Active Inbound Connection From Host Listed in Known Bot Database

info Nessus Plugin ID 59713

Language:

Synopsis

According to a third-party database, the remote host is receiving an inbound connection from a host that is listed as part of a botnet.

Description

This plugin has been temporarily disabled.

According to the output from netstat, the remote host has an inbound connection from one or more hosts that are listed in a public database as part of a botnet.

Solution

Determine which services the botnet hosts are connected to, and investigate further if necessary.

Plugin Details

Severity: Info

ID: 59713

File Name: ipthreat_lookup_netstat_inbound.nasl

Version: 1.7

Type: local

Agent: windows, macosx, unix

Family: General

Published: 6/26/2012

Updated: 8/14/2018

Supported Sensors: Nessus Agent, Nessus

Vulnerability Information

Required KB Items: botnet_traffic/inbound/report

Detections

Analytics