Comments on NOC4HOSTS and the Grum Botnet

kai commented on 'NOC4HOSTS and the Grum Botnet'

2009-02-16T01:16:28Z

this is another of their scam sites with a search I did http://www.nowtorrents.com/torrents/this+is+a+scam+site+.html hosted by NOC4HOSTS you may find the search results interesting! There should be an easier way to shut these sort of sites and companies down

Andrew commented on 'NOC4HOSTS and the Grum Botnet'

2008-12-12T21:17:25Z

There's a cutwail C&C also running in HI velocity @ 69.46.20.65. The traffic is to port 2065 and looks like obfuscated traffic. The only discernible text in the stream is "L.....9ifnospam.0.exe_url..exe_url........"

The other portion of the cutwail C&C is in SoftLayer, also in the US. I posted some of the details on my blog: http://realsecurity.wordpress.com/

Martin commented on 'NOC4HOSTS and the Grum Botnet'

2008-12-09T09:28:13Z

Hivelocity response team is actually decently responsive, they null routed all mentionned IPs yesterday.

Skudd commented on 'NOC4HOSTS and the Grum Botnet'

2008-12-07T00:06:27Z

Out of curiosity, do you folks report this sort of thing to the DC's abuse team? Where I work (an unnamed leader in the hosting industry), our abuse team takes this sort of thing _very_ seriously. If the NOC won't do anything about it, hand the packet logs over to the upstream provider(s) along with copies of the messages submitted to the DC.