Dear All,
As this may land slightly-off the charter of this group so off-list replies are welcome. I just want to know the credibility of the report by Citizen-Lab on FinFisher C&C servers. Some of the C&C servers are hosted in RIPE region.

While checking the flow records of 2 weeks, I've seen some good number of connection to prefixes mentioned in this report out of my ISP.


https://citizenlab.org/storage/finfisher/final/fortheireyesonly.pdf

 

Regards,

Aftab A. Siddiqui