https://www.botnets.fr/index.php?action=history&feed=atom&title=Takeover_of_Virut_domains 2026-10-25T15:26:32Z Revision history for this page on the wiki MediaWiki 1.43.11 https://www.botnets.fr/index.php?title=Takeover_of_Virut_domains&diff=5879&oldid=prev 2015-08-05T20:52:48Z

<p>Text replacement - &quot; www.cert.pl&quot; to &quot;&quot;</p> <table style="background-color: #fff; color: #202122;" data-mw="interface"> <col class="diff-marker" /> <col class="diff-content" /> <col class="diff-marker" /> <col class="diff-content" /> <tr class="diff-title" lang="en"> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Older revision</td> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Revision as of 20:52, 5 August 2015</td> </tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l1">Line 1:</td> <td colspan="2" class="diff-lineno">Line 1:</td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>{{Publication</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>{{Publication</div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|Type=White paper</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|Type=White paper</div></td></tr> <tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>|Link=http://www.cert.pl/news/6744/langswitch_lang/en <del style="font-weight: bold; text-decoration: none;">www.cert.pl</del></div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>|Link=http://www.cert.pl/news/6744/langswitch_lang/en</div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|NomRevue=CERT Polska Blog</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|NomRevue=CERT Polska Blog</div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|Date=2013-02-21</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|Date=2013-02-21</div></td></tr> <!-- diff cache key wiki:diff:1.41:old-2828:rev-5879:php=table --> </table>

Eric.freyssinet https://www.botnets.fr/index.php?title=Takeover_of_Virut_domains&diff=2828&oldid=prev 2015-02-07T14:29:41Z

<p>1 revision imported</p> <table style="background-color: #fff; color: #202122;" data-mw="interface"> <col class="diff-marker" /> <col class="diff-content" /> <col class="diff-marker" /> <col class="diff-content" /> <tr class="diff-title" lang="en"> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Older revision</td> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Revision as of 14:29, 7 February 2015</td> </tr><tr><td colspan="4" class="diff-notice" lang="en"><div class="mw-diff-empty">(No difference)</div> </td></tr> <!-- diff cache key wiki:diff:1.41:old-2827:rev-2828 --> </table>

Eric.freyssinet https://www.botnets.fr/index.php?title=Takeover_of_Virut_domains&diff=2827&oldid=prev 2013-02-23T16:08:01Z

<p></p> <p><b>New page</b></p><div>{{Publication<br /> |Type=White paper<br /> |Link=http://www.cert.pl/news/6744/langswitch_lang/en www.cert.pl<br /> |NomRevue=CERT Polska Blog<br /> |Date=2013-02-21<br /> |Editor=CERT Polska<br /> |Year=2013<br /> |Botnet=Virut<br /> |Abstract=At the end of January and the beginning of February 2013 NASK (Research and Academic<br /> Computer Network) { the .pl ccTLD Registry { and its security team CERT Polska<br /> took over 43 .pl domains used to control the Virut botnet and to spread malicious<br /> applications. These actions were preceded by a detailed legal and technical analyses and<br /> were supported by Spamhaus and VirusTotal. Some of these domains, even outside .pl<br /> domain, were an important part of the botnet infrastructure. As a result of these actions,<br /> all traffic from infected computers to the Command and Control servers were redirected<br /> to the sinkhole server controlled by CERT Polska. The action cripples criminals ability<br /> to control infected machines and allows to gather information about infected machines.<br /> This data is shared with all interested partners. From the gathered data, on average 270<br /> thousand unique IP addresses connect to the botnet server every day, which is a good<br /> estimation of the botnet size at the day of takeover. Almost a half of infected machines<br /> are located in three countries: Egypt, Pakistan and India. Poland is located at the 19th<br /> place on the infection scale. This report presents the actions taken by NASK, methods<br /> used to gather data and their analysis, which offer additional insight into Virut activity,<br /> including a connection to the sale of fake antivirus applications.<br /> }}</div>

Eric.freyssinet