topic backplane1.janrainbackplane.com in Network Security

backplane1.janrainbackplane.com

mrrlg — Tue, 12 Mar 2019 00:22:50 GMT

We have been running the Cisco Botnet fliters for some time now and we are seeing thousands of dropped packets all pointing to backplane1.janrainbackplane.com, port 443 on a wide variety of ip addresses. I can find no information within the other anti-malware vendors that they consider this to be malware. Is this behavior unique to my environment or are you seeing this type of behavior as well?

backplane1.janrainbackplane.com

Marcin Latosiewicz — Tue, 13 Nov 2012 19:11:19 GMT

Just to chime in.

Typically those are good reference pages:

http://www.siteadvisor.com/sites/backplane1.janrainbackplane.com

(ironport ) http://www.senderbase.org/senderbase_queries/rep_lookup?search_name=backplane1.janrainbackplane.com&action%3ASearch=Search

http://www.mywot.com/en/scorecard/backplane1.janrainbackplane.com

http://www.google.com/safebrowsing/diagnostic?site=backplane1.janrainbackplane.com

backplane1.janrainbackplane.com

Robert Zeff — Wed, 28 Nov 2012 17:36:06 GMT

90% of the blocked IPs on my Botnet filter are from backplane1.janrainbackplane.com, port 443

None of the hosts, perhaps 50, have complained about problems.

I have no idea why.

-Robert

backplane1.janrainbackplane.com

mrrlg — Wed, 28 Nov 2012 19:57:34 GMT

I currently have an open ticket with Cisco on this matter. I am seeing this "domain" associated with multiple ips. Their current response is

"the domain is mapped to several IPs and due to the command 'dynamic-filter ambiguous-is-black' then it will be blocked. You can create an entry under the White-list in order to access the Website and keep the "ambiguous" command on."

The ip addresses I checked that were being associated with this domain are part of Amazon's e-commerce space. I have white-listed it in a couple of ASAs to see if the underlying ip addresses are captured by the botnet filter.

backplane1.janrainbackplane.com

Robert Zeff — Sun, 02 Dec 2012 02:59:05 GMT

I think these are all pop-up ads. I thought about white-listing, but we've been blcking thousands of hits with no complaints.

We've seen pop up ads that contain malware, so unless someone complains, we'll not white-list.

What is ambiguoius, I wonder? There is no forward - reverse lookup matches for all of these IPs?

backplane1.janrainbackplane.com

grahamt — Mon, 17 Dec 2012 20:08:10 GMT

Same here. We've been blocking about 300-400k connections per day to this site for weeks. Zero complaints. I did a capture and it seemed related to either ads or analytics for Fox Sports websites.