Saturday, March 20, 2010
Koobface May Be Mutating
Followers of my Proxy Project may have noticed a tremendous increase in the past few weeks of the number of active Koobface proxies in the wild.
They have become so widespread in the USA that I had to include a warning about them on my proxy list.
Koobface proxies are widely known to use TCP port 8085. However since the beginning of March I have seen a new trend of proxies listening on port 2479.
And by "trend" I mean an average of over 900 new proxies per week since March 3rd in the USA alone (the USA is Koobface's #1 "market").
This may be a new strategy by the KK (Koobface Korp) or it may be an entirely new botnet being set up.
We live in interesting times, boys and girls!