Re: [nznog] New Conficker Reports based on ASN and Country

Message: 3 Date: Wed, 16 Dec 2009 18:48:56 -0800 From: "Barry Raveendran Greene" To: Subject: [nznog] New Conficker Reports based on ASN and Country Message-ID: <001901ca7ec3$81a8b440$84fa1cc0$@org> Content-Type: text/plain; charset="us-ascii"

Hello Team,

Shadowserver has new Conficker reports. This was instigated by internal Conficker Working Group dialog. We are now set up to really see if remediation is effective. As you can see in the data, Conficker is still growing (A & B). This is concerning, which some are now starting to express ...

The report also has a country level listing by ASNs. It is not perfect, but it makes it easier to see how New Zealand is doing:

http://www.shadowserver.org/wiki/pmwiki.php/Infections/Conficker-NZ

Just to note that stats for AS38437 (WIC NZ) are being mis-reported by this service. They are including adjacent IP netblocks (in this case 120.89.79.0) rather than just the prefixes that we originate. So while we have normal background activity (from our own tracking), Conficker C stats are showing as 3%+, which would be cause for concern (I've had 3 people contact me about this in the last couple of days), but isn't actually happening. I've sent comment to the guys at Shadowserver, but it is worth signing up for the reports, even just to check that things are being reported correctly. Regards, Stu