{"id":3618,"date":"2014-02-13T13:27:27","date_gmt":"2014-02-13T13:27:27","guid":{"rendered":"https:\/\/live-infoblox-blog.pantheonsite.io\/?p=3618"},"modified":"2020-05-06T10:31:36","modified_gmt":"2020-05-06T17:31:36","slug":"kelihos-botnet","status":"publish","type":"post","link":"https:\/\/www.infoblox.com\/blog\/community\/kelihos-botnet\/","title":{"rendered":"Kelihos Botnet"},"content":{"rendered":"<p>The Kelihos botnet, also known as Hlux, is a botnet mainly involved in spamming and the theft of Bitcoins. Due to its spam activity, Kelihos is also referred to as a spambot. In September 2011 and March 2012, the bot was shut down by sink-holing its Command and Control (CnC) IPs, but after each shutdown a new variation has arisen and replaced the old botnet. Today\u2019s version is Kelihos.c.<\/p>\n<h3 id=\"toc-hId--1902368745\">Targets<\/h3>\n<p>The Kelihos.c version mostly infects computers through Facebook by sending users of the website malicious download links. As of today, the active version of the botnet, Kelihos.c, has infected an estimated 70,000 computers.<\/p>\n<h3 id=\"toc-hId--1873739594\">Technical details<\/h3>\n<p>When the Kelihos botnet was first discovered around December 2010, it was capable of sending an estimated 4 billion spam messages per day. It was shut down in September 2011. In January 2012, a new version of the botnet was discovered. This version was shut down in March 2012, but an updated version surfaced within months. Kelihos.c sends Facebook users malicious download links. Once clicked, a Trojan horse named Fifesoc is downloaded, which turns the computer into part of the botnet.<\/p>\n<p>The Kelihos botnet has peer-to-peer capabilities, where individual botnet nodes are capable of relaying command received from the CnC servers. This way, any node can effectively act as a CnC server for the entire botnet. This makes it more difficult to shut down than a traditional botnet.<\/p>\n<p>The first version of the botnet was mainly involved in denial-of-service attacks and email spam, while version two of the botnet added the ability to steal Bitcoin wallets, as well as a program used to mine Bitcoins itself. The most recent version has the following capabilities:<\/p>\n<ul>\n<li>The bot is capable of infecting flash drives, creating a file on them called \u201cCopy a Shortcut to google.Ink\u201d in the same way Stuxnet did.<\/li>\n<\/ul>\n<p>The bot can search for configuration files for numerous FTP clients and transfer them to its command servers.<\/p>\n<ul>\n<li>The bot has a built-in Bitcoin wallet theft feature.<\/li>\n<li>The bot also includes a Bitcoin miner feature.<\/li>\n<\/ul>\n<p>Back in March 2012, Kelihos used a huge list of different domain names to spread itself. In summer 2012 the Kelihos operators switched from Europe TLD (.eu) to Russian TLD (.ru). All mentioned domain names are registered through the same Russia-based registrar, REGGI-RU.<\/p>\n<p>The domain names themselves use double FastFlux. With this technique, Bots not only flux their IP addresses but also flux the IP addresses of the DNS name servers that serve the IP addresses for the queried FQDNs (fully-qualified-domain-names). This makes it very hard to detect as the IP addresses on both sides are constantly changing.<\/p>\n<p>The following is an example of a trace from one of the random domains used by Kelihos.c. The name servers can be seen hosted on different FastFlux networks. Notice the various randomly distributed IPs used by the name servers; in most networks, the name servers are in one or two IP clusters owned by the same entity and have proper reverse DNS names.<\/p>\n<p>A records for pevhyvys.ru:<\/p>\n<pre>67.177.139.18 [c-67-177-139-18.hsd1.mi.comcast.net.]\r\nDelegated name servers for pevhyvys.ru:\r\nns2.biocruc.com.\r\n-&gt; 114.43.101.84 [114-43-101-84.dynamic.hinet.net.]\r\nns4.systeat.com.\r\n-&gt; 67.177.139.18 [c-67-177-139-18.hsd1.mi.comcast.net.]\r\nns6.systeat.com.\r\n-&gt; 71.205.242.35 [c-71-205-242-35.hsd1.mi.comcast.net.]\r\nns3.biocruc.com.\r\n-&gt; 50.130.45.53 [c-50-130-45-53.hsd1.ms.comcast.net.]\r\nns5.systeat.com.\r\n-&gt; 69.132.69.185 [cpe-069-132-069-185.carolina.res.rr.com.]\r\n<\/pre>\n<h3 id=\"toc-hId--1845110443\">How existing security defenses are circumvented<\/h3>\n<p>Local detection mechanisms such as antivirus software detect only certain known strains of this malware. The malware keeps changing, and it takes time to develop and distribute detection patterns. By the time a new strain is detected, the malware might have mutated again.<\/p>\n<p>Kelihos also has a low detection rate by the majority of antivirus scanners due to the compression and encryption techniques being applied to the newly created backdoor droppers.<\/p>\n<p>Finally, Kelihos\u2019 owners actively update the botnet. It has been shut down twice and both times it has come back in a new form.<\/p>\n<h3 id=\"toc-hId--1816481292\">How Infoblox can help protect against this attack<\/h3>\n<h4 id=\"toc-hId--45041806\"><em>ATTACKED AND INFECTED? &#8211; DISRUPT COMMUNICATION TO THE INTERNET<\/em><\/h4>\n<p>Infoblox DNS Firewall is an application run on an Infoblox DNS server. It will disrupt malware communication by not resolving DNS queries for botnets and CnC servers. All resolved DNS queries are compared to a continually updated table of \u2018bad\u2019 domains and IP addresses with which communication should not be allowed. Resolved DNS queries to malicious domains and IP addresses are either blocked or redirected.<\/p>\n<p>DNS Firewall Subscription Service updates DNS Firewall servers every 2 hours with updated information on domains and IP addresses (networks) that make up the Kelihos infrastructure.<\/p>\n<p>Additionally, DNS Firewall has integration with the FireEye NX series APT appliances that detects any new Kelihos malware strains and constantly updates the DNS Firewall with new list of domains (or IPs) to be blocked.<\/p>\n<p>If the Infoblox DHCP and Reporting server is installed, network administrators can pinpoint the infected devices by IP and MAC address, device type (DHCP fingerprinting), Host name (if configured) and DCHP lease history (on\/off network).<\/p>\n<h4 id=\"toc-hId--16412655\"><em>BASICS &#8211; AVOIDING INFECTION<\/em><\/h4>\n<p>Network administrators can also use the following techniques to lessen the chances of a Kelihos infection and reduce the damage if one occurs:<\/p>\n<ul>\n<li>Patch Windows by running Windows Update to avoid exploitation through vulnerability CVE-2010-2568.<\/li>\n<li>Always use the latest version of an actively maintained browser.<\/li>\n<li>Use port security to limit the use of removable drives and prevent Kelihos from spreading through USB sticks.<\/li>\n<li>Kelihos is using port 80 (HTTP standard port) to communicate with the P2P drones. Restrict outbound connections to port 80 TCP (HTTP) and implement a web proxy with protocol inspection capabilities to prevent non-HTTP and non-HTTPs traffic that tries to go through the proxy.<\/li>\n<li>Restrict outbound SMTP connections (port 25 TCP) to prevent Kelihos from sending out spam mails.<\/li>\n<li>Restrict access to domain names identified as FastFlux: domains hosted on highly dynamic IP addresses and\/or DNS servers that are hosted on dynamic IP addresses.<\/li>\n<\/ul>\n<h3 id=\"toc-hId--1730593839\">External sources<\/h3>\n<ul>\n<li><a href=\"http:\/\/news.cnet.com\/8301-27080_3-57405527-245\/110000-pc-strong-kelihos-botnet-sidelined\/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">110,000 PC-strong Kelihos botnet sidelined<\/a>, by C-net<\/li>\n<li><a href=\"http:\/\/research.zscaler.com\/2013\/08\/kelihos-botnet-what-victims-can-expect.html\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">xKelihos botnet: What victims can expect<\/a>, by zscaler<\/li>\n<li><a href=\"http:\/\/www.lavasoft.com\/mylavasoft\/malware-descriptions\/blog\/update-on-kelihos-botnet-august-2013\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">UPDATE ON KELIHOS BOTNET<\/a>\u00a0(AUGUST 2013), by LavaSoft<\/li>\n<li><a href=\"http:\/\/www.abuse.ch\/?p=4878\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">A Quick Update on Spambot Kelihos<\/a>, by abuse.ch<\/li>\n<li><a href=\"http:\/\/www.itpro.co.uk\/638476\/microsoft-suspects-ex-antivirus-worker-of-kelihos-botnet-creation\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">Microsoft suspects ex-antivirus worker of Kelihos botnet creation<\/a>, by ITPro<\/li>\n<li><a href=\"http:\/\/www.theverge.com\/2012\/3\/29\/2910450\/second-kelihos-botnet-disabled-by-security-experts\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">Second Kelihos botnet downed, 116,000 machines freed<\/a>, by The Verge<\/li>\n<li><a href=\"https:\/\/blogs.technet.com\/b\/microsoft_blog\/archive\/2011\/09\/27\/microsoft-neutralizes-kelihos-botnet-names-defendant-in-case.aspx\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">Microsoft Neutralizes Kelihos Botnet, Names Defendant in Case<\/a>, by The Official Microsoft Blog<\/li>\n<li><a href=\"http:\/\/www.shadowserver.org\/wiki\/pmwiki.php\/Calendar\/20101230\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">New Fast Flux Botnet for the Holidays: Could it be Storm Worm 3.0\/Waledac 2.0?,<\/a>\u00a0by Shadow Server<\/li>\n<li><a href=\"http:\/\/www.spamfighter.com\/News-17598-Security-Companies-Take-Down-Kelihos-Botnet-of-Version-2.htm\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">Security Companies Take Down Kelihos Botnet of Version 2,<\/a>\u00a0by Spamfighter<\/li>\n<li><a href=\"http:\/\/arstechnica.com\/business\/2012\/02\/slain-kelihos-botnet-still-spams-from-beyond-the-grave\/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">\u201cSlain\u201d Kelihos botnet still spams from beyond the grave<\/a>, by ars technica<\/li>\n<li><a href=\"http:\/\/news.techworld.com\/security\/3334428\/kelihos-botnet-cranks-back-up-after-microsoft-attack\/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">Kelihos botnet cranks back up after Microsoft attack by<\/a>, by TechWorld<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>The Kelihos botnet, also known as Hlux, is a botnet mainly involved in spamming and the theft of Bitcoins. Due to its spam activity, Kelihos is also referred to as a spambot. In September 2011 and March 2012, the bot was shut down by sink-holing its Command and Control (CnC) IPs, but after each shutdown [&hellip;]<\/p>\n","protected":false},"author":295,"featured_media":1478,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[3],"tags":[16,15],"class_list":{"0":"post-3618","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-community","8":"tag-infoblox","9":"tag-security","10":"entry"},"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v27.3 (Yoast SEO v27.3) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>Kelihos Botnet<\/title>\n<meta name=\"description\" content=\"The Kelihos botnet, also known as Hlux, is a botnet mainly involved in spamming and the theft of Bitcoins. Due to its spam activity, Kelihos is also referred to as a spambot.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.infoblox.com\/blog\/community\/kelihos-botnet\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Kelihos Botnet\" \/>\n<meta property=\"og:description\" content=\"The Kelihos botnet, also known as Hlux, is a botnet mainly involved in spamming and the theft of Bitcoins. Due to its spam activity, Kelihos is also referred to as a spambot.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.infoblox.com\/blog\/community\/kelihos-botnet\/\" \/>\n<meta property=\"og:site_name\" content=\"Infoblox Blog\" \/>\n<meta property=\"article:published_time\" content=\"2014-02-13T13:27:27+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2020-05-06T17:31:36+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/community-banner-11.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"725\" \/>\n\t<meta property=\"og:image:height\" content=\"483\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Infoblox Security\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Infoblox Security\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/community\\\/kelihos-botnet\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/community\\\/kelihos-botnet\\\/\"},\"author\":{\"name\":\"Infoblox Security\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#\\\/schema\\\/person\\\/5f422bb7a06be93cb128df08840ca8bf\"},\"headline\":\"Kelihos Botnet\",\"datePublished\":\"2014-02-13T13:27:27+00:00\",\"dateModified\":\"2020-05-06T17:31:36+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/community\\\/kelihos-botnet\\\/\"},\"wordCount\":1047,\"publisher\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/community\\\/kelihos-botnet\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/wp-content\\\/uploads\\\/community-banner-11.jpg\",\"keywords\":[\"Infoblox\",\"Security\"],\"articleSection\":[\"Community\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/community\\\/kelihos-botnet\\\/\",\"url\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/community\\\/kelihos-botnet\\\/\",\"name\":\"Kelihos Botnet\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/community\\\/kelihos-botnet\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/community\\\/kelihos-botnet\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/wp-content\\\/uploads\\\/community-banner-11.jpg\",\"datePublished\":\"2014-02-13T13:27:27+00:00\",\"dateModified\":\"2020-05-06T17:31:36+00:00\",\"description\":\"The Kelihos botnet, also known as Hlux, is a botnet mainly involved in spamming and the theft of Bitcoins. Due to its spam activity, Kelihos is also referred to as a spambot.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/community\\\/kelihos-botnet\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/community\\\/kelihos-botnet\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/community\\\/kelihos-botnet\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/wp-content\\\/uploads\\\/community-banner-11.jpg\",\"contentUrl\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/wp-content\\\/uploads\\\/community-banner-11.jpg\",\"width\":725,\"height\":483,\"caption\":\"Computer crime concept\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/community\\\/kelihos-botnet\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Community\",\"item\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/category\\\/community\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Kelihos Botnet\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/\",\"name\":\"infoblox.com\\\/blog\\\/\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#organization\",\"name\":\"Infoblox\",\"url\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/wp-content\\\/uploads\\\/infoblox-logo-2.svg\",\"contentUrl\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/wp-content\\\/uploads\\\/infoblox-logo-2.svg\",\"width\":137,\"height\":30,\"caption\":\"Infoblox\"},\"image\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#\\\/schema\\\/person\\\/5f422bb7a06be93cb128df08840ca8bf\",\"name\":\"Infoblox Security\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/6b1d72646d45388569e0b1577b53b561494422a95e656789193ef414ac7c7027?s=96&d=blank&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/6b1d72646d45388569e0b1577b53b561494422a95e656789193ef414ac7c7027?s=96&d=blank&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/6b1d72646d45388569e0b1577b53b561494422a95e656789193ef414ac7c7027?s=96&d=blank&r=g\",\"caption\":\"Infoblox Security\"},\"url\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/author\\\/isecurityteam\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Kelihos Botnet","description":"The Kelihos botnet, also known as Hlux, is a botnet mainly involved in spamming and the theft of Bitcoins. Due to its spam activity, Kelihos is also referred to as a spambot.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.infoblox.com\/blog\/community\/kelihos-botnet\/","og_locale":"en_US","og_type":"article","og_title":"Kelihos Botnet","og_description":"The Kelihos botnet, also known as Hlux, is a botnet mainly involved in spamming and the theft of Bitcoins. Due to its spam activity, Kelihos is also referred to as a spambot.","og_url":"https:\/\/www.infoblox.com\/blog\/community\/kelihos-botnet\/","og_site_name":"Infoblox Blog","article_published_time":"2014-02-13T13:27:27+00:00","article_modified_time":"2020-05-06T17:31:36+00:00","og_image":[{"width":725,"height":483,"url":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/community-banner-11.jpg","type":"image\/jpeg"}],"author":"Infoblox Security","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Infoblox Security","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.infoblox.com\/blog\/community\/kelihos-botnet\/#article","isPartOf":{"@id":"https:\/\/www.infoblox.com\/blog\/community\/kelihos-botnet\/"},"author":{"name":"Infoblox Security","@id":"https:\/\/www.infoblox.com\/blog\/#\/schema\/person\/5f422bb7a06be93cb128df08840ca8bf"},"headline":"Kelihos Botnet","datePublished":"2014-02-13T13:27:27+00:00","dateModified":"2020-05-06T17:31:36+00:00","mainEntityOfPage":{"@id":"https:\/\/www.infoblox.com\/blog\/community\/kelihos-botnet\/"},"wordCount":1047,"publisher":{"@id":"https:\/\/www.infoblox.com\/blog\/#organization"},"image":{"@id":"https:\/\/www.infoblox.com\/blog\/community\/kelihos-botnet\/#primaryimage"},"thumbnailUrl":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/community-banner-11.jpg","keywords":["Infoblox","Security"],"articleSection":["Community"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.infoblox.com\/blog\/community\/kelihos-botnet\/","url":"https:\/\/www.infoblox.com\/blog\/community\/kelihos-botnet\/","name":"Kelihos Botnet","isPartOf":{"@id":"https:\/\/www.infoblox.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.infoblox.com\/blog\/community\/kelihos-botnet\/#primaryimage"},"image":{"@id":"https:\/\/www.infoblox.com\/blog\/community\/kelihos-botnet\/#primaryimage"},"thumbnailUrl":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/community-banner-11.jpg","datePublished":"2014-02-13T13:27:27+00:00","dateModified":"2020-05-06T17:31:36+00:00","description":"The Kelihos botnet, also known as Hlux, is a botnet mainly involved in spamming and the theft of Bitcoins. Due to its spam activity, Kelihos is also referred to as a spambot.","breadcrumb":{"@id":"https:\/\/www.infoblox.com\/blog\/community\/kelihos-botnet\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.infoblox.com\/blog\/community\/kelihos-botnet\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.infoblox.com\/blog\/community\/kelihos-botnet\/#primaryimage","url":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/community-banner-11.jpg","contentUrl":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/community-banner-11.jpg","width":725,"height":483,"caption":"Computer crime concept"},{"@type":"BreadcrumbList","@id":"https:\/\/www.infoblox.com\/blog\/community\/kelihos-botnet\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.infoblox.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Community","item":"https:\/\/www.infoblox.com\/blog\/category\/community\/"},{"@type":"ListItem","position":3,"name":"Kelihos Botnet"}]},{"@type":"WebSite","@id":"https:\/\/www.infoblox.com\/blog\/#website","url":"https:\/\/www.infoblox.com\/blog\/","name":"infoblox.com\/blog\/","description":"","publisher":{"@id":"https:\/\/www.infoblox.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.infoblox.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.infoblox.com\/blog\/#organization","name":"Infoblox","url":"https:\/\/www.infoblox.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.infoblox.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/infoblox-logo-2.svg","contentUrl":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/infoblox-logo-2.svg","width":137,"height":30,"caption":"Infoblox"},"image":{"@id":"https:\/\/www.infoblox.com\/blog\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.infoblox.com\/blog\/#\/schema\/person\/5f422bb7a06be93cb128df08840ca8bf","name":"Infoblox Security","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/6b1d72646d45388569e0b1577b53b561494422a95e656789193ef414ac7c7027?s=96&d=blank&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/6b1d72646d45388569e0b1577b53b561494422a95e656789193ef414ac7c7027?s=96&d=blank&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/6b1d72646d45388569e0b1577b53b561494422a95e656789193ef414ac7c7027?s=96&d=blank&r=g","caption":"Infoblox Security"},"url":"https:\/\/www.infoblox.com\/blog\/author\/isecurityteam\/"}]}},"_links":{"self":[{"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/posts\/3618","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/users\/295"}],"replies":[{"embeddable":true,"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/comments?post=3618"}],"version-history":[{"count":1,"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/posts\/3618\/revisions"}],"predecessor-version":[{"id":3619,"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/posts\/3618\/revisions\/3619"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/media\/1478"}],"wp:attachment":[{"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/media?parent=3618"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/categories?post=3618"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/tags?post=3618"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}