BotHunter
®
Live Internet Monitor Page
Computer Science Laboratory
SRI International
Last Updated: Mon Mar 18 23:00:03 2013
www.BOTHUNTER.net
Victim IP
Max Score
Profiles
CCs
Events
192.168.1.100
0.9
VIEW 1
212.36.9.1
212.36.9.1 , , , .
94.23.32.56
94.23.32.56 , , , .
1:3810008 {udp}
Russian Business Network:
ET Known Russian Business Network Monitored Domain; 57043->53
1:9930020 {udp}
Bot Space Access:
ET ShadowServer confirmed botnet control server on non-standard port
192.168.1.41
1.8
VIEW 52
777:7777005 {tcp}
Outbound Scan:
Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 22:10
1:2003068 {tcp}
Outbound Attack:
ET SCAN Potential SSH Scan OUTBOUND; 49086->22
1:2003068 {tcp}
Outbound Attack:
ET SCAN Potential SSH Scan OUTBOUND; 57008->22
1:2003068 {tcp}
Outbound Attack:
ET SCAN Potential SSH Scan OUTBOUND; 37549->22
1:2001219 {tcp}
Outbound Attack:
ET SCAN Potential SSH Scan (20 in 60 secs); 53002->22
1:2003068 {tcp}
Outbound Attack:
ET SCAN Potential SSH Scan OUTBOUND; 53002->22
1:2003068 {tcp}
Outbound Attack:
ET SCAN Potential SSH Scan OUTBOUND; 38195->22
777:7777008 {tcp}
Malware Scan:
Detected intense malware port scanning of 42 IPs (27 /24s) (# pkts S/M/O/I=0/42/0/0): 22:42
777:7777005 {tcp}
Outbound Scan:
Detected moderate malware port scanning of 10 IPs (9 /24s) (# pkts S/M/O/I=0/10/0/0): 22:10
1:2003068 {tcp}
Outbound Attack:
ET SCAN Potential SSH Scan OUTBOUND; 53644->22
777:7777005 (2) {tcp}
Outbound Scan:
Detected moderate malware port scanning of 10 IPs (9 /24s) (# pkts S/M/O/I=0/10/0/0): 22:10
777:7777005 (2) {tcp}
Outbound Scan:
Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 22:10
224:1 (3) {udp} E2[dns] BHDNS SPYWARE-DNS: dfudont.ru (Blackhole exploit kit 2.0) MAC_Dst: 00:21:1C:EE:14:00; 55986->53
777:7777005 {tcp}
Outbound Scan:
Detected moderate malware port scanning of 10 IPs (7 /24s) (# pkts S/M/O/I=0/10/0/0): 22:10
777:7777005 (3) {tcp}
Outbound Scan:
Detected moderate malware port scanning of 11 IPs (7 /24s) (# pkts S/M/O/I=0/11/0/0): 22:11
777:7777008 {tcp}
Malware Scan:
Detected intense malware port scanning of 28 IPs (18 /24s) (# pkts S/M/O/I=0/28/0/0): 22:28
1:2003068 {tcp}
Outbound Attack:
ET SCAN Potential SSH Scan OUTBOUND; 46484->22
777:7777008 {tcp}
Malware Scan:
Detected intense malware port scanning of 41 IPs (27 /24s) (# pkts S/M/O/I=0/41/0/0): 22:41
1:2003068 {tcp}
Outbound Attack:
ET SCAN Potential SSH Scan OUTBOUND; 47342->22
1:2003068 {tcp}
Outbound Attack:
ET SCAN Potential SSH Scan OUTBOUND; 48202->22
