botnet information center

r.spiandorello — Mon, 11 Mar 2019 22:15:34 GMT

Hi, where can I verify the nature of botnet malware-sites informations ?

I'd like to detail the output of "show dynamic report top malware-sites" and I'm looking for a site where I can insert the IP (i.e. 209.53.113.221) and obtain detail, like malware that generates that traffic.

thanks

Re: botnet information center

clausonna — Wed, 18 Jan 2012 17:55:17 GMT

Typically you would go to Senderbase, which is the IronPort reputation database.

209.53.113.221&

http://www.senderbase.org/senderbase_queries/rep_lookup

That said, the BTF (Botnet Traffic Filter) database is supposedly a subset of that database, and (in my experiences) completely hit-or-miss on whether a triggering IP address/domain name is in there or not. I wrote some scripts to test known-malicious domain names against BTF. Out of over 15,000 malicious/suspicious domains, BTF only triggered on about 10% of them.

You can test for yourself by logging into the ASA and issuing the 'dynamic-filter database find ' command, where is the domain name. Sites like malwaredomainlist.com and malwaredomains.com are good sources for lists.

A few other sites that can be helpful for correlation; there are plenty more out there:

http://www.trustedsource.org

http://hosts-file.net/default.asp?s=123.123.123.123

http://www.google.com/safebrowsing/diagnostic?site=123.123.123.123

Good luck.

topic Re: botnet information center in Network Security

botnet information center

Re: botnet information center