Botnet traffic filtering IP address 216.246.75.177 port 80

[go.michael]

Hello,

   I recently installed Botnet traffic filtering on my Cisco ASA FW.  Now I get logs that multiple host are trying to access 216.246.75.177 port 80.  Botnet filter categorizes this as Hight/Malware and drops the traffic.  I googled the IP address and I didnt see any known threats from that IP.  Does someone know anything about this IP address.

Thanks,

Mike

[manish arora]

This IP Address belongs to one of the Major CDN , its generally used my many Websites to deliver faster Videos on their web sites or even streams etc.

Don't know much about Botnet , but if this keeps getting denied then you will have ppl coming to you saying that sections of some web sites are not showing up , even web sites like wellfargo bank uses akmai CDN services.

Manish

[raga.fusionet]

Mike, If google for that IP you would see a number of reports from malcode database making reference to it:

http://malc0de.com/database/index.php?search=216.246.75.177&IP=on

Also, I went to that IP address on port 80 with my browser (NoScript enabled to avoid getting infected myself) and I didnt get anything. No website or anything. This is suspicious.

This IP is not registered on WHOIS which makes it even more suspicious.  I would let the ASA drop the traffic and check those PCs' connections to port 80 with all browsers closed and and using something like netstat or TCPView. If you see any activity going on then the PCs are likely to be infected. 

Botnets are hardly detected by regular AV engines so you might even need to reimage the PCs.

I hope this helps.

[manish arora]

Luis,

I don't know what WHOIS you are checking but here's the link on ARIN :-

http://whois.arin.net/rest/net/NET-216-246-75-0-1/pft

As you can see the IP belongs to Akamai Technologies , one of the best CDN in the market as I have used this company's services at times.

Manish

[raga.fusionet]

Hey thats weird ...I did it a couple of times from my linux desktop. If its indeed akamai, then its probably something like software updates.