<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div>I get abuse reports like that - my exit is not yet officially recognised as an exit so is curretly seen as the source of the attack - its unlikely your server is infected its just the traffic from your exit - especially as you using port 443 - just send standard abuse template to them if its a problem for the isp</div><div id="AppleMailSignature"><br></div><div id="AppleMailSignature">U could always install clamav and do a quick check on your server if u think its necessary <br><br>regards<div><br></div><div>Mark B</div><div><br></div></div><div><br>On 7 Dec 2016, at 14:09, Volker Mink <<a href="mailto:volker.mink@gmx.de">volker.mink@gmx.de</a>> wrote:<br><br></div><blockquote type="cite"><div><div style="font-family: Verdana;font-size: 12.0px;"><div>
<div>hey folks.</div>
<div> </div>
<div>i got an abuse-information from my provider, please see details attached.</div>
<div>could this propably be caused by some malware on my tor exit?</div>
<div> </div>
<div>Any ideas on this?</div>
<div> </div>
<div>Best,</div>
<div>volker</div>
<div>
<div name="quote" style="margin:10px 5px 5px 10px; padding: 10px 0 10px 10px; border-left:2px solid #C3D9E5; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
<div name="quoted-content">
<div style="background-color: white;">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: Arial , sans-serif;color: rgb(68,84,106);"> </span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: Arial , sans-serif;color: rgb(68,84,106);"><a href="https://unity.abusehq.net/share/gFraliWxA_A-0uCFJvSxAkPRxYn536JoReAkl2MNUuCq3TNWJ8f4uXJVypwWAnVa" target="_blank"><span style="color: black;">https://unity.abusehq.net/share/gFraliWxA_A-0uCFJvSxAkPRxYn536JoReAkl2MNUuCq3TNWJ8f4uXJVypwWAnVa</span></a></span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: Arial , sans-serif;color: rgb(68,84,106);"> </span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: Arial , sans-serif;color: rgb(68,84,106);"> </span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: Arial , sans-serif;color: rgb(68,84,106);">MAC Address IP</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: Arial , sans-serif;color: rgb(68,84,106);">f07959d25289 109.90.11.123</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: Arial , sans-serif;color: rgb(68,84,106);"> </span></p>
<p class="MsoNormal"><b><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">Date:</span></b></p>
<p class="MsoNormal"><b><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">06.12.2016 11:16</span></b></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;"> </span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">Type:</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">bot-infection</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;"> </span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">Reporter:</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;"><a href="mailto:security@libertyglobal.com">security@libertyglobal.com</a></span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;"> </span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">IP address:</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">109.90.11.123</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;"> </span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">Incident part:</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">- <b>malware family: virut</b></span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">- destination ip: 148.81.111.121</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">- destination port: 80</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">- feeder: team cymru</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">- description: This host is most likely infected with malware.</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;"> </span></p>
<p class="MsoNormal"><b><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">Date:</span></b></p>
<p class="MsoNormal"><b><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">05.12.2016 10:00</span></b></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;"> </span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">Type:</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">malware</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;"> </span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">Reporter:</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;"><a href="mailto:reports@reports.cert-bund.de">reports@reports.cert-bund.de</a></span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;"> </span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">IP address:</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">109.90.11.123</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;"> </span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">Incident part:</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">- <b>malware: urlzone</b></span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">- destination ip: 64.71.166.50</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">- destination port: 443</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">- destination hostname: <a href="http://didnadinka.net">didnadinka.net</a></span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">- asn: 6830</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;"> </span></p>
<p class="MsoNormal"><b><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">Date:</span></b></p>
<p class="MsoNormal"><b><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">02.12.2016 19:16</span></b></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;"> </span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">Type:</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">bot-infection</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;"> </span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">Reporter:</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;"><a href="mailto:security@libertyglobal.com">security@libertyglobal.com</a></span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;"> </span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">IP address:</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">109.90.11.123</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;"> </span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">Incident part:</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">- <b>malware family: zeus</b></span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">- destination ip: 87.106.18.112</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">- http request: /config</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">- destination port: 80</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">- destination domain name: <a href="http://mabqg.com">mabqg.com</a></span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">- feeder: shadowserver</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">- report type: botnet_drone</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: "Courier New";color: windowtext;">- description: This host is most likely infected with malware.</span></p>
<p class="MsoNormal"><span style="font-size: 10.0pt;font-family: Arial , sans-serif;color: rgb(68,84,106);"> </span></p>
<div> </div>
</div>
</div>
</div>
</div>
</div>
</div></div></div></blockquote><blockquote type="cite"><div><smime.p7s></div></blockquote><blockquote type="cite"><div><span>_______________________________________________</span><br><span>tor-relays mailing list</span><br><span><a href="mailto:tor-relays@lists.torproject.org">tor-relays@lists.torproject.org</a></span><br><span><a href="https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays">https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays</a></span><br></div></blockquote></body></html>