Malicious Domains by Lelenina

[lelenina]

Code: [Select]

http://pleasing-tube.com/xplays.php?id=45031
Directs to trojan

Code: [Select]

http://loadmediameans.com/video-plugin.45031.exe
Trojan

[lelenina]

Code: [Select]

http://merlion3oll.com/in.cgi?20&parameter=jonn4b&ur=1&HTTP_REFERER=nnn1
Redirects to fake scanner page

Code: [Select]

http://uikou.in/scaner/?id=02909
Fake scanner page

Code: [Select]

http://zestrsooots.com/aa/index.php
Exploit kit

[lelenina]

Code: [Select]

http://nojtul.co.cc/c/index.php
Phoenix Exploit Kit

Code: [Select]

http://nojtul.co.cc/c/statistics.php
Control panel of Phoenix Exploit Kit

Code: [Select]

http://nojtul.co.cc/c/l.php
http://nojtul.co.cc/c/exe.exe
Trojan

[lelenina]

Code: [Select]

http://buyshieldec.com/dimesis.php?ID=19776
Redirects to fake scanner page

[lelenina]

Code: [Select]

http://jewertlins.com/stars/index.php
Exploit kit

Code: [Select]

http://jewertlins.com/stars/l.php
Trojan

[lelenina]

Code: [Select]

http://titolutis.cn/1/index.php
Phoenix Exploit kit

Code: [Select]

http://titolutis.cn/1/statistics.php
Control panel of Phoenix Exploit Kit

Code: [Select]

http://titolutis.cn/1/l.php
http://titolutis.cn/1/exe.exe
Swisyn trojan

[lelenina]

Code: [Select]

http://huzytaj.co.cc/get/index.php
Exploit kit?

[SysAdMini]

Code: [Select]

http://huzytaj.co.cc/get/index.php
Exploit kit?

Do you receive any content from this url ? I don't get anything.

Special referer ?

[GmG]

Code: [Select]

http://huzytaj.co.cc/get/?pg=171&action=italynew&e=post

same as
http://www.malwaredomainlist.com/mdl.php?search=jabylat.co.cc&colsearch=All&quantity=50


but

/get/?pg=171&action=italynew&e=post

works only with ip from italy

[lelenina]

Code: [Select]

http://goupdates.is.com/
Redirects to exploit kit.

[lelenina]

Code: [Select]

http://vobuzmgsy.ru/wint2/
Redirects to fake scanner page

[lelenina]

Code: [Select]

http://eveninglottery.cz.cc/index.php?s=2&u=4cb83405e1f594cb83405e2342
Exploit kit?

[GmG]

Code: [Select]

http://eveninglottery.cz.cc/index.php?s=1&u=4cb83405e1f594cb83405e2342
http://eveninglottery.cz.cc/index.php?s=2&u=4cb83405e1f594cb83405e2342
http://eveninglottery.cz.cc/d.jar
http://eveninglottery.cz.cc/java.php?jar=1
http://eveninglottery.cz.cc/pdf3.php
http://eveninglottery.cz.cc/loadd.php
http://eveninglottery.cz.cc/load.php?sploit=JAVASMB

http://www.virustotal.com/file-scan/report.html?id=643c9528038b7f0202cc07c18536beca7004849aa2c9dbfc1dd2dcd9313937ba-1287242215

[lelenina]

Code: [Select]

http://eveninglottery.cz.cc/index.php?s=1&u=4cb83405e1f594cb83405e2342
http://eveninglottery.cz.cc/index.php?s=2&u=4cb83405e1f594cb83405e2342
http://eveninglottery.cz.cc/d.jar
http://eveninglottery.cz.cc/java.php?jar=1
http://eveninglottery.cz.cc/pdf3.php
http://eveninglottery.cz.cc/loadd.php
http://eveninglottery.cz.cc/load.php?sploit=JAVASMB

http://www.virustotal.com/file-scan/report.html?id=643c9528038b7f0202cc07c18536beca7004849aa2c9dbfc1dd2dcd9313937ba-1287242215

Thanks.  How did you find all of those URLS?  Wepawet did not work for me.

[GmG]

I tried index.php?s=1&u=4cb83405e1f594cb83405e2342
1 instead of 2
and decoded the page with malzilla

http://wepawet.iseclab.org/view.php?hash=f4a5bbcd8cd803d4184f32535466751b&t=1287263312&type=js