Re: Not so Nice Net

[David Gillett <gillettdavid () FHDA EDU>]

  Traceroute on that address goes to a client of t-internet.de, which I
believe is part of the t-*.de cluster of services possibly affiliated with
T-Mobile.
 
  I recall that when I started doing network security, more than 15 years
ago, t-dialin.de was a recurring source of "bad" traffic, and their network
administrators were the most likely to promise to act on complaints -- to no
visible effect.
 
Technology evolves faster than people....
 
David Gillett, CISSP CCNP
 

  _____  

From: Jeff Moore [mailto:mail () JEFFMOORE COM] 
Sent: Wednesday, February 08, 2012 08:18
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: [SECURITY] Not so Nice Net


Hi all - Got a weird one here... Has anyone else noticed that almost all
traffic from 91.x.x.x is of a "not so good" nature? We created a custom
snort sig a while back to track the 91.x.x.x range because we saw that a
majority of TORPIGs control servers were in that range and our institution
rarely if ever gets traffic from that net. 
What we found interesting was that over the last year or more we have found
that every single hit on that signature traced back to be "Not so Nice"
hosts. for example:
http://www.mcafee.com/threat-intelligence/ip/default.aspx?ip=91.43.140.23
(one from this morning. just mail rep on this one). We have also traced each
of these down on our side and have found that the only traffic(initiated
from our net) that was not virus/malware related was traffic from "Panda
Download Manager" Which we also didn't want and is a shady-ish MP3 download
engine. It astounds me that day in day out if we see traffic from this net
it is always "Not so Nice"!

I was just curious if you all have been seeing this as well and if not can
ya take a peek to see if it rings true with your systems as well? 

Maybe I have just gotten lucky. Just a strange little oddity that I was
curious if you all have seen.

Thanks All!

-- 
Jeff Moore
Chemeketa Community College

Desk (503)  <https://www.google.com/voice?pli=1#phones> 877-4707
Cell (503)  <https://www.google.com/voice?pli=1#phones> 910-0756
Jeff.Moore () chemeketa edu