N
N
Nabi Alimetov2016-01-30 10:49:35
Computer networks
Nabi Alimetov, 2016-01-30 10:49:35

How to permanently remove an ip-address from the blacklist on the site www.abuseat.org?

Hello! Recently, mail has ceased to leave the local network. When you try to send, you get a message that the ip address is blocked on the site www.abuseat.org. On the site itself, they write about this:
his IP is infected with, or is NATting for a machine infected with Win32/Dorkbot
This was detected by observing this IP attempting to make contact to a Win32/Dorkbot Command and Control server, with contents unique to Win32/Dorkbot C&C command protocols.
Win32/Dorkbot is a worm, and can travel to infect other computers via Instant Messaging, Twitter, Facebook and even USB drives.
Once installed, it gets involved with clickfraud, and can act as "ransomware" - locking the user out of their computer or encrypting the contents until the user pays a "ransom".
This was detected by a TCP/IP connection from MY_IP on port 20389 going to IP address 192.42.116.41 (the sinkhole) on port 3720.
The botnet command and control domain for this connection was "n.hmiblgoja.ru".
Has anyone encountered this problem?

Answer the question

In order to leave comments, you need to log in

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question