[ESTIMADO/a cliente:
Nos dirigimos a usted para informarle de que estamos recibiendo en nuestro buzón de abuse@movistar.es incidencias remitidas por otros proveedores o usuarios que indican podría haber un problema de seguridad en sus sistemas que permitan que se estén produciendo abusos de Internet sobre su conexión.
En concreto, le adjuntamos como muestra el correo recibido al respecto, para que puedan analizar y detectar el problema que lleva a que se produzcan estos incidentes desde sus equipos.
********************** INICIO LOG **********************
Hello,
this is an autogenerated email abuse complaint regarding your network.
abusix hereby reports a Grumbot infected System in your network to you as the responsible Network Operator or Abuse Desk - helping you to keep your network clean.
!!! IMPORTANT !!!
!!! PLEASE NOTE THIS IS NOT ABOUT THE C&C SERVER (SINKHOLE) !!!
The C&C Server has been overtaken and shutdown by researchers. And even Grumbot is not active anymore. Nevertheless there are tenth of thousands of infected systems out there, that must be cleaned immediately. That´s why you receive this report.
Please contact your affected customers and let them know, that their system is compromised and ask them to clean it up. Full Scan with a Virus Scanner and the latest definition files should be enough.
More information about Grumbot can be found here:
http://en.wikipedia.org/wiki/Grum_botnet
Please see attachments for more specific information regarding this incident!
This report is implemented in an extended abuse report format (X-ARF) defined on http://www.x-arf.org/specification.html
The used X-ARF scheme can be found at:
http://www.x-arf.org/schema/abuse_grumbot-infection_0.1.0.json
If you need more information about customized reports or the network abuse & Spam handling solution AbuseHQ, please see:
http://abusix.com
Join us and help fighting Spam on http://blackhole.mx
Regards
Your abusix Team
P.S.: You receive this mail because we identified you as the responsible POC for this type of incident. Anyhow, please let us know if our information is outdated and send us the CIDR with the correct contact:
http://abusix.org/contact
- report.txt
xxx.xxx.xxx.xxx 46387 - - [20/Nov/2012:18:27:09 +0000] "POST /100/getcfg.php HTTP/1.1" 404 475 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; en)"
xxx.xxx.xxx.xxx 10359 - - [20/Nov/2012:18:58:52 +0000] "POST /100/getcfg.php HTTP/1.1" 404 475 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; en)"
************************ FIN LOG ***********************
Con el fin de protegerse a si mismo, y a otros usuarios de Internet de estos incidentes, le recomendamos que revise la configuración y seguridad de sus equipos, de forma que no vuelvan a producirse en un futuro.
