Author Topic: 91.212.41.114  (Read 10170 times)

0 Members and 1 Guest are viewing this topic.

May 28, 2009, 06:01:55 am
Read 10170 times

Malware-Web-Threats

  • Special Members
  • Hero Member

  • Offline
  • *

  • 354
    • MalwareURL
It seems that the fake av domain previously parked at zlkon are now online.

http://www.malwaredomainlist.com/mdl.php?search=hs.2-215.zlkon.lv&colsearch=All&quantity=100&inactive=on

The IP has changed to 91.212.41.114

Here's the latest detected - http://www.malwareurl.com/listing.php?ip=91.212.41.114

And some new domains.
Code: [Select]
bestcover2u.cn
bestcover4you.cn
bestcoverforyou.cn
easyfriskdisease.cn
newguardforyou.cn
newguard2u.cn
yourfriskinfection.cn
Registrant: werracruz99008@ gmail.com

Code: [Select]
atioqe.cn
exodih.cn
exousyt.cn
feptuaq.cn
suxpymi.cn
Registrant: dfgsegzhfs@ yahoo.com

Code: [Select]
addedantivirus.com
bestaddedantivirus.com
easyplusantivirus.com
plusantiviruspro.com
youraddedantivirus.com
Registrant: Ivan I Ivanov / jclarke980@ gmail.com

Code: [Select]
smartantivirusplus09.com
getantivirusplus09.com
realantivirusplus09.com
freeantivirusplus09.com
Registrant: HOOYOO (US) INC.

June 01, 2009, 06:47:39 pm
Reply #1

Mr Clean

  • Special Members
  • Hero Member

  • Offline
  • *

  • 331
Code: [Select]
hxxp://adayby.cn/installer_70100.exe

$ dig adayby.cn +short
91.212.41.114

http://www.virustotal.com/analisis/af1db3d369de954640ac6b094f13621453624e4a64cb895c51fb71ff91079d6d-1243878292 11/40


adayby.cn



http://www.threatexpert.com/report.aspx?md5=d1f4cd0a7a4af84a095d562cc3824f61

from threatexpert.com analysis


getantivirusplusnow.com