I get abuse reports like that - my exit is not yet officially recognised as an exit so is curretly seen as the source of the attack - its unlikely your server is infected its just the traffic from your exit - especially as you using port 443 - just send standard abuse template to them if its a problem for the isp
U could always install clamav and do a quick check on your server if u think its necessary
regards
Mark B
On 7 Dec 2016, at 14:09, Volker Mink volker.mink@gmx.de wrote:
hey folks.
i got an abuse-information from my provider, please see details attached. could this propably be caused by some malware on my tor exit?
Any ideas on this?
Best, volker
https://unity.abusehq.net/share/gFraliWxA_A-0uCFJvSxAkPRxYn536JoReAkl2MNUuCq...
MAC Address IP
f07959d25289 109.90.11.123
Date:
06.12.2016 11:16
Type:
bot-infection
Reporter:
security@libertyglobal.com
IP address:
109.90.11.123
Incident part:
malware family: virut
destination ip: 148.81.111.121
destination port: 80
feeder: team cymru
description: This host is most likely infected with malware.
Date:
05.12.2016 10:00
Type:
malware
Reporter:
reports@reports.cert-bund.de
IP address:
109.90.11.123
Incident part:
malware: urlzone
destination ip: 64.71.166.50
destination port: 443
destination hostname: didnadinka.net
asn: 6830
Date:
02.12.2016 19:16
Type:
bot-infection
Reporter:
security@libertyglobal.com
IP address:
109.90.11.123
Incident part:
malware family: zeus
destination ip: 87.106.18.112
http request: /config
destination port: 80
destination domain name: mabqg.com
feeder: shadowserver
report type: botnet_drone
description: This host is most likely infected with malware.
<smime.p7s> _______________________________________________ tor-relays mailing list tor-relays@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays
tor-relays@lists.torproject.org
-
Sec INT -
Volker Mink