<html><head></head><body><div style="font-family: Verdana;font-size: 12.0px;"><div>
<div>hey folks.</div>
<div> </div>
<div>i got an abuse-information from my provider, please see details attached.</div>
<div>could this propably be caused by some malware on my tor exit?</div>
<div> </div>
<div>Any ideas on this?</div>
<div> </div>
<div>Best,</div>
<div>volker</div>
<div>
<div name="quote" style="margin:10px 5px 5px 10px; padding: 10px 0 10px 10px; border-left:2px solid #C3D9E5; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
<div name="quoted-content">
<div style="background-color: white;">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: Arial , sans-serif;color: rgb(68,84,106);"> </span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: Arial , sans-serif;color: rgb(68,84,106);"><a href="https://unity.abusehq.net/share/gFraliWxA_A-0uCFJvSxAkPRxYn536JoReAkl2MNUuCq3TNWJ8f4uXJVypwWAnVa" target="_blank"><span style="color: black;">https://unity.abusehq.net/share/gFraliWxA_A-0uCFJvSxAkPRxYn536JoReAkl2MNUuCq3TNWJ8f4uXJVypwWAnVa</span></a></span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: Arial , sans-serif;color: rgb(68,84,106);"> </span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: Arial , sans-serif;color: rgb(68,84,106);"> </span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: Arial , sans-serif;color: rgb(68,84,106);">MAC Address IP</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: Arial , sans-serif;color: rgb(68,84,106);">f07959d25289 109.90.11.123</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: Arial , sans-serif;color: rgb(68,84,106);"> </span></p>
<p class="MsoNormal"><b><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">Date:</span></b></p>
<p class="MsoNormal"><b><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">06.12.2016 11:16</span></b></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;"> </span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">Type:</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">bot-infection</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;"> </span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">Reporter:</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">security@libertyglobal.com</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;"> </span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">IP address:</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">109.90.11.123</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;"> </span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">Incident part:</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">- <b>malware family: virut</b></span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">- destination ip: 148.81.111.121</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">- destination port: 80</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">- feeder: team cymru</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">- description: This host is most likely infected with malware.</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;"> </span></p>
<p class="MsoNormal"><b><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">Date:</span></b></p>
<p class="MsoNormal"><b><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">05.12.2016 10:00</span></b></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;"> </span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">Type:</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">malware</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;"> </span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">Reporter:</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">reports@reports.cert-bund.de</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;"> </span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">IP address:</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">109.90.11.123</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;"> </span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">Incident part:</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">- <b>malware: urlzone</b></span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">- destination ip: 64.71.166.50</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">- destination port: 443</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">- destination hostname: didnadinka.net</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">- asn: 6830</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;"> </span></p>
<p class="MsoNormal"><b><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">Date:</span></b></p>
<p class="MsoNormal"><b><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">02.12.2016 19:16</span></b></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;"> </span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">Type:</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">bot-infection</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;"> </span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">Reporter:</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">security@libertyglobal.com</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;"> </span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">IP address:</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">109.90.11.123</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;"> </span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">Incident part:</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">- <b>malware family: zeus</b></span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">- destination ip: 87.106.18.112</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">- http request: /config</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">- destination port: 80</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">- destination domain name: mabqg.com</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">- feeder: shadowserver</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">- report type: botnet_drone</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">- description: This host is most likely infected with malware.</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: Arial , sans-serif;color: rgb(68,84,106);"> </span></p>
<div> </div>
</div>
</div>
</div>
</div>
</div>
</div></div></body></html>