Author Topic: Interserver, malware, and the Scottish weather  (Read 6321 times)

0 Members and 1 Guest are viewing this topic.

June 17, 2011, 02:16:38 am
Read 6321 times

MysteryFCM

  • Administrator
  • Hero Member

  • Offline
  • *****

  • 1693
  • Personal Text
    Phishing Phanatic
    • I.T. Mate
Interserver, malware, and the Scottish weather

Quote
They say, if you don't like the Scottish weather, wait 20 mins. That's all I've got on that one.

In the last few weeks alone, 2 specific IPs have racked up a count of over 2000 malicious domains, most through just a handful of registrars (all those through DirectI have been suspended within around 20 mins on average, of being discovered, with DirectI suspending several thousand more related domains and several hundred entire accounts).

The latest domain, dablane.com, identified around 15 mins ago, is through a new registrar (or new to this campaign anyway), REGISTERDOMAIN.NAME, which appears to be a NETEARTH reseller.

The two IPs, 66.45.243.37 [reverse243-34.reserver.ru] and 66.45.243.38 [reverse243-34.reserver.ru], have since May 22nd, racked up the following, with likely alot more not yet being identified;

Read more
http://hphosts.blogspot.com/2011/06/interserver-malware-and-scottish.html
Regards

Steven Burn
I.T. Mate / hpHosts
it-mate.co.uk / hosts-file.net

June 23, 2011, 04:02:41 am
Reply #1

MysteryFCM

  • Administrator
  • Hero Member

  • Offline
  • *****

  • 1693
  • Personal Text
    Phishing Phanatic
    • I.T. Mate
Regards

Steven Burn
I.T. Mate / hpHosts
it-mate.co.uk / hosts-file.net

June 23, 2011, 04:54:19 am
Reply #2

MysteryFCM

  • Administrator
  • Hero Member

  • Offline
  • *****

  • 1693
  • Personal Text
    Phishing Phanatic
    • I.T. Mate
Regards

Steven Burn
I.T. Mate / hpHosts
it-mate.co.uk / hosts-file.net

June 27, 2011, 01:21:52 pm
Reply #3

MysteryFCM

  • Administrator
  • Hero Member

  • Offline
  • *****

  • 1693
  • Personal Text
    Phishing Phanatic
    • I.T. Mate
Regards

Steven Burn
I.T. Mate / hpHosts
it-mate.co.uk / hosts-file.net

July 06, 2011, 01:22:08 pm
Reply #4

MysteryFCM

  • Administrator
  • Hero Member

  • Offline
  • *****

  • 1693
  • Personal Text
    Phishing Phanatic
    • I.T. Mate
When is a 24 hour warning not a 24 hour warning? (aka HostNOC/Burst finally suspend Renos server)
http://hphosts.blogspot.com/2011/07/when-is-24-hour-warning-not-24-hour.html
Regards

Steven Burn
I.T. Mate / hpHosts
it-mate.co.uk / hosts-file.net

July 19, 2011, 03:54:23 pm
Reply #5

MysteryFCM

  • Administrator
  • Hero Member

  • Offline
  • *****

  • 1693
  • Personal Text
    Phishing Phanatic
    • I.T. Mate
Part 9: Interserver, malware, and the Scottish weather

Quote
I love predictability, makes my job much easier (well, as far as these chaps are concerned anyway). 3 IPs as of today, same registrars (surprise surprise);

UK2
DirectI
NetEarth

One of the IPs is the same as yesterday (errr Burst.net/HostNOC - what happened to your 24 hour warning?).

66.197.187.152 immovable.detectstakes.com AS21788 66.197.128.0/17 NOC - Network Operations Center Inc.
193.105.171.120 120-171-105-193.coolvds.com AS50669 193.105.171.0/24 COOLVDS-AS FOP Kutcevol Maksum Mukolaevich
184.22.251.238 184-22-251-238.static.hostnoc.net AS21788 184.22.224.0/19 NOC - Network Operations Center Inc.

http://hphosts.blogspot.com/2011/07/part-9-interserver-malware-and-scottish.html
Regards

Steven Burn
I.T. Mate / hpHosts
it-mate.co.uk / hosts-file.net

July 22, 2011, 09:38:46 pm
Reply #6

MysteryFCM

  • Administrator
  • Hero Member

  • Offline
  • *****

  • 1693
  • Personal Text
    Phishing Phanatic
    • I.T. Mate
Regards

Steven Burn
I.T. Mate / hpHosts
it-mate.co.uk / hosts-file.net

July 24, 2011, 03:48:22 pm
Reply #7

MysteryFCM

  • Administrator
  • Hero Member

  • Offline
  • *****

  • 1693
  • Personal Text
    Phishing Phanatic
    • I.T. Mate
Regards

Steven Burn
I.T. Mate / hpHosts
it-mate.co.uk / hosts-file.net