Sponsored by..

Tuesday 7 May 2013

Something evil on 151.248.123.170, Part III

I've covered 151.248.123.170 (Reg.ru, Russia) a couple of times in the past month [1] [2], and it's still actively pushing out malware via dynamic DNS domains, many of which are injection attacks on hacked sites.

There are hundreds or possibly thousands of malicious domains on this IP. Blocking them individually is likely to be problematic, the best approach is to block all traffic to 151.248.123.170 or to the Dynamic DNS domains involved.. although this might potentially block access to some legitimate sites.

These are the Dynamic DNS domains being abused (you should consider blocking them in my opinion):
3utilities.com
4mydomain.com
4pu.com
changeip.org
ddns.ms
ddns.us
dns04.com
dsmtp.com
dynamicdns.biz
dynamic-dns.net
freeddns.com
ftpserver.biz
ikwb.com
itemdb.com
jetos.com
lflinkup.net
mefound.com
myddns.com
myftp.org
myfw.us
mypicture.info
mysecondarydns.com
myvnc.com
ninth.biz
no-ip.biz
no-ip.info
no-ip.org
ns01.biz
ns01.info
ns02.us
ns3.name
ocry.com
organiccrap.com
otzo.com
port25.biz
redirectme.net
servebeer.com
serveblog.net
servecounterstrike.com
serveftp.com
servegame.com
servehalflife.com
servehttp.com
servemp3.com
servepics.com
servequake.com
serveusers.com
xxuz.com
youdontcare.com

These are the domains that I can detect on the IP, but there are probably many, many more.
0j6nlxx1.myftp.org
0x0ipb74i.myvnc.com
162u8ugl.servehttp.com
1wupkdyz.no-ip.org
2fwujpyj78.servehttp.com
2j9smce4.myvnc.com
3b51lly0.serveftp.com
3lejjwtbog.no-ip.info
3s5c4v.no-ip.org
3xdt4ejh6.servegame.com
4ur8266w.servebeer.com
6a3wfiznv.servepics.com
6lb311je7.servegame.com
6r69m9b5.serveftp.com
6vdsce2.myvnc.com
7rhw1bpqw.redirectme.net
8dcfv6ba.servepics.com
8f3rkuz.servehttp.com
8k4y6s14g.servequake.com
8kli99kzom.servehalflife.com
8vf9eijal.servehttp.com
9jss9fkfz.servebeer.com
9t2ok1w.servehttp.com
9trcul.3utilities.com
acqdpoqlhtlt.myfw.us
acydtk.itemdb.com
ae6s7iq.servemp3.com
aeqxvegity.changeip.org
agbrtjbdmn.dsmtp.com
ah8d1itwz4.servehalflife.com
ahbedbxyo.myfw.us
aivcdizhr.myfw.us
alspyjnx.serveusers.com
anghootuveg.myfw.us
aqbpswfpj.myfw.us
aqmcuaegy.mefound.com
aqydiv.mefound.com
arziphhrov.dsmtp.com
ass6j8glsg.servehalflife.com
astvrbbad.4pu.com
ataiyhhx.xxuz.com
attxrhs.ns3.name
auhjlwn.ftpserver.biz
aupmbeutcbr.myfw.us
awuddyedd.myfw.us
awxtfktz.youdontcare.com
ayfmlz.changeip.org
aywejlbwn.4pu.com
azxbxx.organiccrap.com
bamwkq.ikwb.com
bawhla.otzo.com
bemtknoufs.4pu.com
bfatsqv.organiccrap.com
bfvidbvewl.mypicture.info
bgmya4t.no-ip.biz
biwqqkzcsa.dynamic-dns.net
bkgeepguwu.youdontcare.com
bnnpvmf.4pu.com
bofapqngse.ddns.us
briirddzbn.myfw.us
btpqyb1p7a.servebeer.com
bzyphcsjcrhs.myfw.us
chlcsqnh.myddns.com
ckbqvlouqe.serveusers.com
cnsycrdv.organiccrap.com
cqunky.xxuz.com
csggbzz.ikwb.com
cttjhki.dynamicdns.biz
cuhadjcnyl.myfw.us
cuimcgv.dns04.com
cundqzpc.youdontcare.com
cuupggih.4pu.com
cvgjzgjabfzz.myfw.us
cwabkfjsh.organiccrap.com
cwfbslqwj.organiccrap.com
cymkwqz.ftpserver.biz
cysbagz.mysecondarydns.com
czbzcx.jetos.com
czjgxkcbf.freeddns.com
czyllsokwi.dynamic-dns.net
ddamrkgie.mypicture.info
ddmvubybx.myfw.us
ddzcvtvglpgb.myfw.us
detnqgkbjahg.myfw.us
dgdgfs.dynamicdns.biz
djgoaf.mysecondarydns.com
dkpdfe.port25.biz
dmfqtxoqvmbe.myfw.us
dnvkizwemfmy.myfw.us
dpwmvwqa.ftpserver.biz
dqmbhghc.itemdb.com
drxjqr.serveusers.com
drzvmd.ns3.name
dtjkin.ns01.info
dukr7abe6.serveftp.com
dumqgfkodvko.myfw.us
dxexzx.port25.biz
eajwozhkn.myfw.us
ecqhffsix.youdontcare.com
edbjaepjg.myfw.us
edefwbh.ftpserver.biz
eeerrtnzii.ftpserver.biz
ehaxoe.mysecondarydns.com
eifmydan.organiccrap.com
ekmlvqvc.dns04.com
emhkyc.ns3.name
encrtggml.youdontcare.com
eogxekpdtcvb.myfw.us
epllsmxckoo.myfw.us
erygtbkshcz.myfw.us
esmiqsq.mysecondarydns.com
eufdldv.mypicture.info
evbntlv.dynamicdns.biz
evkhegeue.myftp.org
exrjzleph.myfw.us
ezbbhtfo.freeddns.com
ezrzmcnmwkl.myfw.us
ezzbnjwtz.changeip.org
fbwlwfnboll.myfw.us
ferzds.ns01.info
fhlswqcai.4pu.com
fitiioenutsp.myfw.us
fjbcsk.otzo.com
fkvqztwwitsm.myfw.us
fmdetqh.dsmtp.com
fntqexnwhjdz.myfw.us
fqbiankg.ikwb.com
fqguhzwcasmj.myfw.us
fqzbwstxyypa.myfw.us
fryjpao.myddns.com
frzfhndxw.itemdb.com
fum22fhpi.servegame.com
fxkooknk.itemdb.com
fxxpnp.itemdb.com
fyuccxbvon.jetos.com
fzeypa.ns3.name
g5fm891.3utilities.com
gaaemoaa.itemdb.com
gaolppjyq.myfw.us
gblfhdwbegow.myfw.us
gdlvqfak.4pu.com
getbwoedccls.myfw.us
gexurmmntx.changeip.org
gfdwowolvt.myfw.us
gfwmxzpvnp.myfw.us
ggpmov.ddns.us
gidnmygaum.ddns.us
gjsqbsqawb.myfw.us
gnbaamarlyit.myfw.us
gpqfskqe.lflinkup.net
gtvqed.organiccrap.com
gtyvjhvw.port25.biz
gumyfsjo.itemdb.com
gwgz8nz7bu.servepics.com
gwhwyvf.ocry.com
gxdcjg.dynamic-dns.net
gzfbhckcddl.myfw.us
h898k9wo.serveftp.com
hbvqaddxz.myfw.us
hdbbzvxejqn.myfw.us
hdowbe.servehttp.com
hdskfrel.ninth.biz
hdwuuvr.ddns.us
hdzfbnlenp.ninth.biz
hefqgipiv.myfw.us
hfltusb.ocry.com
hgibkcayvxc.myfw.us
hgqsiruxft.myfw.us
hgykiuwwh.organiccrap.com
hopucovetkbn.myfw.us
hpnfoqes.ftpserver.biz
hqvjpdsqa.organiccrap.com
hrwouxktkt.ftpserver.biz
hszdvlv.mefound.com
htensj.xxuz.com
hvdqroibk.port25.biz
hvjmsvfdmeab.myfw.us
hvmkidxvr.dynamic-dns.net
hvywhncmn.itemdb.com
hxqvvy.changeip.org
i74hiyo2y.no-ip.org
iappjftw.itemdb.com
iavvgjkk.ftpserver.biz
idjwfvk.dynamicdns.biz
iftewoyvwpob.myfw.us
ijccqljgr.myfw.us
ilugmefnc.freeddns.com
iqyqszqf.lflinkup.net
iriqvotyaz.ns01.biz
irszbliskh.myddns.com
iskiyiha.ninth.biz
iszibayuer.myddns.com
ithnqo.4pu.com
ituevs.xxuz.com
iub483p4.servegame.com
ivkpydtby.no-ip.org
iwhabdyn.serveusers.com
iypjnpcqw.myfw.us
izdzccr.xxuz.com
jacqvk.lflinkup.net
jaiftyxs.mysecondarydns.com
jaqmastga.itemdb.com
jbtcinyjv.4pu.com
jdfoggkzh.serveusers.com
jeaalexymm.myfw.us
jeldtld.organiccrap.com
jenzxchy.ns01.biz
jflhcqv.ikwb.com
jgbkbtyz.freeddns.com
jirshkrgu.youdontcare.com
jjjpbhx.4pu.com
jlbabnosva.otzo.com
jmiqcslfum.ns01.info
jnpknqp.lflinkup.net
jonaybvvy.itemdb.com
jpqtaqvaln.myfw.us
jpvjaujch.myfw.us
jqkaywyy.myddns.com
jupdsuhoh.youdontcare.com
jw5w8658z.redirectme.net
jxxemgpdyqk.myfw.us
kaavrqisc.myfw.us
kamxaip.mypicture.info
kchergnrxp.myfw.us
kcjbeu.ocry.com
kdeftpvpng.dynamic-dns.net
kejzxgh.4pu.com
knmbrnexxh.mysecondarydns.com
knvspjvyz.itemdb.com
koqlwnbku.serveusers.com
kplfuxjzy.myfw.us
kpvshgdss.ns3.name
krnwhhhtwvh.myfw.us
krwwhoehyl.myfw.us
kukxizdui.4mydomain.com
kycwuhgvc.serveusers.com
kyfmidqmh.4pu.com
kzklrwv.serveusers.com
l1y3o4o.serveblog.net
l2z0i6s1.servehttp.com
lajbbeqj.jetos.com
laqsaui.ns01.info
lclcnkhccdl.myfw.us
ldvdfx.ikwb.com
lhbqxfuvy.ocry.com
ljnanlpatrwd.myfw.us
llbguuda.ikwb.com
llotmdufz.dns04.com
lozbalothmc.myfw.us
lrnqgxgoa.ikwb.com
lsjqlbo.port25.biz
lusvrj.dsmtp.com
luyyyd.mysecondarydns.com
lwnplgpton.dsmtp.com
lwtujojereoi.myfw.us
lxpilprs.myddns.com
lyleqfeq.4pu.com
meuquma.ddns.us
mfdteohcrc.youdontcare.com
mfksblicgi.ocry.com
mfyxqutszl.otzo.com
mikxwsfmj.changeip.org
mkgwgjgwci.ddns.us
mrfltmzyeseg.myfw.us
mrnmqdsxfyze.myfw.us
muqvwvf.freeddns.com
mvdqmecbf.myfw.us
mvjlxlyjp.myfw.us
mvuqao.myddns.com
mwqgxlttg.ns01.biz
mx0t2z.servecounterstrike.com
myhnzszkoe.myfw.us
myijyjux.organiccrap.com
mzikrrzf.jetos.com
mzxkmjmquo.myfw.us
naxfpmhw.ninth.biz
ncywhwofn.dsmtp.com
nczgqdlrys.myfw.us
negkht.changeip.org
nhzgjm.dynamic-dns.net
nmwikbwrxia.myfw.us
nnufbc.dynamicdns.biz
npfhqlsm.dynamic-dns.net
npphmnxy.ddns.us
nqusbcphiby.myfw.us
nrpfyekqlk.dynamic-dns.net
nrqmusuueb.serveusers.com
ntbdeedkj.dsmtp.com
nuzmis.itemdb.com
nxcgynyedfs.myfw.us
oatg31.servehalflife.com
ocrrwieqzlha.myfw.us
ohustyl.mysecondarydns.com
okbriapkfb.mefound.com
okeqqnzcge.myfw.us
oliwkndvyxw.myfw.us
omuiekhqjg.myfw.us
oonfrqcocu.myfw.us
oonqydmt.ikwb.com
opaalghwxqlt.myfw.us
opsypzduo.myfw.us
oqccjqk.ikwb.com
oreywhh.serveusers.com
otcdaq.ns02.us
otnblbzjo.serveusers.com
otrshugxco.dynamic-dns.net
otsgcgz.servehttp.com
outwlswin.4mydomain.com
ouurcv.4mydomain.com
ovamujvhsa.dsmtp.com
owljtjpwb.myfw.us
ownowavbfj.ns01.info
oykqbk5bqf.servemp3.com
oywwrii.organiccrap.com
ozgaoshpd.mefound.com
ozxvjdyz.changeip.org
p9kc1ha4.servemp3.com
panvscen.ddns.us
pcafwnm.ikwb.com
pddcmcvof.mysecondarydns.com
peusfapdz.myfw.us
pjhzlriy.ninth.biz
pjrkvghqg.ocry.com
pjvcoazluq.dsmtp.com
pkyowjrjycw.myfw.us
pluowrgpl.myfw.us
pmkihqq.mypicture.info
ppakfotxhpy.myfw.us
ppmdbwqxcrv.myfw.us
ppsjpvzmjg.serveusers.com
prdjva.otzo.com
ptyxbmzkz.itemdb.com
pwkbuuor.xxuz.com
pwkwxztpaj.myfw.us
pyyxiapoxv.myfw.us
qcwkznq.dsmtp.com
qdfjptc.ns01.info
qfawknwtl.myfw.us
qfvrlt.4pu.com
qhfxww.dns04.com
qiwxwwy.dns04.com
qjhdnvjrn.changeip.org
qmnouatnlelp.myfw.us
qmnrup.mysecondarydns.com
qnljeztgg.changeip.org
qnwycifjfl.myfw.us
qplgaurnspl.myfw.us
qtbxjkot.ocry.com
qvvefzzj.ocry.com
qwwxtgojc.ninth.biz
qxp9xez9.3utilities.com
qzlkluald.myfw.us
qzsoegkp.dsmtp.com
r4g6m2.servehttp.com
ramtaky.4pu.com
rbnumsmbygqb.myfw.us
rcezlgb.ns3.name
rclmhzj.mefound.com
rdhrrxlyu.port25.biz
rebcdbgzic.ftpserver.biz
reoenqybu.myfw.us
rgtyavgys.freeddns.com
rhxiepm.ns3.name
ricznb.port25.biz
rjolnrlnpn.serveusers.com
rkaseooypl.myfw.us
rnordfancw.mefound.com
rnrbdynkblyb.myfw.us
rpbdqzdemsu.myfw.us
rtxektc.xxuz.com
rujaafdzwq.xxuz.com
rutqjnsex.myfw.us
rwscdhnhn.4mydomain.com
rxnirgmhsgwv.myfw.us
rxuvkq.mefound.com
rygsjmlss.dsmtp.com
rzreau.myddns.com
sb0y2h.myftp.org
sbjbuclp.dns04.com
seronwzic.myfw.us
serszgynbi.mysecondarydns.com
sgcdujudgzm.myfw.us
simiawbsilu.myfw.us
sjjcmisyd.mysecondarydns.com
skfynaq.serveusers.com
slcnxx.dynamic-dns.net
slcvzheogxph.myfw.us
smjyq1vm.serveftp.com
snediezzlsq.myfw.us
snozgi.organiccrap.com
sopnxhpyjb.port25.biz
sozsybvook.myfw.us
sozuzt.ddns.us
sqdgixmrki.dynamicdns.biz
sqqttryu.itemdb.com
swvgvgldodz.myfw.us
swxxruj.dynamicdns.biz
szsitxy.4pu.com
taokofzze.dynamic-dns.net
tbpsuzdk.port25.biz
tbrfrz.lflinkup.net
tcdcyjxit.ddns.ms
tcutixej.ikwb.com
tfqvhdg.otzo.com
tfywivnfc.myfw.us
tlasuq.itemdb.com
tlggqcgx.ftpserver.biz
tmipoitnfj.myfw.us
tq5wmetanb.servecounterstrike.com
tqzhbfaoy.ns02.us
tsxkxilw.ikwb.com
tufslzazbs.mypicture.info
tuvyov.changeip.org
uegnytqslcm.myfw.us
uelrmywt.ddns.us
uftmrikaydi.myfw.us
ugrhad.dynamic-dns.net
umogoraqz.myfw.us
unkcwjcrmh.otzo.com
utcdmox.dynamic-dns.net
uttptbyvgr.organiccrap.com
uucnwdbptssb.myfw.us
uufqumjr.youdontcare.com
uw35u18.servemp3.com
uwivsj.mefound.com
uwoyvvwvz.myfw.us
uyblrr.dsmtp.com
uyubmke.ns02.us
uzaqlbvvw.ninth.biz
vajoznzefrpt.myfw.us
vawhnrazl.organiccrap.com
vbgbbbjkr.mefound.com
vbhxqbwpt.myfw.us
vdbcdlmwie.port25.biz
ve57fs4.no-ip.org
vgyxuawyxb.myfw.us
vhfemrmovaiq.myfw.us
viptao.ddns.us
viqvti.ns01.info
vktlhllldxz.myfw.us
vpogbb.ns01.info
vpxnbn.organiccrap.com
vtzetcj.ftpserver.biz
vyjhuhol.ftpserver.biz
vysanjugba.changeip.org
wbgavjt.port25.biz
wbhglzsnqe.mypicture.info
wbjnmudcekl.myfw.us
wcxqvknrd.myfw.us
wenrtsjzbc.myfw.us
wfgjxiai.jetos.com
wfjktwnlfx.4mydomain.com
wgolucqns.myfw.us
whaumhrm.organiccrap.com
whpiiimwpodx.myfw.us
whsdoygqm.myfw.us
wilompgsaf.myfw.us
wjdakob.serveusers.com
wkbmaebigy.xxuz.com
wlrdvucbw.myfw.us
wmfqnjimufe.myfw.us
wmhvxsyex.dynamic-dns.net
wmjjdhqfev.myfw.us
wmnrrskry.myfw.us
wnxran.itemdb.com
wpjbcs.ns3.name
wtaumavodr.mysecondarydns.com
wthsard.dsmtp.com
wtriylabiccu.myfw.us
wuamrecon.myfw.us
wzjaaohoigzj.myfw.us
wzkjljfhfx.myfw.us
xcltzwbpmf.4mydomain.com
xfhhefpp.ns01.info
xicrkcb.dynamic-dns.net
xjtkbawsfc.ninth.biz
xkfrazfa.changeip.org
xkxbhbnc.organiccrap.com
xlhppgpktfrq.myfw.us
xosjtax.itemdb.com
xrjwwo.dsmtp.com
xtjypuoa.ftpserver.biz
xtkwuntrv.organiccrap.com
xufntdrj.ns01.info
xujepnjhas.dns04.com
xvsfuixww.organiccrap.com
xwnnmn.ns01.info
xygvilyksie.myfw.us
xzbqujbaj.ocry.com
xzphozmjxqsd.myfw.us
ybcpncmnea.ddns.ms
ydadyu.serveusers.com
yffrfdbkaq.myfw.us
yirlmqgnl.ns3.name
yjrpzzveovi.myfw.us
ynoljubnwos.myfw.us
ynskejsvl.myfw.us
ypccsuwr.ns3.name
yqkdkhqlei.ns01.info
yrtbvvytij.myfw.us
ys9hh20i.servehttp.com
yupbgt.4pu.com
yvwyrbgaji.serveusers.com
yxkudyzfnuv.myfw.us
yywgvpqrpeym.myfw.us
yzmgroem.changeip.org
yzytnygb.ftpserver.biz
yzzihzpo.mysecondarydns.com
zbauqs.ns01.info
zbirjhbbwb.ocry.com
zc287xl.servepics.com
zcauzvzqm.ftpserver.biz
zenxdduid.myfw.us
zhdlzrwzlw.myfw.us
zhudyeczk.myfw.us
zixxjxpc.mefound.com
zjbihpktdn.myfw.us
zkaowad.ddns.ms
zklseo.ddns.us
zmrycmomb.jetos.com
znfrriscgl.myfw.us
zphazatgvuob.myfw.us
zqt4wnw.myftp.org
zrizzrhxcmy.myfw.us
zrqkczmec.dynamic-dns.net
ztvbimxeq.myddns.com
zviwqprs.dynamic-dns.net
zwnovqmrquml.myfw.us
zxjczhjvq.otzo.com
zyttqhhvc.ns3.name
zzifxrfob.dynamicdns.biz
zznbfpbjpqpm.myfw.us

No comments: