines, but I could
> not detect any bot infection. Has anyone got false positives
> on events hiting that rule ?
Can you figure out which DNS entries and/or processes are making those
queries from the clients in question?
That IP has a lot of stuff on it. EG:
However, it has also hosted C&Cs on those ports (as per your snort rule) so
you'll probably need to do a bit more digging to find out what site the
hosts are connecting to in order to make a more accurate determination.
> UFRGS - BR
> Universidade Federal do Rio Grande do Sul
> unisog mailing list
> unisog at lists.dshield.org
More information about the unisog