Sponsored by..

Showing posts with label Botnet. Show all posts
Showing posts with label Botnet. Show all posts

Monday 7 September 2015

Something evil on 184.105.163.192/26 / White Falcon Communications / Dmitry Glazyrin

So.. I spotted some Nuclear EK (or some other Flash exploit) traffic on our network which attracted my interest. The IP in question was 184.105.163.243 hosted on what appears to be a Hurricane Electric IP. Personally, I don't tend to see a lot of bad stuff on HE so I looked more closely at the IP WHOIS and saw it was part of a range 184.105.163.192/26 suballocated to:

contact:ID;I:POC-DC-1258
contact:Auth-Area:contacts
contact:Class-Name:contact
contact:Name:Dmitry Glazyrin
contact:Company:White Falcon Communications
contact:Street-Address:3-758 Riverside Dr
contact:City:Port Coquitlam
contact:Province:BC
contact:Postal-Code:V3B 7V8
contact:Country-Code:CA
contact:Phone:+1-510-580-4100


The next step was to query the range using DNSDB to see what has been hosted there. This came back with several thousand sites that have been hosted there in the past, the following of which are still hosted in the 184.105.163.192/26 range now..

bilettver.ru
ituslugi-ekb.ru
kerept.ru
porno-gt.com
pornosup.com
redkrab.com
vgubki.com
erotubik.com
autowagen.ru
decoitalcolor.ru
jimbobox.ru
kr-enot.ru
alemanas.ru
dynamo-energia.ru
master-lesa.ru
kinoprosmotra.net
multi-torrent.com
pl-games.ru
voyeur-hard.com
fishemania.com
learnigo.ru
qazashki.net
surfus.ru
mysuppadomainname.gq
kinoprosmotrov.net
multtracker.com
kyricabgr.tk
onlyhdporno.com
stat-irc.tk
white-wolves.tk
blondescript.com
dc-dcbcf352.hotvideocentral.com
wishfishworld.com
5ka.info
igro-baza1.ru
igro-baza2.ru
igro-baza3.ru
igro-baza4.ru
igro-baza5.ru
kinorelizov.net
torrent-mult.com
trailer-games.ru
vvpvv10.ru
vvpvv9.ru
todoke.ru
glazikvovana.cf
glazikvovana.ga
glazikvovana.gq
glazikvovana.ml
glazikvovana.tk
glazikvovki.cf
glazikvovki.ga
glazikvovki.gq
glazikvovki.ml
glazikvovki.tk
popochkavovana.cf
popochkavovana.ga
popochkavovana.gq
popochkavovana.ml
popochkavovana.tk
popochkavovki.cf
popochkavovki.ga
popochkavovki.gq
popochkavovki.ml
popochkavovki.tk
resnichkavovana.cf
resnichkavovana.ga
resnichkavovana.gq
resnichkavovana.ml
resnichkavovana.tk
resnichkavovki.cf
resnichkavovki.ga
resnichkavovki.gq
resnichkavovki.ml
resnichkavovki.tk
samaragss.ru
wechkavovana.cf
wechkavovana.ga
wechkavovana.gq
wechkavovana.ml
wechkavovana.tk
wechkavovki.cf
wechkavovki.ga
wechkavovki.gq
wechkavovki.ml
wechkavovki.tk
zalypkavovana.ml
zalypkavovana.tk

zalypkavovki.cf
zalypkavovki.ga
zalypkavovki.gq
zalypkavovki.ml
zalypkavovki.tk
zybikvovana.cf
zybikvovana.ga
zybikvovana.gq
zybikvovana.ml
zybikvovana.tk
zybikvovki.cf
zybikvovki.ga
zybikvovki.gq
zybikvovki.ml
zybikvovki.tk
staffrc.com
stopudof.com
35igr.ru
adandc.ru
avgyst.ru
comedy24.ru
e7ya.ru
funrussia.ru
ladykafe.ru
med-cafe.ru
mykazantip.ru
ohotaforum.ru
powerpoint-ppt.ru
sibledy.ru
turistvip.ru
ya-pisatel.ru
kypitest.ru
anykadavai.tk
forwarditaly.org
getyourimesh.com
mymobi.ml
yellowfrance.org

Sites that are flagged as malware by Google are highlighted and these are all hosted on 184.105.163.243. But what was interesting was what White Falcon Communications have been hosting in the past. When I ran the entirety of all the sites from DNSDB through my checker, I got some interesting results* [csv].

Out of 2867 sites analysed, 1973 (69%) sites had either hosted malware or were spammy. Some of the unrated sites are clearly phishing sites (e.g. usabanksecurity.com). Although these sites are not hosted on White Falcon Communications IPs now, they all have been at some point in the past.

So, who is this outfit? Well, it didn't take to come up with a couple of news stories, firstly this one where White Falcon had been raided by police in Canada in connection with C2 infrastructure for the Citadel botnet. That was followed by this story where White Falcon was allegedly suing law enforcement back, due to alleged "negligence".

However, given the sheer volume of crap that White Falcon has hosted in the past and its current problem with exploit kits, I would definitely recommend blocking traffic to 184.105.163.192/26 to be on the safe side.

* fields are domain name, current IP address, MyWOT ratings, Google Safebrowsing rating, SURBL status.

Thursday 16 October 2014

A bunch of .su and .ru domains leading to malware

These sites lead to some sort of malware. The presence of .SU domains hosted on what looks like a botnet is probably all you need to know. I haven't had much time to poke at these properly though, but I'd recommend watching out for these:

alinbot.ru
angryflo.ru
arnebbc.su
brokenpiano.ru
bubkagops.su
everydaypp.ru
f11europe.ru
fixiland.su
fumondaydns.in
funnygronni.com
goliathuz.com
icaldns.in
kimberlydns.in
kineshevasto.ru
levdnjord.su
madagask.ru
monkeysea.su
mysweetmon.ru
nitmurmansk.su
nomoreblack.su
odekon.su
opolla.ru
proffygroup.ru
salgarian.su
slimsize1.su
slowdownn.ru
solofrikred.su
superbup.su
temeluchus.ru
tomasz.su
whoisjohnthefirst.ru
winstent.su
wzorcd.ru
xchy3yzbdcavqij3dcr3.ru
ywaiukgcmmmcwqmk.org

108.21.223.101
109.104.174.109
109.104.184.20
109.120.7.117
109.162.32.234
109.162.6.112
109.184.141.196
109.196.77.198
109.201.232.221
109.227.103.153
109.227.105.88
109.227.114.50
109.227.91.150
109.254.116.68
109.60.243.38
109.86.76.58
109.86.83.167
119.18.77.27
121.176.22.15
125.135.166.159
130.204.235.160
134.19.225.199
134.249.15.60
134.249.65.178
14.33.25.64
141.101.27.2
141.101.3.150
158.181.134.227
158.181.14.38
158.181.169.88
158.181.175.126
159.224.101.52
173.171.103.248
173.49.70.65
174.61.141.129
176.100.28.115
176.102.209.127
176.104.253.21
176.104.97.17
176.105.201.21
176.106.31.227
176.114.32.97
176.114.38.72
176.118.144.240
176.118.45.228
176.120.39.87
176.193.22.49
176.193.37.112
176.215.117.210
176.239.12.104
176.36.48.185
176.36.68.13
176.8.203.177
176.8.95.116
176.98.22.147
176.99.226.87
178.132.2.153
178.137.175.36
178.137.215.186
178.137.232.234
178.141.98.158
178.150.104.8
178.151.0.25
178.158.135.20
178.158.16.193
178.158.16.248
178.159.122.213
178.212.101.94
178.213.175.151
178.213.189.58
178.216.227.71
178.219.91.40
178.74.212.207
178.74.226.67
178.89.203.41
178.90.99.120
178.91.41.119
178.94.92.212
185.10.2.11
185.32.120.210
188.0.120.49
188.163.31.16
188.163.50.18
188.214.33.160
188.230.1.99
188.230.15.191
188.230.87.17
188.239.5.123
193.111.241.125
193.34.94.85
194.187.111.74
194.44.252.229
194.44.37.3
195.114.145.188
195.114.147.96
195.138.75.163
195.174.42.216
195.242.81.56
195.72.156.236
2.132.61.249
2.135.129.248
2.135.87.207
206.174.99.120
208.107.176.24
212.22.192.224
212.79.119.49
212.90.32.62
212.92.237.199
212.92.253.167
213.111.151.156
213.111.183.205
213.129.111.70
213.164.123.63
213.174.10.241
213.231.11.136
213.231.49.184
217.112.220.202
217.12.122.58
217.175.85.76
217.197.252.11
218.52.52.157
24.163.109.78
24.214.93.170
27.147.182.44
31.130.4.1
31.131.137.63
31.133.79.131
31.133.79.205
31.134.19.130
31.134.211.43
31.135.140.114
31.170.156.146
31.192.156.153
31.28.249.94
31.41.116.88
31.41.72.159
37.110.12.9
37.115.110.8
37.115.229.27
37.115.33.96
37.115.65.28
37.140.106.117
37.229.189.190
37.229.54.152
37.25.103.214
37.25.106.88
37.53.73.152
37.55.61.26
37.57.159.200
37.57.244.98
37.57.97.229
46.118.162.62
46.118.220.117
46.118.228.6
46.118.46.202
46.119.157.204
46.119.85.215
46.119.90.143
46.146.40.134
46.149.177.86
46.149.48.133
46.160.79.233
46.164.179.75
46.172.211.150
46.172.230.166
46.173.171.118
46.185.51.76
46.185.98.100
46.191.172.157
46.211.40.28
46.211.74.12
46.219.77.143
46.33.243.82
46.61.62.152
46.63.135.3
46.63.66.102
46.98.171.128
46.98.174.49
5.1.27.92
5.1.28.199
5.105.120.46
5.137.71.123
5.153.189.97
5.246.178.134
5.248.243.117
5.34.18.37
5.56.111.111
50.134.47.136
50.154.149.189
62.16.38.131
62.220.53.85
62.80.181.42
62.84.254.75
67.183.123.151
70.114.48.81
70.53.172.129
72.185.199.204
72.80.145.90
74.103.3.126
75.131.252.100
75.76.166.8
76.17.60.31
77.120.183.13
77.121.105.26
77.121.129.150
77.121.140.120
77.122.153.68
77.71.188.240
77.95.92.254
78.131.93.231
78.27.159.75
78.27.183.113
79.113.160.194
79.114.113.151
79.132.17.125
79.134.2.105
79.171.124.211
80.245.117.198
80.64.81.51
81.162.70.55
81.162.75.68
81.163.142.181
81.163.153.185
81.200.148.6
81.90.233.231
82.117.243.39
83.218.228.46
85.198.171.90
85.237.35.122
85.29.154.152
87.110.167.54
87.76.61.30
88.135.93.105
89.105.249.250
89.116.191.51
89.161.84.65
89.209.91.107
89.252.29.97
89.254.147.242
91.196.97.220
91.197.187.189
91.198.143.44
91.200.232.86
91.201.243.191
91.203.89.26
91.207.86.210
91.210.87.242
91.222.63.1
91.223.86.185
91.243.203.238
91.250.34.68
92.112.156.8
92.113.161.218
92.113.4.121
92.114.123.227
92.245.40.208
92.55.30.207
93.170.68.140
93.171.77.198
93.183.247.117
93.76.240.22
93.76.57.57
93.77.75.2
93.78.145.22
93.79.177.59
93.79.199.81
94.100.95.109
94.153.125.201
94.153.53.132
94.153.69.169
94.178.216.34
94.179.99.149
94.231.32.32
94.231.72.194
94.244.173.95
94.45.92.6
95.135.58.25
95.215.117.207
95.47.128.209
95.66.202.226
95.76.64.224
95.87.94.65
96.26.196.66
98.111.140.190
98.244.185.173
98.245.227.235




Monday 22 April 2013

Malware sites to block 22/4/13

These domains form part of a large Kelihos botnet described over at Malware Must Die and which is related to the recent Boston Marathon and Texas Fertilizer Plant spam runs. There are probably thousands of IP addresses, but so far I have identified just 76 domains that seem to be active (there are a large number of subdomains). Monitoring for these may reveal Kelihos activity on your network.

Update: a list of associated IPs can be found here. There are too many to analyze, but the majority seem to be hacked PCs in Ukraine, Russia, Bulgaria and Poland.

agrybnyd.ru
akafneyd.ru
aqloqsis.ru
bajidmed.ru
butlesuh.ru
ciwefbod.ru
conrozof.ru
dapxonuq.ru
derdepan.ru
dijxohqa.ru
dydebmek.ru
dypuhtiw.ru
emysgual.ru
ewhynwox.ru
fadanres.ru
fubkimab.ru
funkabyv.ru
fuqiwriv.ru
gojzawde.ru
howoggoc.ru
ickyrjum.ru
ivsykifa.ru
jabfetiq.ru
jakyskyf.ru
jehbuqri.ru
jigzilys.ru
jujeblob.ru
juqhasri.ru
jykoamny.ru
kezamzoq.ru
kolasoeg.ru
kuiffaam.ru
lohdyrpa.ru
melijfes.ru
meuhwycu.ru
migyxluk.ru
mujosdim.ru
needhed.com
nudegnuc.ru
nurwiwur.ru
nyhhakfi.ru
okxusout.ru
ovxurxom.ru
poretget.ru
qeqgomha.ru
qevihnit.ru
qyxpucaf.ru
rezselix.ru
rigyhdyq.ru
rithakip.ru
sagucqyp.ru
sahiwten.ru
siajxenu.ru
sigkeqvi.ru
soljasek.ru
taurbael.ru
tuhoxkyt.ru
tuklicit.ru
tuswusah.ru
ubhyfnyz.ru
ufqinweb.ru
ulvojfol.ru
vezylgys.ru
wirxopiz.ru
wylovpuc.ru
xikgygga.ru
xujxiwli.ru
yddivvev.ru
yhwursyn.ru
yhzewguv.ru
ymvuchyq.ru
yskicfuw.ru
ytliywax.ru
zahebfox.ru
zaszigic.ru
zurgeqyr.ru