Sponsored by..

Monday, 20 October 2014

beeg.com hacked (again)

Earlier this year I looked at a hack attack on popular porn site beeg.com (Alexa rank 429) which appeared to be something to do with a fake advertising agency that had bought ad space.

Well, it appear that beeg.com has been hacked again (as of yesterday) [1] [2] [3] and has been serving up an exploit kit (which appears to have been cleaned up now).

What's interesting about this attack are the domains in use, all using .CF (Central African Republic), .GA (Gabon), .ML (Mali) plus the more commonly abused .TK and .UNI.ME. The domains detected are listed at the end of this post, but they all appear to be dead now.

All the domains in question use nameservers using the domain rezupsell.com which uses an anonymous registration, but which itself uses reg3.ru nameservers which perhaps gives a clue as to the general origins of this attack.

The malicious hosts were based on the following IPs which might be worth blocking:

192.208.185.103 (Continuum Data Centers, US)
64.187.224.62 (Microglobe LLC, US)
64.251.19.156 (Infolink / Serverpronto, US)


(plain list for copy-and-pasting)
192.208.185.103
64.187.224.62
64.251.19.156

The domains that seem to be associated with this attack are as follows:
axxesopri.cf
carrillen.cf
casselful.cf
ceurstros.cf
chcontaca.cf
ciscomphy.cf
coperhemi.cf
cymersion.cf
disticsis.cf
elenecyat.cf
geommibun.cf
kofaxiors.cf
leumilyso.cf
moultrayi.cf
newspryga.cf
oruminfol.cf
oxbretrin.cf
pathotect.cf
romarflyt.cf
samarkare.cf
shtanakin.cf
spotalaba.cf
stanaderi.cf
tinginest.cf
trollethi.cf
univalone.cf
yocreitaw.cf
zinifersi.cf
librayippinedi.cf
locinagenphafe.cf
obusicaressoft.cf
pandalinexitys.cf
parsportertuel.cf
picabulsteeneo.cf
portgateaminem.cf
pucreweatiange.cf
sysoplanitolbr.cf
techrintorcell.cf
tentectrilyawp.cf
thngrxiamedier.cf
toresilvadplet.cf
axxesopri.ga
casselful.ga
ceurstros.ga
chcontaca.ga
ciscomphy.ga
coperhemi.ga
cymersion.ga
disticsis.ga
elenecyat.ga
geommibun.ga
kofaxiors.ga
leumilyso.ga
moultrayi.ga
newspryga.ga
oruminfol.ga
oxbretrin.ga
pathotect.ga
romarflyt.ga
portgateaminem.cf
shtanakin.ga
spotalaba.ga
stanaderi.ga
tinginest.ga
trollethi.ga
univalone.ga
yocreitaw.ga
zinifersi.ga
librayippinedi.ga
locinagenphafe.ga
obusicaressoft.ga
pandalinexitys.ga
parsportertuel.ga
picabulsteeneo.ga
portgateaminem.ga
pucreweatiange.ga
sysoplanitolbr.ga
techrintorcell.ga
tentectrilyawp.ga
thngrxiamedier.ga
toresilvadplet.ga
acrostorilifeg.uni.me
actuallessaric.uni.me
adianaldbalide.uni.me
adzilablenetsk.uni.me
aestatchapease.uni.me
aistedianametr.uni.me
akedianonligno.uni.me
aladdiersought.uni.me
altonemagingso.uni.me
annousynqsoftv.uni.me
armanorducketi.uni.me
articatianavia.uni.me
ascetonbringra.uni.me
asitegoldnterp.uni.me
asurcersalcode.uni.me
aumentediaside.uni.me
axiantfxtresti.uni.me
aycarpaxcellon.uni.me
backcopartveit.uni.me
barretaballtip.uni.me
bazzinguatelee.uni.me
bectechedianel.uni.me
benshnorgerven.uni.me
beyoneyentpoin.uni.me
boldowngottoni.uni.me
boxholephoniwo.uni.me
breadischarksm.uni.me
axxesopri.ml
carrillen.ml
casselful.ml
ceurstros.ml
chcontaca.ml
ciscomphy.ml
coperhemi.ml
cymersion.ml
disticsis.ml
elenecyat.ml
geommibun.ml
kofaxiors.ml
leumilyso.ml
moultrayi.ml
newspryga.ml
oxbretrin.ml
pathotect.ml
samarkare.ml
shtanakin.ml
spotalaba.ml
stanaderi.ml
tinginest.ml
trollethi.ml
univalone.ml
yocreitaw.ml
zinifersi.ml
locinagenphafe.ml
obusicaressoft.ml
pandalinexitys.ml
parsportertuel.ml
picabulsteeneo.ml
portgateaminem.ml
pucreweatiange.ml
sysoplanitolbr.ml
techrintorcell.ml
tentectrilyawp.ml
thngrxiamedier.ml
toresilvadplet.ml
axxesopri.tk
carrillen.tk
casselful.tk
ceurstros.tk
chcontaca.tk
ciscomphy.tk
coperhemi.tk
cymersion.tk
disticsis.tk
elenecyat.tk
geommibun.tk
kofaxiors.tk
leumilyso.tk
moultrayi.tk
newspryga.tk
oruminfol.tk
oxbretrin.tk
pathotect.tk
romarflyt.tk
samarkare.tk
shtanakin.tk
spotalaba.tk
stanaderi.tk
tinginest.tk
trollethi.tk
univalone.tk
yocreitaw.tk
zinifersi.tk
librayippinedi.tk
locinagenphafe.tk
obusicaressoft.tk
pandalinexitys.tk
parsportertuel.tk
picabulsteeneo.tk
portgateaminem.tk
pucreweatiange.tk
sysoplanitolbr.tk
techrintorcell.tk
tentectrilyawp.tk
thngrxiamedier.tk
toresilvadplet.tk

No comments: