Abuse Message [AbuseID:84C17E:1F]: AbuseNormal: SBL Notify: IP: 88.198.3.5 added to Spamhaus Botnet Controller List (BCL)

 ————————————————————————
 SBL519488 — The Spamhaus Project — SBL International Anti-Spam System
 ————————————————————————
 
 Hello hetzner.de Abuse Desk,
   
 This is an automated message from the Spamhaus Block List (SBL) database
 to advise that the IP below has been added to sbl.spamhaus.org:
 
 IP/cidr: 88.198.3.5
 
 Problem: *** BOTNET CONTROLLER LISTING ***
 
 RedLineStealer botnet controller @88.198.3.5
   
 SBL Ref: SBL519488
  
 The reason for listing the IP address(es) is explained at the url:
 https://www.spamhaus.org/sbl/query/SBL519488
 
 If this problem has already been taken care, a removal request can
 be sent for SBL519488 by emailing:
 <mailto:sbl-removals@spamhaus.org?Subject=SBL519488_88.198.3.5>
 
 Note that the email must tell us how the problem has been resolved (we need
 to know exactly how the issue has been dealt with and that this problem is fully terminated).
 
 Please always include «SBL519488» in the Subject of any emails to
 sbl-removals@spamhaus.org regarding this listing.
 
   SBL System Robot
   The Spamhaus Project
   https://www.spamhaus.org
 
 ————————————————————————
 You can review all current SBL listings concerning your network here:
 https://www.spamhaus.org/sbl/listings/hetzner.de
 
 More information may be availble in the new Spamhaus ISP Portal, including
 free API access to CSS and XBL listings. Sign up for a PBL account here
 to access the Spamhaus ISP Portal:
 https://www.spamhaus.org/pbl/ispaccount/
 ————————————————————————
 You are receiving this notification because you are the designated abuse
 contact for your network. If you do not want to be alerted whenever IPs
 on your network are listed in the SBL, please advise us by contacting
 <mailto:sbl-autonotify@spamhaus.org?Subject=STOP_Notify_hetzner.de>
 ————————————————————————
 ISP Abuse Desk Resources……..: https://www.spamhaus.org/isp/
 Spamhaus Block List (SBL)…….: https://www.spamhaus.org/sbl/
 Exploits Block List (XBL)…….: https://www.spamhaus.org/xbl/
 Botnet Controller List (BCL)….: https://www.spamhaus.org/bcl/
 Don’t Route or Peer List (DROP).: https://www.spamhaus.org/drop/
 Register Of Known Spammers……: https://www.spamhaus.org/rokso/
 ————————————————————————
 
The host at this IP address is obviously operated by cybercriminals. It is running a malware botnet controller which is being used to control infected computers (bots) around the globe using a trojan horse.

Malware botnet controller located at 88.198.3.5 on port 81 TCP:
$ telnet 88.198.3.5 81
Trying 88.198.3.5
Connected to 88.198.3.5.
Escape character is ‘^]’

$ nslookup 88.198.3.5
static.88.198.3.5.clients.your-server.de

Referencing malware samples (MD5 hash):
487cbebe3e0e954d3cd2d42a5daf2f67 — AV detection: 53 / 71 (74.65%)
4920169cae3b94797609bcf4d6bc5df4 — AV detection: 19 / 70 (27.14%)
4f095e73016bbf9432ec5a14f66239c0 — AV detection: 37 / 71 (52.11%)
6d258ba9a819c1b345e85e857eab26cf — AV detection: 37 / 70 (52.86%)
 

Добавить комментарий

Ваш адрес email не будет опубликован.