ML
    • Recent
    • Categories
    • Tags
    • Popular
    • Users
    • Groups
    • Register
    • Login

    Botnet Security Alert on Sonicwall

    Scheduled Pinned Locked Moved IT Discussion
    securitysonicwallbotnet
    23 Posts 8 Posters 3.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • travisdh1T
      travisdh1 @zachary715
      last edited by

      @zachary715 I'd go ahead and report it. It could well not be anything, but if it is, then they need to know yesterday.

      1 Reply Last reply Reply Quote 2
      • DashrenderD
        Dashrender
        last edited by Dashrender

        Is it calling the IP of that website a botmaster?
        I'm risking the thrashing of JB.
        But I'm just curious.. does it maybe think your PC is infected because you're going to a banking like site? I mean I would hope not.. but WTFK?

        zachary715Z 1 Reply Last reply Reply Quote 0
        • zachary715Z
          zachary715 @Dashrender
          last edited by

          @dashrender said in Botnet Security Alert on Sonicwall:

          Is it calling the IP of that website a botmaster?
          I'm risking the thrashing of JB.
          But I'm just curious.. does it maybe think your PC is infected because you're going to a banking like site? I mean I would hope not.. but WTFK?

          I'm not totally sure what you're asking. Does what think my PC is infected? The Sonicwall? And I'm not sure why going to a "banking-like site" would make it scream infection. I login to Mint almost daily and my other bank accounts from time to time no issues.

          Like I said I tried on different computers with same result. As soon as I would login to my account, my phone would start going off with email alerts constantly until I logged back out. The IP of the site (23.something) is not the same IP that it says is triggering the alert, so I don't know if it's some behind the scenes CDN or analytics or what. I was just looking to see if anyone had any suggestions on what to do beyond what I've done.

          1 Reply Last reply Reply Quote 0
          • DanpD
            Danp
            last edited by

            Did you notify your bank?

            zachary715Z 1 Reply Last reply Reply Quote 0
            • ObsolesceO
              Obsolesce
              last edited by

              Sounds like your mortgage website was infected with malware, or it's running ads that are. Does your CPU jump when visiting that site more than others? It may not but still may be infected.

              1 Reply Last reply Reply Quote 2
              • ObsolesceO
                Obsolesce
                last edited by

                Latest news is saying a half million sized botnet is mining line to, and one of the targets are Linux SQL servers.

                JaredBuschJ scottalanmillerS 2 Replies Last reply Reply Quote 0
                • JaredBuschJ
                  JaredBusch @Obsolesce
                  last edited by

                  @tim_g said in Botnet Security Alert on Sonicwall:

                  Latest news is saying a half million sized botnet is mining line to, and one of the targets are Linux SQL servers.

                  Mining line to?

                  1 Reply Last reply Reply Quote 0
                  • scottalanmillerS
                    scottalanmiller @Obsolesce
                    last edited by

                    @tim_g said in Botnet Security Alert on Sonicwall:

                    Latest news is saying a half million sized botnet is mining line to, and one of the targets are Linux SQL servers.

                    What's a Linux SQL server? Anything running a relational database? How do they target them?

                    JaredBuschJ ObsolesceO 2 Replies Last reply Reply Quote 0
                    • JaredBuschJ
                      JaredBusch @scottalanmiller
                      last edited by

                      @scottalanmiller said in Botnet Security Alert on Sonicwall:

                      @tim_g said in Botnet Security Alert on Sonicwall:

                      Latest news is saying a half million sized botnet is mining line to, and one of the targets are Linux SQL servers.

                      What's a Linux SQL server? Anything running a relational database? How do they target them?

                      I assumed that one meant Linux servers running MS SQL.

                      scottalanmillerS 1 Reply Last reply Reply Quote 0
                      • scottalanmillerS
                        scottalanmiller @JaredBusch
                        last edited by

                        @jaredbusch said in Botnet Security Alert on Sonicwall:

                        @scottalanmiller said in Botnet Security Alert on Sonicwall:

                        @tim_g said in Botnet Security Alert on Sonicwall:

                        Latest news is saying a half million sized botnet is mining line to, and one of the targets are Linux SQL servers.

                        What's a Linux SQL server? Anything running a relational database? How do they target them?

                        I assumed that one meant Linux servers running MS SQL.

                        I had thought of that, but that seemed so unlikely.

                        JaredBuschJ 1 Reply Last reply Reply Quote 0
                        • JaredBuschJ
                          JaredBusch @scottalanmiller
                          last edited by

                          @scottalanmiller said in Botnet Security Alert on Sonicwall:

                          @jaredbusch said in Botnet Security Alert on Sonicwall:

                          @scottalanmiller said in Botnet Security Alert on Sonicwall:

                          @tim_g said in Botnet Security Alert on Sonicwall:

                          Latest news is saying a half million sized botnet is mining line to, and one of the targets are Linux SQL servers.

                          What's a Linux SQL server? Anything running a relational database? How do they target them?

                          I assumed that one meant Linux servers running MS SQL.

                          I had thought of that, but that seemed so unlikely.

                          Not really. I mean you know how good Windows people patch right?

                          scottalanmillerS 1 Reply Last reply Reply Quote 0
                          • scottalanmillerS
                            scottalanmiller @JaredBusch
                            last edited by

                            @jaredbusch said in Botnet Security Alert on Sonicwall:

                            @scottalanmiller said in Botnet Security Alert on Sonicwall:

                            @jaredbusch said in Botnet Security Alert on Sonicwall:

                            @scottalanmiller said in Botnet Security Alert on Sonicwall:

                            @tim_g said in Botnet Security Alert on Sonicwall:

                            Latest news is saying a half million sized botnet is mining line to, and one of the targets are Linux SQL servers.

                            What's a Linux SQL server? Anything running a relational database? How do they target them?

                            I assumed that one meant Linux servers running MS SQL.

                            I had thought of that, but that seemed so unlikely.

                            Not really. I mean you know how good Windows people patch right?

                            That's true. But it seems like a worthless target. How many of these can there be yet?

                            ObsolesceO 1 Reply Last reply Reply Quote 0
                            • zachary715Z
                              zachary715 @Danp
                              last edited by

                              @danp said in Botnet Security Alert on Sonicwall:

                              Did you notify your bank?

                              Yes I did. It was forwarded to the mortgage department. Who knows what they'll do with it.

                              1 Reply Last reply Reply Quote 0
                              • ObsolesceO
                                Obsolesce @scottalanmiller
                                last edited by Obsolesce

                                @scottalanmiller said in Botnet Security Alert on Sonicwall:

                                What's a Linux SQL server?

                                Meaning an SQL server running on a Linux OS. I don't know if it's MySQL specific or not, so I didn't say it specifically. (yes I know MySQL can run on Windows too... I wish I didn't have to add so much detail all the time and risk everyone firing bullets as if I'm clueless)

                                I couldn't imagine his mortgage company running on Windows... so that's why I mentioned Linux, even though the botnet targets Windows too.

                                scottalanmillerS 1 Reply Last reply Reply Quote 0
                                • ObsolesceO
                                  Obsolesce @scottalanmiller
                                  last edited by

                                  @scottalanmiller said in Botnet Security Alert on Sonicwall:

                                  @jaredbusch said in Botnet Security Alert on Sonicwall:

                                  @scottalanmiller said in Botnet Security Alert on Sonicwall:

                                  @jaredbusch said in Botnet Security Alert on Sonicwall:

                                  @scottalanmiller said in Botnet Security Alert on Sonicwall:

                                  @tim_g said in Botnet Security Alert on Sonicwall:

                                  Latest news is saying a half million sized botnet is mining line to, and one of the targets are Linux SQL servers.

                                  What's a Linux SQL server? Anything running a relational database? How do they target them?

                                  I assumed that one meant Linux servers running MS SQL.

                                  I had thought of that, but that seemed so unlikely.

                                  Not really. I mean you know how good Windows people patch right?

                                  That's true. But it seems like a worthless target. How many of these can there be yet?

                                  Probably nothing outside of labs / testing.

                                  Why would you run MS SQL on Linux when an MS SQL license includes an OS license?
                                  Why would you run MS SQL on Linux when there are better options to run on Linux?

                                  scottalanmillerS 1 Reply Last reply Reply Quote 0
                                  • scottalanmillerS
                                    scottalanmiller @Obsolesce
                                    last edited by

                                    @tim_g said in Botnet Security Alert on Sonicwall:

                                    @scottalanmiller said in Botnet Security Alert on Sonicwall:

                                    What's a Linux SQL server?

                                    Meaning an SQL server running on a Linux OS. I don't know if it's MySQL specific or not, so I didn't say it specifically. (yes I know MySQL can run on Windows too... I wish I didn't have to add so much detail all the time and risk everyone firing bullets as if I'm clueless)

                                    I couldn't imagine his mortgage company running on Windows... so that's why I mentioned Linux, even though the botnet targets Windows too.

                                    It's just that those things aren't generic. The only thing that makes them similar is that they use relational math in the storing of the data. SQL is the query language, but not the protocol. for accessing them. So SQL servers aren't a group of things in any meaningful way.

                                    1 Reply Last reply Reply Quote 0
                                    • scottalanmillerS
                                      scottalanmiller @Obsolesce
                                      last edited by

                                      @tim_g said in Botnet Security Alert on Sonicwall:

                                      @scottalanmiller said in Botnet Security Alert on Sonicwall:

                                      @jaredbusch said in Botnet Security Alert on Sonicwall:

                                      @scottalanmiller said in Botnet Security Alert on Sonicwall:

                                      @jaredbusch said in Botnet Security Alert on Sonicwall:

                                      @scottalanmiller said in Botnet Security Alert on Sonicwall:

                                      @tim_g said in Botnet Security Alert on Sonicwall:

                                      Latest news is saying a half million sized botnet is mining line to, and one of the targets are Linux SQL servers.

                                      What's a Linux SQL server? Anything running a relational database? How do they target them?

                                      I assumed that one meant Linux servers running MS SQL.

                                      I had thought of that, but that seemed so unlikely.

                                      Not really. I mean you know how good Windows people patch right?

                                      That's true. But it seems like a worthless target. How many of these can there be yet?

                                      Probably nothing outside of labs / testing.

                                      Why would you run MS SQL on Linux when an MS SQL license includes an OS license?
                                      Why would you run MS SQL on Linux when there are better options to run on Linux?

                                      MS SQL licenses include an OS license?

                                      ObsolesceO 1 Reply Last reply Reply Quote 1
                                      • dbeatoD
                                        dbeato
                                        last edited by

                                        At some point they had a Locky infection as below:
                                        https://www.abuseipdb.com/check/208.91.197.46
                                        0_1517691872759_DeepinScreenshot_select-area_20180203160425.png

                                        1 Reply Last reply Reply Quote 1
                                        • dbeatoD
                                          dbeato
                                          last edited by

                                          https://otx.alienvault.com/indicator/ip/208.91.197.46

                                          1 Reply Last reply Reply Quote 0
                                          • ObsolesceO
                                            Obsolesce @scottalanmiller
                                            last edited by

                                            @scottalanmiller said in Botnet Security Alert on Sonicwall:

                                            @tim_g said in Botnet Security Alert on Sonicwall:

                                            @scottalanmiller said in Botnet Security Alert on Sonicwall:

                                            @jaredbusch said in Botnet Security Alert on Sonicwall:

                                            @scottalanmiller said in Botnet Security Alert on Sonicwall:

                                            @jaredbusch said in Botnet Security Alert on Sonicwall:

                                            @scottalanmiller said in Botnet Security Alert on Sonicwall:

                                            @tim_g said in Botnet Security Alert on Sonicwall:

                                            Latest news is saying a half million sized botnet is mining line to, and one of the targets are Linux SQL servers.

                                            What's a Linux SQL server? Anything running a relational database? How do they target them?

                                            I assumed that one meant Linux servers running MS SQL.

                                            I had thought of that, but that seemed so unlikely.

                                            Not really. I mean you know how good Windows people patch right?

                                            That's true. But it seems like a worthless target. How many of these can there be yet?

                                            Probably nothing outside of labs / testing.

                                            Why would you run MS SQL on Linux when an MS SQL license includes an OS license?
                                            Why would you run MS SQL on Linux when there are better options to run on Linux?

                                            MS SQL licenses include an OS license?

                                            Maybe not. I thought about it again and I think I got that mixed with System Center including an MS SQL license.

                                            scottalanmillerS 1 Reply Last reply Reply Quote 1
                                            • 1
                                            • 2
                                            • 1 / 2
                                            • First post
                                              Last post