Reputation Definitions

Reputation is an attribute of an IP address, host, domain, or URL.Stellar Cyber uses feeds from several threat intelligence providers (such as ET Pro, PhishTank, OpenPhish, abuse.ch, and others) as well as network traffic analysis to assign reputations. These reputations are visible in the Interflow as srcip_reputation and dstip_reputation, and in the event tables under the Source Reputation and Dest Reputation columns.

Following are the reputations in use, and their definitions.

Reputation	Definition
Activex	ActiveX attacks and vulnerabilities.
Abused TLD	Rogue TLD and GTLD activity that might be of interest. Limited to registrars who cannot or will not police their domains, and TLDs that lack accountability or are free. For example, ICANN cannot claim .su back from the Soviet Union, as that country no longer exists.
Attack Response	Indicates the results of a successful attack. For example, LMHost file download, certain banners, Metasploit Meterpreter kill command detected.
Bitcoin	Bitcoin clients running in the Bitcoin P2P network. This can help identify the rogue use of computing resources in Bitcoin mining operations.
Blackhole	A known black hole, this category often overlaps with CnC.
Bot, Botcc	Clear indications of unwanted or criminal code on the host, or a host checking in to a command and control server.
Botcc Portgrouped	Same as Botcc, but grouped by destination port.
Brute Forcer	Authentication brute forcing, such as SSH, IMAP, and VNC.
Chat, ChatServer	Chat activity, such as IRC, Jabber, Google Talk, MSN, AIM, ICQ, Baidu, or GaduGadu. Correlate this with CnC to identify networks used for CnC.
CIArmy	IP rules for blocking from Collective Intelligence .
CnC	Domains and IPs that are command & control for known Trojans. This reputation is for criminal command & control; spyware and user tracking domains are classified in SpywareCnC.
Compromised	Known compromised hosts, updated daily.
Current Events	Currently active campaigns expected to be short-lived, such as fraud related to a current natural disaster.
DDoS Attacker	Source of DDoS traffic.
DDoSTarget	Target of DDoS traffic, or commands to launch attacks.
Decoder-events	Normalization events related to decoding.
DNS	DNS attacks and vulnerabilities, which can include DNS tunneling.
DOS	Inbound Denial of Service activity, as well as outbound indications.
DriveBySrc	Sites used by an exploit kit like Neosploit or Blackhole, where HTML injection is used to redirect a browser to sites that deliver an exploit by java or some other method.
Drop	From the Spamhaus Don't Route Or Peer list, updated daily. A site where stolen data or credentials are being pushed. Excludes droppers being served or other .exe movement.
Dshield	DShield top attackers, updated daily.
DynDNS	A dynamic DNS entry or request host, or a domain using DynDNS.
EXE_Source	Serving an executable file. Can indicate CnC.
Exploit	Exploits not covered by other, specific categories.
FakeAV	Fake anti-spyware and anti-virus sites. Often overlaps with CnC.
Files	Example rules for Suricata file handling and extraction.
FTP	DNS attacks and vulnerabilities. Also logs basic activity, such as logins.
Games	Popular online games, such as Starcraft and WoW. Not malicious, just not necessarily appropriate.
Good	Does not have a reputation.
HTTP-Events	Logging of HTTP events, typically not malicious.
ICMP	ICMP attacks and vulnerabilities. Typically not malicious.
ICMP_info	Logging of ICMP events, typically not malicious.
IMAP	IMAP identification, attacks, and vulnerabilities. Also logs basic activity.
Inappropriate	Pornography. Not malicious, but not appropriate.
IPCheck	IP address and geolocation checking services. These public services can be abused by malware or DynDNS.
Malware	Malware and spyware tracking with no obvious criminal intent. Not criminal, but certainly undesired.
Misc	Miscellaneous things not covered in other categories.
Mobile Malware	Mobile malware and spyware tracking with no obvious criminal intent. Not criminal, but certainly undesired.
Netbios	NetBIOS identification, attacks, and vulnerabilities. Also logs basic activity.
OnlineGaming	Gaming sites that install a client to report or track user activity. Not necessarily criminal, but possibly of interest. This is different from outright spyware.
P2P	Clients and sources of file sharing, including Bittorrent, Gnutella, Kazaa, LimeWire, and Qvod. Not malicious, just not necessarily appropriate.
P2PCnC	P2P used as a CnC mechanism. Separated from P2P used for file sharing.
Parking	A parked domain or domain parking server.
Policy	Applications often disallowed by company or organization policy, such as DropBox, Google Apps, eBay, Facebook.
POP3	POP3 identification, attacks, and vulnerabilities. Also logs basic activity.
Proxy	Proxy endpoint for protocols such as HTTP, STUN, and SOCKS.
Remote Access Service	Remote access services such as Kaseya, GoToMyPC, and Citrix.
RPC	RPC identification, attacks, and vulnerabilities. Also logs basic activity.
SCADA	SCADA attacks and vulnerabilities. Also logs basic activity.
SCADA_special	Snort Digital Bond based SCADA preprocessor.
SCAN, Scanner	Vulnerability scanning, open relay scanning, network and service reconnaissance, or other scanning activity.
SelfSignedSSL	Self-signed or invalid SSL certificates, which can be suspicious.
Shellcode	Remote shell access to a machine on a local network.
SMTP	SMTP attacks and vulnerabilities. Also logs basic activity.
SMTP-events	SMTP operational logging.
SNMP	SNMP attacks and vulnerabilities. Also logs basic activity.
Spam	Blacklisted spam sources.
SpywareCnC	Servers and domains serving or tracking user activity. Not criminal, but could be of interest. Generally toolbars, rogue gaming, free screensavers, and such.
SQL	SQL attacks and vulnerabilities. Also logs basic activity.
Steam-events	TCP streaming events.
TELNET	Telnet attacks and vulnerabilities. Also logs basic activity.
TFTP	TFTP attacks and vulnerabilities. Also logs basic activity.
TLS-Events	TLS events and anomalies.
TOR, TorNode	Tor exit nodes and participants in the network.
Trojan	Clearly malicious software. Could be in transit, active, infecting, attacking, updating, or in any other state.
Undesirable	Hacking tool forums, metasploit updates, and such. Not criminal, but of interest.
User Agents	User agent identification and detection.
Utility	Known good services, such as Google search front ends, Bing, and others.
VOIP	VoIP attacks and vulnerabilities.
VPN	VPN concentrator. This is a potential anonymizing service.
Web Client	Web client attacks and vulnerabilities.
Web Server	Web server attacks and vulnerabilities.
Web Specific Apps	Specific web applications.
WORM	Indications of a worm in the network.