Sponsored by..

Monday, 11 October 2010

Evil network: Specialist Ltd / Specialist-ISP-PI2 AS48691(194.28.112.0/22)

Specialist Ltd is a fairly large netblock containing a small number of very bad hosts and nothing else. Registered to a company in Moldova, Specialist looks like another part of the Latvia / Moldovan / Bosnian black hat network which supports all sorts of organised crime.

inetnum:         194.28.112.0 - 194.28.115.255
netname:         Specialist-ISP-PI2
descr:           Specialist, Ltd.
country:         MD
org:             ORG-SL206-RIPE
admin-c:         VP2841-RIPE
tech-c:          AB16163-RIPE
status:          ASSIGNED PI
mnt-by:          RIPE-NCC-HM-PI-MNT
mnt-lower:       RIPE-NCC-HM-PI-MNT
mnt-by:          SPECIALIST-MNT
mnt-routes:      SPECIALIST-MNT
mnt-domains:     SPECIALIST-MNT
source:          RIPE # Filtered

organisation:    ORG-SL206-RIPE
org-name:        Specialist, Ltd
org-type:        OTHER
descr:           Specialist, Ltd, Rybnitsa, MD
address:         I. Soltysa 12, Rybnitsa, MD
phone:           +373-777-12921
phone:           +373-693-18189
phone:           +373-777-65071
fax-no:          +373-555-43073
mnt-ref:         MONITORING-MNT
abuse-mailbox:   abuse@lan-rybnitsa.com
mnt-by:          SPECIALIST-MNT
source:          RIPE # Filtered

person:          Vladimir Pilan
address:         I. Soltysa 12, Rybnitsa, MD
phone:           +373-777-12921
fax-no:          +373-555-43073
nic-hdl:         VP2841-RIPE
source:          RIPE # Filtered
mnt-by:          SPECIALIST-MNT

person:          Anatoly Belitsky
address:         I. Soltysa 12, Rybnitsa, MD
phone:           +373-777-65071
fax-no:          +373-555-43073
nic-hdl:         AB16163-RIPE
source:          RIPE # Filtered
mnt-by:          SPECIALIST-MNT

% Information related to '194.28.112.0/22AS48691'

route:           194.28.112.0/22
descr:           Specialst-route2
origin:          AS48691
mnt-by:          SPECIALIST-MNT
source:          RIPE # Filtered


Google's Safe Browsing diagnostics only show part of the story:

Safe Browsing
Diagnostic page for AS48691 (SPECIALIST)

What happened when Google visited sites hosted on this network?

    Of the 28 site(s) we tested on this network over the past 90 days, none served content that resulted in malicious software being downloaded and installed without user consent.

    The last time Google tested a site on this network was on 2010-10-09, and the last time suspicious content was found was on 2010-10-09.

Has this network hosted sites acting as intermediaries for further malware distribution?

    Over the past 90 days, we found 3 site(s) on this network, including, for example, 0jiqjmk3.ru/, fngmadopx.ru/, bingosyssaver24.com/, that appeared to function as intermediaries for the infection of 2 other site(s) including, for example, rttattorneys.com/, mygooglephotos.webs.com/.

Has this network hosted sites that have distributed malware?

    Yes, this network has hosted sites that have distributed malicious software in the past 90 days. We found 15 site(s), including, for example, 194.28.112.0/, xebetak.ru/, bingosyssaver24.com/, that infected 865 other site(s), including, for example, slutdrive.com/, stvid.com/, amatura.com/.
The MyWOT reputation of the sites on this network is very bad [CSV]. It is unlikely that this netblock will be used for anything other than evil purposes, so blocking 194.28.112.0 - 194.28.115.255 (194.28.112.0/22) is probably a good idea, or block the domains listed below.

Globdomain.ru
Greenter.ru
Photois.org
Style-vk.com
Vkstyle.net
07tqqwem.ru
0jiqjmk3.ru
0qhe7y6o.ru
0scoubpk.ru
0st44x7z.ru
0w6scx6a.ru
1001jimm.ru
23qjmdic.ru
27wuxt37.ru
28iue5ri.ru
28jnbuak.ru
2be-trends.ru
2poaxz3k.ru
2ti0pv3y.ru
2zm5mcep.ru
30zcz8ot.ru
32iafdnp.ru
3a0stbqe.ru
3jruf6nc.ru
40ktc2tn.ru
4hp2ag6c.ru
4jfhywir.ru
4mausx2w.ru
4y8pqcby.ru
5c4aiwcs.ru
5gsco2w5.ru
5q4eyd2w.ru
5znhff2s.ru
6dpg3khy.ru
6ojj8sks.ru
6pgsqndh.ru
777wxpc7.ru
78w88epi.ru
83qndvnj.ru
868r5e0b.ru
8n7pnyyr.ru
8reclame.ru
Alwaysprokladka.com
Artenhart.ru
Artiestenloket.ru
Ashcbzbbbz.ru
Aslkjhqeqw.ru
Atyyyopg.ru
Azaamdwo.ru
Bim6xe3t.ru
Bjpfk0rm.ru
Boskoop2nepal.info
Bossal.info
Bramrozafestival.info
Brand-central.info
Bvo62o0i.ru
Bwzz5c32.ru
C28xd2ck.ru
C6iv0x3j.ru
Cafetariaroyal.info
Cateredchaletfrankrijk.ru
Cf8sagkn.ru
Childsurvival.info
Creedenceclearwatersurvival.info
Crosslinks-services.ru
Csokolom.ru
Cw5k47ye.ru
D6vjbbv6.ru
Damesfutsal.info
Datadigital.info
Dekeukenbouwer.ru
Dotyuzcifl.ru
Duz5n2ca.ru
Dwunvuum.ru
Ea7xh4vw.ru
Ef6j6u0r.ru
F50rbdb8.ru
Farmsurvival.info
Fbbktj2z.ru
Fhlaenyxor.ru
Fimpvs8t.ru
Fppf2h28.ru
Freemobiledns.mobi
Gayq8rgx.ru
Gdwre766.ru
Gopchicken.ru
Gscrystal.info
H6poe6or.ru
Haaglandia-futsal.info
Hc6zxms4.ru
Hem3oxjh.ru
Henness.ru
Hetkwispelaartje.ru
Hotcrystal.info
Huisenenergielabel.info
Hvdwal.info
I4nhjopf.ru
I7in0b64.ru
Ic2u8kk0.ru
Ihbkbzcm.ru
Ihcswgcz.ru
Ihjddgqs.ru
Inventivecapital.info
Io060fcn.ru
Io0yfyc8.ru
J6kb3pfa.ru
J7k6xze2.ru
J7oc5v3o.ru
Jbsc.ru
Jimakolo.ru
Jimm2rusru.ru
Jimmbly.ru
Jimmdlyadjimmru.ru
Jimmdlyasamsa.ru
Jimmdns1.ru
Jimmdns3.ru
Jimmdns4.ru
Jimmdns5.ru
Jimmdnsru.ru
Jimmfanfik.ru
Jimmfantasy2.ru
Jimmfaqru.ru
Jimmforyouru.ru
Jimmfreeru.ru
Jimmgps.ru
Jimmgpsru.ru
Jimmhobbyrus.ru
Jimmhostoryru.ru
Jimmhtcru.ru
Jimmicqlop.ru
Jimmkolipo12.ru
Jimmkonstructru.ru
Jimmlocationrus.ru
Jimmlocationss.ru
Jimmlokolok.ru
Jimmmobru2.ru
Jimmmobru4.ru
Jimmnewsru.ru
Jimmokiloi.ru
Jimmonlineru.ru
Jimmonlinerus.ru
Jimmosuk.ru
Jimmplanetka.ru
Jimmpolice12.ru
Jimmpolomba.ru
Jimmpoloniy.ru
Jimmpozor.ru
Jimmprofile.ru
Jimmprofilerus.ru
Jimmrurus.ru
Jimmsamsungru.ru
Jimmtebepii.ru
Jimmtrahaet.ru
Jimmvmozg.ru
Jimmyblo.ru
Jnano5gh.ru
Jokerjokk.ru
Jongfcmp.ru
Josal.info
Joy-adventure.ru
Kadefestival.info
Kefpvbsi.ru
Kfgemaae.ru
Kleinhengstdael.info
Kojvdspw.ru
Koliander.ru
Langsdewal.info
Liononlinensd.ru
Lipsticpi.ru
Listikjimm.ru
Literatuurfestival.info
Lokipol.ru
Lopolok.ru
Macdental.info
Maruuhp2.ru
Meeenti.ru
Mipolok.ru
Mjbims7m.ru
Mokojikol.ru
Momomom.ru
Mrt0zqcb.ru
Multimediamagazine.ru
Mvanderwal.info
Mxek5t5g.ru
N7wg0g5w.ru
Naaminkristal.info
Noordelijkkoorfestival.info
Nv8os6yt.ru
Nxo48a7g.ru
O3wg4sya.ru
Ocggnaif.ru
Ofz5qzgu.ru
Oh7iumr7.ru
Ohjbkyudil.ru
Ojimmx4.ru
Ojimmx6.ru
Okiolk.ru
Onlinecheapsdo.ru
Onlinefeeds.ru
Onlinefreeze.ru
Onlinegearsd.ru
Onlinegop.ru
Onlinejimmmovse.ru
Onlinejobsfrees.ru
Onlinelongjorn.ru
Onlineonlkiok.ru
Onlinerujimm.ru
Onlineteammaster.ru
Onlinetechnicals.ru
Onlineworkers.ru
Onlinkrt.ru
Oordfestival.info
Orthocapelle.ru
Patronah.ru
Paulvosdewael.info
Petstotal.info
Piscine-ecologique.ru
Pororkol.ru
Praktijkdebergkristal.info
Prc6t7z3.ru
Psxdv0nr.ru
Pvbsiy5y.ru
Q2auv3at.ru
Q3ysg05s.ru
Q8juhmhh.ru
Qbecqe0s.ru
Qec5beqn.ru
Qzhvlpso.ru
Rebootfestival.info
Renarental.info
Retrosensual.info
Rickenchantal.info
Rietfestival.info
Rikosdhu.ru
Ronaldknol.ru
Rs3gpd0m.ru
Rudjimmdjimm.ru
Rvvcoal.info
S4gvhd35.ru
S748eop4.ru
Sadjbamn.ru
Sadjkadkasj.ru
Schutrups.ru
Selavis.ru
Sgivnn0t.ru
Smart-accountant.ru
Spankabel.info
Srowig.ru
Stichtingderevival.info
Stiltefestival.info
Stpf6qpv.ru
Sv4wmtxj.ru
T0a2afyq.ru
T3tzynvj.ru
T8hftjx8.ru
Tinkel-bel.info
Transfusionfestival.info
Trustincompanies.ru
Twqhde3i.ru
U5fyfzjt.ru
Ucf47vnu.ru
Uplcash.com
Vaxlgfsb.ru
Vdmi2fz8.ru
Vecgndv8.ru
Vetstival.info
Vgksry7k.ru
Vicl.info
Vk0urcvu.ru
Vroegop.ru
W8iroomb.ru
Webeval.info
Wiiqiieiqa.ru
Worldfuneral.info
Wsewf0rw.ru
Wyvbe7vg.ru
X7p03g0j.ru
X8zv6433.ru
Xni27ftd.ru
Xthjrgxz.ru
Xu44i03y.ru
Yearsforfan.ru
Yi0ewtmd.ru
Yldpkozfmi.ru
Yo4nyzyc.ru
Yp7o07nq.ru
Z26hggcb.ru
Z7u4wtfe.ru
Zatuhnichmo.com
Zsrd4xj5.ru
Zumbafestival.info
Zxcvsbrds.ru
Zznks8fh.ru
Fijicool.com
1l1i16b0.com
Nl6fa53.com
Fruitboss.ru
Katamizo.info
Promoup.info
Partnerspromo.info
Zumnox.info
Bingosyssaver21.com
Bingosyssaver22.com
Bingosyssaver23.com
Bingosyssaver24.com
Bingosyssaver25.com
Bingosyssaver26.com
Bingosyssaver27.com
Bingosyssaver28.com
Bingosyssaver29.com
Bingosyssaver30.com
Freerobertodefeater.com
Myrobertodefeater.com
Newrobertodefeater.com
Robertodefeater.com
Robertodefeaternow.com
Robertodefeateronline.com
Robertodefeaters.com
Robertodefeatersite.com
Robertodefeaterstore.com
Therobertodefeater.com
Claerprotection11.com
Claerprotection12.com
Claerprotection13.com
Claerprotection14.com
Claerprotection15.com
Claerprotection16.com
Claerprotection17.com
Claerprotection18.com

No comments: