Patent attributes
A method and system for detection of malicious network resources in a distributed computer system are provided. The method comprises: receiving, by a first computing device, disposed inside the distributed computer system, an outbound traffic, detecting, by the first computing device, a suspicious external IP address in the outbound traffic, scanning, by the first computing device, a suspicious device located at the suspicious IP address to obtain a list of services running thereon, transmitting, by the first computing device, the suspicious IP address and the list of services to a second computing device disposed outside the distributed computer system, comparing, by the second computing device, the list of services with known malicious services, and in response to a match between at least one service from the list of services and a respective one of the known malicious services: determining the suspicious device, at the suspicious IP address, as being malicious.