Once a hacker infects a server, the hacker controls the server’s IP address with commands to run C2 malicious codes or remote control protocols. IP addresses that were classified as Remote on Criminal IP ( ) are those with open port 22 (SSH) and 3389 (RDP). Conducting DDoS Attack Through Remote Control IP Address IP Address Category that displays the malicious history of an IP address from the DDoS attack case.

The corresponding IP address’ various malicious traces were found as it was categorized into KISA’s DDoS IP, Fail2ban’s Brute force IP, and even spam mail in the IP Address Category section. That’s why hackers are frequently scanning open SMB ports worldwide.īecause these IP addresses are infected by malicious codes, they can initiate other cyber attacks under the command of other than SMB Worm like C2 servers. Once hackers confirm that the SMB ports are open and successfully negotiate, they use brute force attack to obtain personal information from the PC and access the server IP. SMB is a file/printer sharing protocol, which allows computers with assigned network names and IP addresses to communicate via NetBIOS running over NBT protocol. As the following image shows, SMB negotiation was requested from this IP address around Jat 3:35 pm and Jat 8:52 pm, meaning it was infected by SMB Worm and performed SMB scanning periodically. What we first noticed from this DDoS attack case is that the vast majority of the IP addresses were classified as Scanner. Criminal IP Score result of 6,972 IP addresses used in the DDoS attack SMB Worm Infected IP Addresses Used in the Attack

Attack an ip address