View Single Post
jeffgrant jeffgrant is offline
Registered
 
jeffgrant's Avatar
 
Join Date: Mar 2005
Location: London, ON, Canada
Posts: 1,737
Re: cyber sleuth some IPs for me

Quote:
Originally posted by Sonic dB
3 seperate log ins...all from this company, which makes
virus software....hmmm thats very intersting.
I'm sure you meant anti-virus.


FYI, most of this spidering is done using viruses and malware.

Anti-virus companies, among others, usually operate what are called "honeypots", which basically attract and incubate viruses/malware so that they can be studied, dissected, and an anti-virus developed.

Wikipedia description here: http://en.wikipedia.org/wiki/Honeypot_%28computing%29


Odds are that in the normal process of the virus doing it's thing, it happened to have you in it's sights, but it just happened to be running from within an anti-virus company's honeypot... or they actually have some infected computers in their network. (Cobbler's children and all that).

Most larger anti-virus companies that I've worked with in the past (I do Internet security "stuff" for banks and governments, among other things) usually keep their honeypots Internet location (IP's) as a closely guarded secret, so that it's not easily detectable. This is because some high-tech, uber-smart virus writers make their code NOT go there so that their creations can last a little longer in the wild. Having those boxes be configured in reverse DNS is kind of a "beginner's mistake", if you will.

Last edited by jeffgrant; 02-27-2007 at 03:28 AM..
Old 02-27-2007, 03:12 AM
  Pelican Parts Catalog | Tech Articles | Promos & Specials    Reply With Quote #3 (permalink)