mazix Posted March 31, 2015 Posted March 31, 2015 Stevie is blacklisted again.Could / would Heliohost admins setup a blacklist watch for the Heliohost servers ..., and upon receiving an alert start the delisting process ?That would be more efficient than waiting for users to be impacted and report the blacklisting in this forum. Alert HistoryStatus Name Description TimeStamp 65.19.143.2 Blacklist Added to INPS_DE 3/17/2015 7:08:58 AM 65.19.143.2 Blacklist Removed from CBL 3/12/2015 6:37:17 AM 65.19.143.2 Blacklist Removed from Spamhaus ZEN 3/12/2015 6:37:17 AM 65.19.143.2 Blacklist Added to CBL 3/10/2015 6:13:34 AM 65.19.143.2 Blacklist Added to Spamhaus ZEN 3/10/2015 6:13:34 AM 65.19.143.2 Blacklist Removed from LASHBACK 1/9/2015 4:18:33 AM 65.19.143.2 Blacklist Added to LASHBACK 1/2/2015 4:18:37 AM 65.19.143.2 Blacklist Removed from CBL 12/2/2014 11:22:17 AM 65.19.143.2 Blacklist Removed from Spamhaus ZEN 12/2/2014 11:22:17 AM 65.19.143.2 Blacklist Added to CBL 11/28/2014 2:08:00 AM 65.19.143.2 Blacklist Added to Spamhaus ZEN 11/28/2014 2:08:00 AM
Byron Posted March 31, 2015 Posted March 31, 2015 This support request is being escalated to our root admin.
Tjoene Posted April 6, 2015 Posted April 6, 2015 Did a lookup, and it appears that we have several black lists: Stevie: * cbl.abuseat.org * cidr.bl.mcafee.com * dnsbl.ahbl.org * spamtrap.trblspam.com Johnny: * dnsbl.ahbl.org * spamtrap.trblspam.com
jchang Posted April 7, 2015 Posted April 7, 2015 Looks like it's being listed here: http://cbl.abuseat.org/lookup.cgi?ip=65.19.143.2
r0nmlt Posted April 9, 2015 Posted April 9, 2015 Infection is still ongoing:IP Address 65.19.143.2 is listed in the CBL. It appears to be infected with a spam sending trojan, proxy or some other form of botnet.It was last detected at 2015-04-09 00:00 GMT (+/- 30 minutes), approximately 4 hours, 30 minutes ago.Is anybody doing something about it please.
Tjoene Posted April 9, 2015 Posted April 9, 2015 Please give it some times.Krydos will handle it as soon as has the time for it.
nightbyrd Posted April 10, 2015 Posted April 10, 2015 Just tried to send an email from my account that was returned because IP 65.19.143.2 is listed in Spamhaus XBL. I looked it up and apparently some moron installed pirated themes or plugins and now the web server is infected. Hope you can take care of this. Here's the info: IP Address 65.19.143.2 is listed in the CBL. It appears to be infected with a spam sending trojan, proxy or some other form of botnet.It was last detected at 2015-04-10 19:00 GMT (+/- 30 minutes), approximately 3 hours, 30 minutes ago.Due to how these infections are being delisted without being corrected, you cannot delist this IP address until there's been at least 48 hours of no-relisting.The host at this IP address is infected with the CryptPHP PHP malware.CryptoPHP is a threat that uses backdoored Joomla, WordPress andn Drupal themes and plug-ins to compromise webservers on a large scale. More information about this threat can be found on the referenced link below.Fox-IT: CryptoPHP - Analysis of a hidden threat inside popular content management systemsAttackers Using Compromised Web Plug-Ins in CryptoPHP Blackhat SEO Campaign This infection almost certainly means that the infected web site has used pirated plugins from the nulledstylez.com, dailynulled.com sites or some other site that specializes in providing "nulled" (pirated) software. Fox-IT's research has shown that every pirated theme or plug-in on these two sites has been infested with the cryptophp malware. This was detected by a TCP connection from 65.19.143.2 on port 50927 going to IP address 192.42.116.41 (the sinkhole) on port 80. The botnet command and control domain for this connection was "carandfly.net". Behind a NAT, you should be able to find the infected machine by looking for attempted connections to IP address 192.42.116.41 or host name carandfly.net on any port with a network sniffer such as wireshark or by configuring the router to block and log such connections. Equivalently, you can examine your DNS server or proxy server logs to references to 192.42.116.41 or carandfly.net. See Advanced Techniques for more detail on how to use wireshark - ignore the references to port 25/SMTP traffic - the identifying activity is NOT on port 25. This detection corresponds to a connection at 2015-04-10 19:20:07 (GMT - this timestamp is believed accurate to within one second). Fox-IT has published a new blog item on this infection. Fox-IT has written two Python scripts that should be very good at finding these infections: check_url.py and check_filesystems.py. The first script scans a web site to find the infection, the second is used for scanning the web site's filesystem to find the infection. Please go to the above Fox-IT link to obtain these scripts and further instructions. Fox-IT recommends that you should NOT try to "repair" the infection. The infected account should be reinstalled from scratch. I shall repeat the previous paragraph: removing the "social.png" file DOES NOT remove the infection. "social.png" is only just one small piece of it. The infected account should be reinstalled from scratch. This listing cannot be delisted until at least 48 hours (2 days) have elapsed from the last listing. In 2 days from the above listing timestamp, come back here and you'll be able to delist this IP.
wolstech Posted April 11, 2015 Posted April 11, 2015 We've been blocked for almost 2 weeks: http://www.helionet....ie-blacklisted/ Not sure why Krydos hasn't cleaned this up yet. We probably got CryptPHP again...
wolstech Posted April 11, 2015 Posted April 11, 2015 This support request is being escalated to our root admin.
r0nmlt Posted April 14, 2015 Posted April 14, 2015 It is now 14 days since the OP and yet nothing has been done yet! I appreciate that Krydos might be busy, but having a server blacklisted for this amount of time does not reflect good on the reputation of the server. IP Address 65.19.143.2 is listed in the CBL. It appears to be infected with a spam sending trojan, proxy or some other form of botnet. It was last detected at 2015-04-14 10:00 GMT (+/- 30 minutes), approximately 3 hours ago.
Krydos Posted April 17, 2015 Posted April 17, 2015 having a server blacklisted for this amount of time does not reflect good on the reputation of the server.Delisting a server only to have it listed again a few days (or hours) reflects even worse on the reputation, and in some cases they can permanently block the server from ever being delisted again. The more information you all can provide as to the nature and method of the spam being sent from our servers the more quickly we can refine our automated spam prevention processes, and hopefully never have this happen again.
Recommended Posts