Sponsored by..

Wednesday, 22 September 2010

Evil network: VLine Ltd / VLINERU2-NET AS39150 (109.196.128.0/20)

A malware run in progress today using the arestyute.com domain made me look at VLine Ltd, a Moscow based host well-known for supporting criminal activities. The question is.. does VLine actually host any legitimate sites? The answer.. probably not.

An analysis of the netblock 109.196.128.0/20 (109.196.128.0 - 109.196.143.255) which forms AS39150 shows a collection of fake pharma sites, malware sites, fake banks and shipping companies, illegal downloads, fake passports and various other organised criminal activities.

A scan of the netblock using the MyWOT API shows a lot of very bad sites with a few rated "40" which shows that the MyWOT system has rated them automatically. You can see the ratings for all sites in the range in this CSV.

Google's Safe Browsing diagnostic for AS39150 is damning:

Safe Browsing
Diagnostic page for AS39150 (VLTELECOM)


What happened when Google visited sites hosted on this network?

    Of the 567 site(s) we tested on this network over the past 90 days, 33 site(s), including, for example, cgm.ru/, gigalife.info/, kastrade.ru/, served content that resulted in malicious software being downloaded and installed without user consent.

    The last time Google tested a site on this network was on 2010-09-21, and the last time suspicious content was found was on 2010-09-21.

Has this network hosted sites acting as intermediaries for further malware distribution?

    Over the past 90 days, we found 109 site(s) on this network, including, for example, 109.196.134.0/, webserviceftp.ru/, webservicelupa.ru/, that appeared to function as intermediaries for the infection of 3232 other site(s) including, for example, madonnaonline.com.br/, veloplus.ch/, skihutonline.nl/.

Has this network hosted sites that have distributed malware?

    Yes, this network has hosted sites that have distributed malicious software in the past 90 days. We found 165 site(s), including, for example, 109.196.134.0/, webserviceftp.ru/, webserivcessh.ru/, that infected 7766 other site(s), including, for example, madonnaonline.com.br/, homeandi.com/, ishrae.in/.

There's no reason not to block the entire range permanently, or if you want the individual domains check the CSV or copy and paste from below.

Zoma.ru
All4roof.ru
Minirank.ru
Chem-prom.ru
Dias-design.ru
Tile-world.ru
Airways-pro.ru
Mountain-air.ru
Office-ready.ru
Copyterra.ru
Home-building.ru
Vcam-security.ru
Find-furniture.ru
Air-free.ru
Office-interior.ru
Altioma.ru
Artellab.ru
Teplicy-volya.ru
Smirl.ru
Furniture-catalog.ru
Minipr.ru
Plastistrong.ru
Amalgamator.ru
Best-ceramics.ru
Vorota-avto.ru
Building-window.ru
Ccwater.ru
Smbuilding.ru
Home-interior.ru
Fertilize.ru
Light-breeze.ru
Sol-system.ru
Funny-holidays.ru
Furnbox.ru
Eco-bus.ru
Parquet4all.ru
Diesel-electric.ru
Sliding-gates.ru
Kamin-pro.ru
Gloomyandspy.com
Sultanpalase.com
Tdom1.ru
Aruspemedic.com
Atacmedic.com
Ballemed.com
Barblmedic.com
Bumedicine.com
Clayemed.com
Cupharmacy.info
Demornmedic.com
Dilimedic.com
Displimedic.com
Dns4life.com
Doctoraxon.com
Doctorpi.info
Doctorte.info
Draymedic.com
Drugstoremp.com
Gardmedic.com
Gatmedic.com
Ghostemed.com
Haemed.com
Hymedicine.com
Inlmedic.com
Inspidoctor.com
Izedrugs.com
Jestumed.com
Jolynbmedic.com
Kalsmed.com
Kedrugs.com
Lamilmed.com
Locumimed.com
Logdrugs.com
Lomedicine.com
Lumedicine.com
Mablmedic.com
Medalea.com
Medalee.com
Medalinve.com
Medaltype.com
Medalyssa.com
Mediardbi.com
Mediatear.com
Mediccu.com
Mediceday.com
Medicerly.com
Medicgant.com
Medicht.com
Medicineax.com
Medicinece.com
Medicineck.com
Medicineie.com
Medicineir.com
Medicinele.com
Medicinta.com
Mediclace.com
Mediclder.com
Medicmile.com
Medicnl.com
Medicorer.com
Medicsh.com
Medictu.com
Mediculio.com
Medicwe.com
Mediuling.com
Mediuro.com
Medulerac.com
Mestinmed.com
Nepharmacy.com
Nidrugs.com
Obamedic.com
Pharmacybp.com
Pharmacydg.com
Pharmacyec.com
Pharmacyha.com
Pharmacyji.com
Pharmacyna.com
Pharmacyou.com
Pharmacyri.com
Pharmacyta.com
Pharmacyty.com
Romannmed.com
Shormed.com
Site1dns.com
Staimed.com
Tommedic.com
Toucmedic.com
Towmedic.com
Unfmedic.com
Weemedic.com
Dnsupport4site.com
Frmedic.com
Golmedic.com
Grmedic.com
Agemedic.com
Balatmedic.com
Boulatomedic.com
Boumedic.com
Busbmmedic.com
Citelmedic.com
Clipmedic.com
Cofmedic.com
Cotmedic.com
Critrmed.com
Curragmed.com
Czkarmed.com
Drugsbr.com
Drugsdo.com
Drugsin.com
Drugski.com
Newnshome.com
Pharmacybw.com
Agammed.com
Alfmedic.com
Anodormed.com
Bapharmacy.com
Bromedic.com
Cartonlinesite.com
Caumedic.com
Doctorrnes.com
Doctorrteeny.com
Drugsab.com
Fiendemed.com
Sandpimed.com
Bilmedic.com
Socmdoctor.com
Anadoctor.com
Aprdoctor.com
Beldoctor.com
Cormedic.net
Cosadoctor.com
Cytdoctor.com
Decadoctor.com
Diadoctor.com
Doctorcitr.com
Doctordefu.com
Doctordnes.com
Doctorelig.com
Doctoresia.com
Doctorglos.com
Doctorlg.com
Doctorni.com
Doctoround.com
Doctorrman.com
Doctorsele.com
Doctorsour.com
Doctorsterca.com
Doctorstri.com
Doctorsust.com
Doctortelamy.com
Doctorusab.com
Doctorwnee.com
Dymedic.net
Esdoctor.com
Eurdoctor.com
Evemedic.net
Exdoctor.com
Faxedoctor.com
Flidoctor.com
Hodoctor.com
Idodoctor.com
Inamedic.net
Karldoctor.com
Lasdoctor.com
Lordoctor.com
Matmedic.net
Momedic.net
Pomedic.net
Prmedic.net
Prydoctor.com
Rodoctor.com
Sarmedic.net
Shimedic.net
Shmedic.net
Sigdoctor.com
Sumedic.net
Toudoctor.com
Tumedic.net
Wrmedic.net
Yeadoctor.com
Agefeskousavd.com
Baguntalput.com
Bandlobhepe.com
Doctoramro.com
Doctoraubr.com
Evercavsuv.com
Everuvdredsovg.com
Feremokerfeve.com
Kalkfallpoxeble.com
Kougsapelex.com
Kownamemavy.com
Laghtbukstap.com
Lekboxover.com
Lupharmacy.com
Mevbeforeday.com
Okworldadd.com
Perapsalfkvow.com
Pestendblask.com
Sallfapestpong.com
Seemalwayxame.com
Sekevak.com
Somekurvcar.com
Svowkooleskev.com
Swedoctor.com
Thousandbondepoff.com
Voecesoutree.com
Vowelvortevg.com
Wakerkesedurevg.com
Welebodyuvdred.com
Weskarereal.com
Wycerkaevsek.com
Yesqueskeovabove.com
Afmedicine.com
Ammedicine.com
Chmedicine.com
Medicalmoisdw.com
Medicalmoisdw1.com
Medicalmoisdw10.com
Medicalmoisdw2.com
Medicalmoisdw3.com
Medicalmoisdw4.com
Medicalmoisdw5.com
Medicalmoisdw6.com
Medicalmoisdw7.com
Medicalmoisdw8.com
Medicalmoisdw9.com
Medicineds.com
Medicinels.com
Medicinemi.com
Medicinena.com
Medicinend.com
Medicineoi.com
Am-way.ru
Sheathing.ru
Zakonoma.ru
Inmoble.ru
Crosswall.ru
Auto-wash.ru
Service-stroy.ru
Pure-air.ru
Window-tech.ru
Aeroventa.ru
Jackcond.ru
Ullte.com
Mp3fiesta.com
Setyupdates.com
Netspart.net
Myupdates.biz
Headboong.com
Myupdateswindows.biz
Bestandxast.com
Besternax.com
Erterzan.com
Joprestons.net
Ralaxanteras.com
Russian-post.net
Slikanddik.com
Trafallbest.com
Xalentarna.net
Zalevaka.com
Zaskupalt.com
Fdsdorgan.com
Freefdsvoip.com
Jastli.com
Qlepa.in
Infinitelivin.tw
Vviv.ru
Audo20s.in
Music9star.com
Nostalgictitation1.info
Pixelateder.info
Reducedilonion.info
Music9star.org
Video4gamle.org
Budulay.net
Ak2o.info
Bioloom.info
Cd3o.info
Dkm5.info
Drone2556yb5.info
Ek5k.info
Gambolsfhsw5.info
Jingoisticth65.info
Joculartuu7.info
L1nn.info
Largessff.info
Tjkd.info
Vaqp.info
Ymso.info
Globalstream.info
Xwealthglobal.com
Xwestprivate.com
Partnerandassist.com
Representativesuk.com
Tinygimme.info
Alm-career.com
Gdm247.com
Kadewsq.com
Kahlier.com
Myservster.com
Old-crash.com
Onlinesexytube.com
Vipnakurka.com
Asderbit.com
Ilaydiy.com
Ilovelasvegas.ru
X5vsm5.ru
Godfast.info
Haycorn.info
Lercuw.info
Winkum.info
Ukada.ru
Careerbuildjobs.com
Astraphs.com
Jarntauiuva91.com
Banktrustservice.com
Staffsecurecheck.com
Vseravnopidersii.net
Aatrgroup.com
Accentincolor.com
Prodesgroup.com
Kse-advertising.com
Sysport-1.com
Vlnet.ru
Intlos.org
Atomicc.com
Cern-a.com
Xbasex.com
Upslabels.cc
Securixp.com
Securixp.net
Addthiss.cn
Addthiss.net
Addthiss.org
Countinfo.com
Free-ns.org
Searchits.org
Searchnew.net
Top-analitics.com
Qweda.cn
Ameriprise-careers.eu
Piccinirealestate.eu
Sniping.biz
Your-usa-address.com
Gitrest.net
Utromesa.net
Yarostt.net
Absolutefinancegroup.com
C339.net
Freehost21.tw
Keller-services.com
Llwql.com
Parcelforwardingservice.com
Ticketalfa.com
Ticketbravo.us
Babaevo.com
Bestinsurancequotesinfo.com
Detoxhot.com
Freestarcraft2guide.info
Googlesecrets.biz
Guitar-beginners-guide.com
Insuranceproquotes.com
Pokeralpha.net
Agency-sunsea.com
Aslrr.com
Avelectronics.org
Buyfakepassport.cc
Buyfakepassports.com
Cargoex.info
Fakepassportsale.cc
Mbe-kerriere.com
Myhotlot.com
Oem-buy-soft.com
Oem-soft-buy.com
Raggaperfibra.net
Silverstarf.net
Whoismansheck.com
Yahoo-statistic.com
Geo-tour.org
Zeoxmark.com
Zeoxmark.net
Time-sync.net
Acfinc.eu
Banking-security.org
Lnterhome.biz
New-crash.com
Storetablets.net
Vipnakurka.net
Wallst-news-line.com
Sexyshowmovies.info
Sexyshowvideo.info
Allow-strike.ru
Allowstrike.ru
Antituta.ru
Awm-magazine.ru
Enterteiment-wizrd.ru
Enterteimentwizrd.ru
Julyrelax.ru
Magazineawm.ru
Magazineshare.ru
Nanovoice.ru
Protray.ru
Relax-july.ru
Relaxjuly.ru
Ros-tec.ru
Sensationworld.ru
Shareawm.ru
Sharks-devision.ru
Sharkstux.ru
Traypro.ru
Tuta-anti.ru
Tutaanti.ru
Tutavir.ru
Vir-tuta.ru
Viranti.ru
Virtuta.ru
Visitthermal.ru
Voice-nano.ru
Voicecontrol.ru
Wizrd-enterteiment.ru
Wizrdenterteiment.ru
Combicorm.com
Dertentazner.com
Notersils.com
Rerasterk.com
Westtrafficanser.com
Wrtumenter.com
Arestyute.com
Rtttins.com
Trrrasret.com
Ukklomk.com
Bibblea.com
Trawqe.com
Uttere.com
Yterast.com
Capitalmarktservice.com
Dangerousteens.com
Mrxbase.com
Sweetpornobabes.com
Sweettiny.com
The-snake-jewellery.com
Tight-slits.com
Tinysweet.com
Youngsweat.com
Zedexpost.com
Gkkotre.com
Letyasheypohodkoymoraleswtf.info
Mindwor.com
Promojoyswif.net
Tristan-express.com
Vain-and-ryan.com
Vain-ryan.com
Weslisnaps.info
Samsclearancerainbow.com
Samsclearancewebers670.com
Samsclubclearance.cc
7crack.com
7newmails.com.ua
9ladiesmails.com.ua
Abruzzonelblues.com
Alina-sp.com.ua
Alinamails-jl.com.ua
Allmails-1u.com.ua
Anastasia-mails7.com.ua
Annamail-jl.com.ua
Ckinter.ru
Contacts4u-sp.com.ua
Crack-info.com
Crack-key.com
Crack-keygen-serial.com
Crack-news.com
Crack-software.com
Crack-warez.com
Crackblogs.com
Cracknews.info
Dates-eva.com.ua
Download-url.com
Drcrack.com
Evadates.com.ua
Evamass-pa.com.ua
Evanews-pa.com.ua
Evanotes.com.ua
Evatease.com.ua
Free-key.net
Freecrack.net
Girlfriend-re.com
Julia-mails.com.ua
Julia-mails7.com.ua
Julia-sp.com.ua
Katerina-sp.com.ua
Ladies-re.com
Mails4u-pa.com.ua
Maria-mails7.com.ua
Marina-sp.com.ua
Matches-re.com
Messages4u-sp.com.ua
Mila-sp.com.ua
Nadya-sp.com.ua
Notes4u-pa.com.ua
Olganotes.com.ua
Search-crack.com
Serials-keys.com
Teaseville-sp.com.ua
Thecrack.name
Warez-crack.com
Wincrack.info
Yeva4u-pa.com.ua
Search-841.com

No comments: