another Luckysploit IP

[phenom]

Code: [Select]

http://hello-to-you.net/rttz/?t=6
Its IP is 78.109.30.48, already in the MDL database, but does not yet list Luckysploit or the domain name.

Looks pretty similar to the fuck-lady version.

Wepawet link:
http://wepawet.iseclab.org/view.php?hash=c616a15254aa57bb0035ecce05633557&type=js

[SysAdMini]

I have seen many Luckyploits urls in the last days, but they work only one time from the same ip.

Example:

Code: [Select]

http://85.17.189.183/opis2/?h=

[SysAdMini]

Another one

Code: [Select]

http://202.73.57.6/tomi

[SysAdMini]

Code: [Select]

http://r-state.com/equi/http://wepawet.cs.ucsb.edu/view.php?hash=14a57e49e92bebd6116da5ebddef1418&t=1234542448&type=js

[GmG]

Code: [Select]

http://94.247.2.157/.lck/?t=3
http://dvlorg.net/parus/?t=25
http://rodexcom.org/parus/?t=5
http://superioradz.info/opis2/?t=2
http://superioradz.info/opis3/?t=2

http://92.62.100.66/bm/?t=5
http://92.62.100.66/wait/?t=5
http://directlink0.cn/bm/?t=15
http://directlink0.cn/wait/?t=15
http://directlink1.cn/bm/?t=15
http://directlink1.cn/wait/?t=15
http://directlink2.cn/bm/?t=15
http://directlink2.cn/wait/?t=15
http://directlink4.cn/bm/?t=15
http://directlink4.cn/wait/?t=15
http://directlink9.cn/bm/?t=15
http://directlink9.cn/wait/?t=15
http://trafffive.cn/bm/?t=15
http://trafffive.cn/wait/?t=15


[SysAdMini]

Thanks, GmG. Nice collection.

[SysAdMini]

Another url. Thanks to our new member Bang.

Code: [Select]

http://deinglaube.com/images/
redirects to Luckysploit url

Code: [Select]

http://statclick.net/main/?t=1

[Micha]

The other domains are also not very kosher:

http://www.trustedsource.org/query/ns1.globo-meds.com?m=ns

Code: [Select]

Domains on Nameserver ns1.globo-meds.com

statclick.net
sei-keine.com
globo-meds.com
google-analitic.com
deinglaube.com
verzeih.com
auf-jeder.com
chiburashko.com
xryndel.com
Already listed as bad since last year: http://www.malwaredomainlist.com/mdl.php?search=verzeih.com

[SysAdMini]

Code: [Select]

http://verzeih.com/state/?t=1
redirects to another Luckysploit

Code: [Select]

top.sei-keine.com/u-store/?t=1

[SysAdMini]

Code: [Select]

federalreserve.banknetworks.net/bb/?t=2http://wepawet.cs.ucsb.edu/view.php?hash=5f7cc23f4777d2d36527479fc1154557&t=1235499824&type=js

[Micha]

Another example: (watch the hidden IFRAME to DummySploit)

Code: [Select]

hxxp://ustreasury.usbanknet.net

Code: [Select]

ns1.frb-network.com A 220.196.59.26
ns1.usbanknetwork.com A 220.196.59.26
ns1.fedwirenetworks.com A 220.196.59.26
ns1.e-banknetworks.com A 220.196.59.26
ns1.ebanknetworks.com A 220.196.59.26
ns1.usbanknetworks.com A 220.196.59.26
ns1.federalreservebanks.us A 220.196.59.26
ns1.fedwirenetworks.us A 220.196.59.26
ns1.e-banknetworks.us A 220.196.59.26
ns1.banknetworks.us A 220.196.59.26
ns1.ebanknetworks.us A 220.196.59.26
ns1.usbanknetworks.us A 220.196.59.26
ns1.banknets.us A 220.196.59.26
ns1.frb-network.net A 220.196.59.26
ns1.ebanknetwork.net A 220.196.59.26
ns1.usbanknetwork.net A 220.196.59.26
ns1.e-banknetworks.net A 220.196.59.26
ns1.banknetworks.net A 220.196.59.26
ns1.ebanknetworks.net A 220.196.59.26
ns1.usbanknetworks.net A 220.196.59.26
ns1.usbanknet.net A 220.196.59.26
ns1.dnscore.ru A 220.196.59.26
ns1.dnshoster.ru A 220.196.59.26
ns1.cheapdns.ru A 220.196.59.26

[SysAdMini]

Code: [Select]

85.17.189.183/clicksagent2http://wepawet.cs.ucsb.edu/view.php?hash=e7f5ef845f85b27352b3d890ea6bab9a&t=1235832015&type=js

[SysAdMini]

Code: [Select]

analytics.pl.ua/scripts/?t=4

[SysAdMini]

Code: [Select]

odile-marco.com/tomihttp://wepawet.cs.ucsb.edu/view.php?hash=104400c94a446e2cdb803341c189dc03&t=1236003897&type=js

[GmG]

Code: [Select]

http://idealadvertising.org/clicksagent2/?t=2