[ Team Cymru Community Services ] [ Team Cymru Commercial Services ] [ Dragon Research Group ]
RT @bl4ckh0l3z: 43rd TF-CSIRT meeting in #Rome #tfcsirt #terena #cert #securiry #poste #posteitaliane @TERENAorg @CSDistrict | firms start emailing users with gmails on 'the list' - kudos for being proactive, thats GREAT to see! http://t.co/9Ol1pGxrQu | One of the least problematic of these: "How to set a super tough password that you won’t forget" articles, simple too http://t.co/cH81gjafxB | Your configuration files are showing and it's "beyond trivial to find these"...oh, thats not cool http://t.co/f3mfO6Ncv1 | IronNet (+Ex-NSA chief) #hack patent either 'really fishy' or 'genuinely groundbreaking and totally not NSA related' http://t.co/tgRg2rqgVJ | bind9 security update you ought to read if wheezy, jessie and sid mean anything to you http://t.co/p7riiT49PT | BCS publishes new guide for security architects as the average UK big business breach cost becomes £600k - £1.15m http://t.co/3ClDQ9Ti7C | Google denies breach after hackers leak millions of user logins, states only 2% of credentials are valid http://t.co/Z3A1DsTTsf | Thai authorities reportedly to conduct mass surveillance of Thai internet users, targeting lèse majesté #infowar http://t.co/0J5TiqnmuX | Certificartions are always hotly debated in #infosec, and here are some good examples of test questions for students http://t.co/gMzZjq41Bg | got email from "Apple" about buying Lane Splitter via iTunes from odd device? it's not Apple it's the Kelihos botnet http://t.co/QYHIIzYzYD | Cyber loss survey: nearly half of online retailers reported losing some finance related data to #hackers over 12 mths http://t.co/CLc6O3WPeK | UK National Cyber Security Programme not delivering promised economic benefits, but positive overall says NAO report http://t.co/0QL3oi2zre | The #infoSec Aussies are coming, and it's going to be GREAT! AFP embeds cops worldwide in cybercrime fight http://t.co/mrv8AE9sq0 | How they fight DDoS attacks in Japan (...and it really seems to work) http://t.co/8jkucYCh6L | leaking leads to phishing leads to bad days as 5M Gmail emails and passwords reportedly leaked online http://t.co/zBl05yY8xz | Home Depot Data Breach Confirmed, since April, but claims no PINs for debit cards taken http://t.co/VxdwcOXPkQ | Great read: phishing #pentest against an OS X heavy firm with lot's of Cloud, indeed: "All you need is one" http://t.co/YuZwrmXNSm | one of our favorite tools takes a tumble: Enigmail PGP plugin forgets to encrypt mail sent as Bcc, oh noes :( http://t.co/NXqTbjWJz1 | One of the best #infosec #privacy tools out there today: Tails 1.1.1: The Amnesic Incognito Live System=a live OS http://t.co/JkX6uA871N | BRIC #hackers use Tor, QQ and weekends and in the evening to supplement their day jobs? Hmm, interesting conclusions http://t.co/1FA7B6OTyV | interesting interview with a mobile phone #forensics specialist http://t.co/eHW9TaSdwo | Seeding Craigslist with laptop ads reveals that just five gangs in Nigeria are behind most Craigslist buyer scams http://t.co/n64JiDLPGp | 8 of the Best Online Security Dashboards...and some of them are really cool http://t.co/n40FCkW41j | AnonIB site, original source of hacked naked celebrity photos, is now down for (permanent?) 'maintenance' http://t.co/UoG9NHlmp5 | Barclays goes big on biometrics with vein-scanners and voice recognition authentication for some customers http://t.co/7hf6yVQP5M | Twitter to pay users $140 for finding security flaws which will buy a handful of coffees at least http://t.co/Xr7pYDGpmU | and the battle rages on: 'Malware Bypasses Chrome Extension Security Feature' http://t.co/sgq2dPqVW9 | #infosec tool: Arachni v1.0=feature-full, modular, high-performance Ruby framework for #pentesting web apps http://t.co/36wCYPMh9h | F-Secure on the new Windows Phone 8.1 feature that allows your phone contacts to access your Wi-Fi, seriously? http://t.co/N6FtgQO1Gj
Team Cymru - SOHO Pharming Update YouTube RSS Feed Twitter

Recent Data

[ Data Page 1 ] [ Data Page 2 ] [ Data Page 3 ] [ Data Page 4 ] [ Data Page 5 ]

Top 10 TCP Ports (logarithmic scale)

This chart shows the top 10 TCP ports seen in sampled global Internet traffic in our most recent hourly data sample. This chart is on a logarithmic scale, so the difference between the top port (usually TCP/80) and the bottom port may be more significant than it appears to the naked eye.

View all available monitoring graphs

Sampled Internet Traffic Rate (hourly)

We receive sampled and generalized information about Internet traffic flow rates from many partners, and this chart reflects those rates over the past week, aggregated hourly. This is by no means the "full speed" of the Internet, but a way of seeing trends and patterns within the overall mix of traffic.

View all available monitoring graphs

Bot Activity, Top 10 Countries

This chart lists the top 10 countries seen contributing to botnet activity online in the last 24 hours, as a percentage relative to total malicious activity in the same period. IP geolocation isn't perfect, so this data isn't exact, but we believe it should be representative of the current global picture.

View all available monitoring graphs

Sampled DNS Request Rate (hourly)

Our insight into Internet traffic around the globe allows us to sample and estimate trends in Domain Name System (DNS) requests, one of the key pieces of Internet infrastructure. This chart provides a glimpse into that sampled rate over the course of seven days, aggregated hourly, for both TCP and UDP DNS requests (though the TCP request rate is so low as to be virtually impossible to see).

View all available monitoring graphs

Internet Malicious Activity Maps

Internet Malicious Activity Hilbert Map The map to the left shows network locations of malicious activity on the Internet within the past 30 days, plotted using a Hilbert curve. Check out our Internet Malicious Activity Maps page for full details and a larger view of this and other maps.

Recent Releases

Our contribution to Operation Ghost Click

[17 NOV 2011] On 09 November 2011, US law enforcement released details of a major series of arrests as part of Operation Ghost Click. Team Cymru is proud to have been able to add details of victim computers that were part of this criminal infrastructure into one of our daily feeds of data that is provided at no cost to providers around the world. These lists of affected IP addresses enable network managers to identify and remediate computers infected by malware that are taking part in criminal activities.

This has a direct impact on people: it disrupts criminals and improves the lives of legitimate Internet users everywhere; we're honored to have been able to contribute to this effort. Our great thanks to all who contributed to this team effort.

Details of the case and our commentary can be found in this darkreading.com article. Images of the data we provided to our partners can be found via Twitter here and here.

Unexpected and unsubstantiated blog post

[25 OCT 2011] A recent blog post appeared to draw the unsubstantiated conclusion that more than 760 organizations were compromised with some of the same resources used to hit RSA earlier this year. Team Cymru was one of the organizations named in the posting.

We have no evidence of compromise related to incidents at RSA or anywhere else. The source of the report, and those who revealed and posted it, didn't take the time to contact us, or to share incident details with us. Thus we are unable to investigate further. We hope that those who gathered this data will responsibly disclose it to the potential victims.

Please note that without more details on the methodology used to determine the list of organizations, and a scientific review of the same, it's not safe to assume that an entry on the list means either "victim" or "false positive". We've seen no data or methodology description that would support either case.

New Underground Insight: A Criminal Perspective on Exploit Packs

[05 MAY 2011] The Team Cymru Business Intelligence Team is pleased to announce the release of their latest paper, entitled "A Criminal Perspective on Exploit Packs". This paper chronicles the genesis and historical eveolution of the Browser Exploit Pack (BEP). We discuss our research into the installation and usage of 40 different packs. Most notably, the paper discusses dishonor among coding thieves and the entrenched practice of "statistics shaving". Finally, we examine the monetization, code protection, and overall effectiveness of the various packs. For full details, check out the whitepaper, and don't forget to look at the rest of our whitepapers as well!

Team Cymru moving to Florida

[04 MAY 2011] Team Cymru today announced that they are relocating their headquarters staff from Chicago, Illinois, to Central Florida over the summer. The majority of our Chicago staff will move and are excited at the prospect of continuing to use our insight to improve lives, but from a significantly warmer location.

We do not forsee any disruption to our community or commercial feeds and services during this transition and we will continue to update our partners with news as appropriate. If you have any questions or concerns in the meantime, please e-mail outreach@cymru.com and we will be happy to discuss them with you!

View older news items in our news archives.

Friends of Team Cymru  
  CSIRT-MU DomainSponsor Dyn, Inc. F-Secure  
  FIRST GoDaddy.com Interoute Communications Oversee.net GOVCERT-LU  
  REN-ISAC Savvis Communications Support Intelligence Tata Communications Verizon Business INTECO CERT  

Team Cymru Community Services