eXploits Blocklist (XBL) - Why was this IP address listed?

The machine using this IP is infected with malware that is emitting spam, or is sharing a connection with an infected device.

As a result, this IP address is listed in the eXploits Blocklist (XBL)

Show Details

44.192.26.226 is listed on the Spamhaus XBL

Why was this IP listed?

A device using 44.192.26.226 is infected with malware:

44.192.26.226 initiated contact with a matsnu command and control server, using contents unique to matsnu C&C command protocols.

Technical details of the matsnu detection

44.192.26.226 initiated a tcp connection from 44.192.26.226 using source port 38516, to the sinkhole IP address 216.218.185.162 on destination port 80.

The most recent detection was on: September 12 2024, 00:37:05 UTC.

Information about the matsnu botnet

matsnu - also known as "Trustezeb" is a trojan that targets the Microsoft Windows operating system. It can perform different commands such as remotely downloading and executing files, updating itself and its C&C server, and also can be used as ransomware.

Additional information on matsnu can be found by doing a web search.

What should be done about it?

If this is a shared server, please call your hosting company or ISP!

This listing is the result of what we believe to be a security issue. To stop ongoing listings and to secure your network, devices, and data, we recommend both prevention and remediation of the issue.

Prevention

Spamhaus has an FAQ about general security best practices that should be followed.

Remediation

To find and remove the malware from your Windows computer please see the Microsoft website.

XBL listings expire automatically after the last detection. If necessary, once the security issue is solved, you can update an existing ticket to request removal.

44.192.26.226 has 1 listing