Malware Domain List

Malware Related => Malicious Domains => Topic started by: Seedler on January 12, 2011, 09:20:08 pm

Title: I propose 94.63.241.155 for blocklist
Post by: Seedler on January 12, 2011, 09:20:08 pm
94.63.241.155 appears to be associated with CryptMEN:

The Host header on the request was the IP and this was in the response:

Content-Disposition: attachment; filename="inst.exe"

94.63.241.151 is already on the AMaDa blocklist (http://amada.abuse.ch/blocklist.php?download=ipblocklist) and it is in the same netblock (which is registered to a RO address....).

-Seedler
Title: Re: I propose 94.63.241.155 for blocklist
Post by: SysAdMini on January 12, 2011, 11:30:39 pm
94.63.241.155 appears to be associated with CryptMEN:

The Host header on the request was the IP and this was in the response:

Content-Disposition: attachment; filename="inst.exe"

94.63.241.151 is already on the AMaDa blocklist (http://amada.abuse.ch/blocklist.php?download=ipblocklist) and it is in the same netblock (which is registered to a RO address....).

-Seedler

If you can provide complete urls of currently active malware then I will add them to our database.