A couple hits on the DNS query logs of interest. The www [dot] serifwebresources [dot] com is known to be tied to the GUMBLAR malware command/control. No idea if the machine making these queries is infected or not, but if you can track it down, it may prevent a bigger problem later. Feb 1 13:49:11 client 140.221.8.88 query: www [dot] serifwebresources [dot] com Feb 1 14:08:41 client 140.221.8.88 query: www [dot] serifwebresources [dot] com The freeonlinedatingtips is tied to GBOT and TDL3 malware. Typically a hit on just this domain is an attempt on the machine to install the malware. ie a redirect from some other site to freeonline then to the malware download site. Since we have this blocked, chances are this is nothing. Feb 1 08:43:25 client 140.221.9.222 query: freeonlinedatingtips [dot] net
The query for serifwebresources has scrolled out of the logs on sirius. I can't tell who requested it. The query for freeonlinedatingtips query came from imaclam.mcs.anl.gov. It's registered to Kathy Horkey in hostbase. Ken On 02/03/2011 08:31 AM, Gene Rackow wrote:
A couple hits on the DNS query logs of interest.
The www [dot] serifwebresources [dot] com is known to be tied to the GUMBLAR malware command/control. No idea if the machine making these queries is infected or not, but if you can track it down, it may prevent a bigger problem later. Feb 1 13:49:11 client 140.221.8.88 query: www [dot] serifwebresources [dot] com Feb 1 14:08:41 client 140.221.8.88 query: www [dot] serifwebresources [dot] com
The freeonlinedatingtips is tied to GBOT and TDL3 malware. Typically a hit on just this domain is an attempt on the machine to install the malware. ie a redirect from some other site to freeonline then to the malware download site. Since we have this blocked, chances are this is nothing. Feb 1 08:43:25 client 140.221.9.222 query: freeonlinedatingtips [dot] net
participants (2)
-
Kenneth Raffenetti -
rackow＠anl.gov