Potentially Breached Entities (From Sensor Data) - 7-21-2014 11:19PM EST

The following host have been detected as being potentially breached based on data from SLC Security owned and operated sensors. We have decided that we would start publishing a daily list to help these organizations get their network under control. While we believe these host to be breached they may also be involved in hacking attempts on other entities or may be used by hackers as a jump point to conduct other attacks. The following list are the bad entities for the last 24 hours. Our volunteers have detected the following attackers:

• University of California - San Diego, CA (Multiple Systems Detected)
• Deluth Holiday Inn Gwinneth (Still owned)

An interesting note is that there is a node with reverse dns of fbi-vps hosted in the data center of Data Shack in North Kansas City, MO. Was also seen by 3 other companies in the last 24 hours according to our stats. 

Potentially Breached Entities (From Sensor Data) - 7-14-2014 1:32 AM EST

The following host have been detected as being potentially breached based on data from SLC Security owned and operated sensors. We have decided that we would start publishing a daily list to help these organizations get their network under control. While we believe these host to be breached they may also be involved in hacking attempts on other entities or may be used by hackers as a jump point to conduct other attacks. The following list are the bad entities for the last 24 hours. Our volunteers have detected the following attackers:

• American Industrial Partners - New York
• Micro-Globe ITS - Raleigh 

Well that's all for today... Hope your all having a great work week!

Potentially Breached Entities (From Sensor Data) - 7-6-2014 2:20 AM EST

The following host have been detected as being potentially breached based on data from SLC Security owned and operated sensors. We have decided that we would start publishing a daily list to help these organizations get their network under control. While we believe these host to be breached they may also be involved in hacking attempts on other entities or may be used by hackers as a jump point to conduct other attacks. The following list are the bad entities for the last 24 hours. Our volunteers have detected the following attackers:

• Kenrick-Glennon Seminary - Indications of Compromised Host - Multiple Sensors and Email Traffic

Potentially Breached Entities (From Sensor Data) - 7-5-2014 3:11 AM EST

The following host have been detected as being potentially breached based on data from SLC Security owned and operated sensors. We have decided that we would start publishing a daily list to help these organizations get their network under control. While we believe these host to be breached they may also be involved in hacking attempts on other entities or may be used by hackers as a jump point to conduct other attacks. The following list are the bad entities for the last 24 hours. Our volunteers have detected the following attackers:

• Atlas Professional Services - Florida - Brute Force and Scanning Activity
• American Credit Card - Comenity
• Global A Products Incorporated

Plus the usual chatter from Amazon Hosting., Shodan, etc. We really wish these entities would start to remove malicious clients from their networks. 

Potentially Breached Entities (From Sensor Data) - 7-4-2014 2:21 AM EST

The following host have been detected as being potentially breached based on data from SLC Security owned and operated sensors. We have decided that we would start publishing a daily list to help these organizations get their network under control. While we believe these host to be breached they may also be involved in hacking attempts on other entities or may be used by hackers as a jump point to conduct other attacks. The following list are the bad entities for the last 24 hours. Our volunteers have detected the following attackers:

• KM HOMES LLC - 74.11.11.66 - Seen attacking external networks

• University of Michigan College of Engineering - 141.212.122.66 - Reported multiple times (No action taken)

Analyst Note: Please note that the Univ of Michigan has been reported at least 20 times and they have not stopped the activity. If they don't care about being on blacklist and about their end users not being able to access Internet resources then we don't care if they are breached. We have attempted to help them resolve their issues on numerous occasions however they continue to deny they have any issue. You can lead a cow to water but they don't drink milk! (makes about as much sense as the responses we have received).

UPDATE: Apparently the Univ of Michigan thinks it's OK to scan host. Some farther review of the IP in question shows that the IP is a research scanning system. So that being said they are not breached however they are definitely not good Netizens with the mass scanning. A review of logs indicates that the Univ of Michigan is scanning web servers for vulnerabilities and some other very nasty behavior.


SLC Security Services LLC operates honeypot and inline sensors located in 74 locations. Our OSINT-X platform collects data and is available in our paid feed products. For more information visit www.slcsecurity.com.