The CBL says that somebody in my network just some hours ago connected (again) to (conficker sinkhole).

But as I know, conficker is a malware for windows machines only. It's my home network, and I'm sure that I have no windows machines here, but one was there for about month ago.

I'm trying to detect source IP with wireshark, but still have no results. If it gives you some information, right now I have mac, smart TV and ps4 connected to my network.

How is it possible?

Thanks, Andrew;

  • What's your IP?
    – DrDamnit
    Aug 12, 2017 at 21:06

1 Answer 1

  1. If the computer runs win emulators sometimes, it can get infected through that.
  2. It is possible, that there is an unreported mac variant already
  3. Probably its just containing the virus, but macs are not affected. In this case your ip is blocked to stop infecting other win machines. It happened to linux machines too in the case of wannacry. It can also happen that a bot spoofed its ip through you...

    Tip: run some scan for the virus, tell all your contacts that they might be infected, change your ip, ask for delisting, and see if youre still blocked. If yes, youre still infected.


  • they usually recommend Mac OS users to update everything and uninstall freeware "antivirus" programs which are actually spywares/viruses or cause problem
  • if you have Liux on Mac, you should install GUFW firewall, clamTK antivirus and chkrootkit + rootkithunter rootkit-detector apps. The latter 2 have false positives, and require update before scan. They were updated recently, but as I saw the false positive for operation windigo is still there - can be confrmed by 3 tests
  • Thanks for the answer, TriloBite! I'll try to change ip on monday, because my provider changes ip only once a month and the support doesn't work on weekends. Btw, I tried to look for connections to sinkhole via activity monitor, and didn't find anything again. Looks like ip changing will help Aug 12, 2017 at 21:38
  • Wireshark - if you use Linux on mac, I can suggest you tools to detect virusses which also affect Win.
    – TriloByte
    Aug 12, 2017 at 22:00
  • It would be great Aug 12, 2017 at 22:01
  • I will update my answer.
    – TriloByte
    Aug 12, 2017 at 22:06
  • Ok, thanks. If ip changing woun't help ill try to install firewall Aug 12, 2017 at 22:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .