Is my exit affected by a botnet?
I get abuse reports like that - my exit is not yet officially recognised as an exit so is curretly seen as the source of the attack - its unlikely your server is infected its just the traffic from your exit - especially as you using port 443 - just send standard abuse template to them if its a problem for the isp U could always install clamav and do a quick check on your server if u think its necessary regards Mark B
On 7 Dec 2016, at 14:09, Volker Mink <volker.mink@gmx.de> wrote:
hey folks.
i got an abuse-information from my provider, please see details attached. could this propably be caused by some malware on my tor exit?
Any ideas on this?
Best, volker
https://unity.abusehq.net/share/gFraliWxA_A-0uCFJvSxAkPRxYn536JoReAkl2MNUuCq...
MAC Address IP
f07959d25289 109.90.11.123
Date:
06.12.2016 11:16
Type:
bot-infection
Reporter:
security@libertyglobal.com
IP address:
109.90.11.123
Incident part:
- malware family: virut
- destination ip: 148.81.111.121
- destination port: 80
- feeder: team cymru
- description: This host is most likely infected with malware.
Date:
05.12.2016 10:00
Type:
malware
Reporter:
reports@reports.cert-bund.de
IP address:
109.90.11.123
Incident part:
- malware: urlzone
- destination ip: 64.71.166.50
- destination port: 443
- destination hostname: didnadinka.net
- asn: 6830
Date:
02.12.2016 19:16
Type:
bot-infection
Reporter:
security@libertyglobal.com
IP address:
109.90.11.123
Incident part:
- malware family: zeus
- destination ip: 87.106.18.112
- http request: /config
- destination port: 80
- destination domain name: mabqg.com
- feeder: shadowserver
- report type: botnet_drone
- description: This host is most likely infected with malware.
<smime.p7s> _______________________________________________ tor-relays mailing list tor-relays@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays
participants (2)
-
Sec INT -
Volker Mink