Sponsored by..

Showing posts with label Evil Network. Show all posts
Showing posts with label Evil Network. Show all posts

Monday, 21 November 2016

Something evil on 64.20.51.16/29 (customer of Interserver, Inc)

I wrote about this evil network on 64.20.51.16/29 (a customer of Interserver, Inc) over a year ago, identifying it as a hotbed of fraud. Usually these bad networks don't hang around for very long, but in this case it seems to be very persistent.

This time it came to notice from a terse spam with a PDF attached:

From:    Lisa Liang [ineedu98@hanmail.net]
To:    me@yahoo.com
Date:    20 November 2016 at 23:23
Subject:    11/21/2016 Amended

FYI
Attached is a file Amended copy.pdf which when you open it (not recommended) looks blurry with "VIEW" in big red letters.

The link in the email goes to bit.ly/2fJbyol - if you put the "+" on the end of a Bitly link then you can see the number of clickthroughs and what the landing page is (www.serviceupgrade.tech/pdf.php in this case).

Clicking through gives you a login page for "Adobe PDF Online" which is of course a generic phishing page.


Analysis of the 64.20.51.16/29 range finds 193 sites historically connected with it marked as being phishing or some other malicious activity. There are at least 284 sites currently within that range, of which the following are both hosted in that range currently and are malicious:

sparvicharityfoundation.com
ftp.eurocontrol-int.net
eurocontrol-int.net
bocusin.com
eurocontrol-int.net
meclp.com
lntedg.com
bs-shipmanagements.com
rolloninz.com
outlook-excell.com
safetech-online.com
lrbis.com
stmposlka.com
combinaparts.com
gsctechinology.com
writverify-online.com
ubsinvbnk.com
kiy-carbon.com
hsbcoffshores.com
natural-live.top
ftp.daemon-mail.com
ftp.paypalcenter.com
mobile-secure.us
zharmonics-online.com
nahpa-vn.com
djhexport.com
paypalcenter.com
victorialmpex.com
schmiditsports.com
lindner-stofftiere.com
novady.top

11% of the total sites in the range have been tagged by SURBL or Google as being bad, and to be honest there are probably a LOT more but those services haven't caught up yet.

In any case, there seems to be nothing of value in 64.20.51.16/29 and I strongly recommend that you block traffic to the entire range.




Tuesday, 1 November 2016

Malware spam: "New Fax Message" / administrator@local-fax.com leads to TrickBot

This fake fax leads to TrickBot which appears to be similar to the Dyre banking trojan that we saw a lot of last year..

From:    Administrator [administrator@local-fax.com]
To:    annie@[redacted]
Date:    1 November 2016 at 13:28
Subject:    New Fax Message
Signed by:    local-fax.com

Confidential Fax
Date: 01/11/2016
Recipient: annie@[redacted]
From: +443021881211
Attn:
Important document: For internal use only
The documents are ready. Check attached file for more information.

[THIS IS AN AUTOMATED MESSAGE - PLEASE DO NOT REPLY DIRECTLY TO THIS EMAIL]

Confidentiality Notice: The information contained in this message may be confidential and legally privileged. It is intended only for use of the individual named. If you are not the intended recipient, you are hereby notified that the disclosure, copying, distribution, or taking of any action in regards to the contents of this fax - except its direct delivery to the intended recipient - is strictly prohibited. If you have received this fax in error, please notify the sender immediately and destroy this cover sheet along with its contents, and delete from your system, if applicable.



Attached is a Word document (in this case Internal_Fax.doc) which has a pretty low detection rate at VirusTotal of 5/54. Both the Malwr report and Hybrid Analysis give some clues as to what is going on, but in fact the Malwr report comes out with a binary download location of:

www.tessaban.com/img/safafaasfasdddd.exe

This is a hacked legitimate website. Downloading that file manually and resubmitting it gives two rather more interesting Malwr and Hybrid Analysis reports give the following suspect traffic:

91.219.28.77 (FLP Kochenov Aleksej Vladislavovich aka uadomen.com, Ukraine)
193.9.28.24 (FLP Kochenov Aleksej Vladislavovich aka uadomen.com, Ukraine)
37.1.209.51 (3NT Solutions LLP, UK)
138.201.44.28 (Philip Diver, Australia / Hetzner, Germany)
23.23.107.79 (Amazon EC2, US)

I can match all those IPs except the last to this ThreatGeek report, those IPs are a mix of what looks like dynamic IPs for hacked home users and static ones (highlighted):

5.12.28.0 (RCS & RDS Residential, Romania)
27.208.131.97 (China Unicom, China)
36.37.176.6 (VietTel, Cambodia)
37.1.209.51 (3NT Solutions LLP, UK)
37.109.52.75 (Cyfrowy Polsat, Poland)
46.22.211.34 (Inferno Solutions aka 3NT Solutions LLP, UK)
68.179.234.69 (ECTISP, US)
91.219.28.77 (FLP Kochenov Aleksej Vladislavovich aka uadomen.com, Ukraine)
91.219.28.103 (FLP Kochenov Aleksej Vladislavovich aka uadomen.com, Ukraine)
104.250.138.194 (Sean Sweeney, US / Gorillaservers, US)
138.201.44.28 (Philip Diver, Australia / Hetzner, Germany)
188.116.23.98 (NEPHAX, Poland)
188.138.1.53 (PlusServer, Germany)
193.9.28.24 (FLP Kochenov Aleksej Vladislavovich aka uadomen.com, Ukraine)


3NT Solutions (aka Inferno Solutions / inferno.name) are very, very bad news and I would recommend blocking any IPs you can find for this outfit. FLP Kochenov Aleksej Vladislavovich aka uadomen.com has appeared here so many times [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] that really I have to categorise that as an Evil Network too.

If we excise the domestic IPs and blackhole the 3NT / Inferno / uadomen.com ranges we get a recommended blocklist of:

37.1.208.0/21
46.22.211.0/24
91.219.28.0/22
104.250.138.192/27
138.201.44.28
188.116.23.98
188.138.1.53
193.9.28.0/24


However, there's more to this too. The original email message is actually signed by local-fax.com and it turns out that this domain was created just today with anonymous registration details. The sending IP was 104.130.246.8 (Rackspace, US) and it also turns out that this is widely blacklisted and is probably worth blocking.

All the samples I have seen show a consistent MD5 of e6d2863e97523d2f0e398545989666e4 for the attachment, and all the recipients I have seen begin with the letter "a" curiously enough..


Tuesday, 20 September 2016

Evil network: 178.33.217.64/28 et al (evolution-host.com, customer of OVH)

This customer of OVH appears to be registered with fake details, and are distributing malware via a block at 178.33.217.64/28. Currently, the following IPs are distributing some sort of unidentified exploit kit:

178.33.217.64
178.33.217.70
178.33.217.71
178.33.217.78
178.33.217.79

A list of the domains associated with those IPs can be found here [pastebin].

OVH have allocated the IP range to this customer:

organisation:   ORG-JR46-RIPE
org-name:       Jason Reily
org-type:       OTHER
address:        32 Oldfarm Road
address:        GB21DB London
address:        GB
e-mail:         ourbills@evolution-host.com
abuse-mailbox:  ourbills@evolution-host.com
phone:          +353.8429143
mnt-ref:        OVH-MNT
mnt-by:         OVH-MNT
created:        2016-05-24T18:16:03Z
last-modified:  2016-05-24T18:16:03Z
source:         RIPE


There is no such address in London, the postcode is obviously invalid and the telephone number appears to be an Irish mobile phone. Checking the evolution-host.com domain reveals something similar:

Registrant Name: OWEN PHILLIPSON
Registrant Organization: EVOLUTION HOST
Registrant Street: 24 OLDFARM ROAD
Registrant City: LONDON
Registrant State/Province: LONDON
Registrant Postal Code: SW19 3RQ
Registrant Country: GB
Registrant Phone: +353.851833708
Registrant Phone Ext:
Registrant Fax: +44.7479012225
Registrant Fax Ext:
Registrant Email: info@evolutionhost.co.uk
Registry Admin ID: 


Again, an invalid address with a different street number from before and an Irish telephone number. We can look at evolutionhost.co.uk too..

    Registrant:
        Owen Phillipson

    Registrant type:
        UK Sole Trader

    Registrant's address:
        24 Oldfarm Road
        London
        London
        SW19 3RQ
        United Kingdom

    Data validation:
        Nominet was able to match the registrant's name and address against a 3rd party data
source on 09-Feb-2014


Obviously Nominet's validation process isn't worth rat shit. The Evolution Host website appears to have no contact details at all.

RIPE associates the tag ORG-JR46-RIPE with the following IP ranges, all rented from OVH. I suggest you block all of them:

91.134.220.108/30
92.222.208.240/28
149.202.98.244/30
176.31.223.164/30
178.33.217.64/28


UPDATE

A contact says that IP listed at the beginning of the post are the Neutrino Exploit Kit.

Friday, 16 September 2016

Malicious domains to block 2016-09-16

These domains are part of a cluster, some of with are serving the EITEST RIG exploit kit (similar to that described here). They all share nameservers running on 62.75.167.186 and 62.75.167.187.

kisliy.com
tatar28.com
netvoyne.com
susana24.com
tigkolor.com
wartan24.com
kitoboyka.com
koktail24.com
salagriva.com
konektyfor.com
shophodoki.com
livefreedns.com
liveskansys.com
longzonenet.com
vestostnord.com
2f8d2n456f0x.com
freensservic.com
nshun89qvgxa.com
tujkh6ncxqzc.com
wtyr0lu7cxm3.com

blizorsysdate.com
shopslovyanka.com
prowebanalityc.com
roginozsecurnet.com
adobesecurupdate.com
linksbacksreport.com
websecuranalitic.com
adobe-flesh-update.com
adobe-secur-update.com
microsoft-securety.com
securetypostanalityc.com
pronetanaliz.info
1i3w9az49av0.net
345uzwpqnohu.net
4lmbkpqrklqv.net
705qvchqrk5e.net
8d6fw1i3ot67.net
f4tir0dqb01u.net
fg1238tq38le.net
no1q349azgpm.net
o92rgx6r456b.net
pev09m38laj4.net
ty78lizc9ung.net
yrwlejglq3wl.net

aligosecurety.net
3wdev4pqfw1u.org
j8le7s5q745e.org
o9aj8xa34xaf.org
v8p2zw96vg5e.org

outsecurety.pw
kisliy.com
tatar28.com
netvoyne.com
susana24.com
tigkolor.com
wartan24.com
kitoboyka.com
koktail24.com
salagriva.com
konektyfor.com
shophodoki.com
livefreedns.com
liveskansys.com
longzonenet.com
vestostnord.com
2f8d2n456f0x.com
bwl2rola3cpm.com
freensservic.com
nshun89qvgxa.com
tujkh6ncxqzc.com
wtyr0lu7cxm3.com

blizorsysdate.com
shopslovyanka.com
prowebanalityc.com
roginozsecurnet.com
adobesecurupdate.com
linksbacksreport.com
websecuranalitic.com
adobe-flesh-update.com
adobe-secur-update.com
microsoft-securety.com
securetypostanalityc.com
businessprofessionalzgroup.com
1i3w9az49av0.net
345uzwpqnohu.net
4lmbkpqrklqv.net
705qvchqrk5e.net
8d6fw1i3ot67.net
f4tir0dqb01u.net
fg1238tq38le.net
no1q349azgpm.net
o92rgx6r456b.net
pev09m38laj4.net
ty78lizc9ung.net
yrwlejglq3wl.net

aligosecurety.net
3wdev4pqfw1u.org
j8le7s5q745e.org
o9aj8xa34xaf.org
v8p2zw96vg5e.org

siteanalytics.pro
pronetanaliz.info

The EK domains are running on a botnet (those are listed in italics). The other domains seem to serve some other sort of nastiness. Those IPs form part of a range rented from Host Europe Group consisting of the following IPs:

62.75.167.186
62.75.167.187
62.75.167.188
62.75.167.189
62.75.167.190

This is roughly analogous to 62.75.167.184/29 which might be worth blocking, but note that won't stop IP traffic to the EK domains which are on different IPs. These IPs are allocated to:

person:         Vasiliy Buyanov
address:        Tereshkovoy 37
address:
address:        664000 Irkutsk
address:        Russia
phone:          +7 901 6508840
e-mail:         admin@realhosters.com
nic-hdl:        VB5472-RIPE
remarks:        5408042
abuse-mailbox:  admin@realhosters.com
mnt-by:         BSB-SERVICE-MNT
created:        2015-10-07T08:35:50Z
last-modified:  2015-10-07T08:35:50Z
source:         RIPE



Tuesday, 24 May 2016

Evil network: OVH / kaminskiy@radiologist.net

Here's an Angler EK cluster, hosted on multiple ranges rented from OVH France.. working first from this list of Angler IPs in OVH address space we can see a common factor.

5.135.249.214
5.135.249.215
51.255.59.119
51.255.59.120
51.255.59.121
51.255.59.123
91.134.206.128
91.134.206.129
91.134.206.130
91.134.206.131
91.134.204.217
91.134.204.218
91.134.204.219
91.134.204.243
91.134.204.245
91.134.204.247

One handy thing that OVH does with suballocated ranges is give clear details about the customer. This certainly helps track down abusers. In this case, the ranges these IPs are in are allocated to:

organisation:   ORG-KM91-RIPE
org-name:       Kaminskiy Mark
org-type:       OTHER
address:        Bema 73
address:        01-244 Warszawa
address:        PL
e-mail:         kaminskiy@radiologist.net
abuse-mailbox:  kaminskiy@radiologist.net
phone:          +48.224269043
mnt-ref:        OVH-MNT
mnt-by:         OVH-MNT
created:        2016-05-18T14:46:09Z
last-modified:  2016-05-18T14:46:09Z
source:         RIPE


That ORG-KM91-RIPE reference can be looked up on the RIPE database: giving more of these little /30 blocks:

5.135.249.212/30
51.255.59.116/30
51.255.59.120/30
51.255.59.124/30
91.134.206.128/30
91.134.204.212/30
91.134.204.216/30
91.134.204.220/30
91.134.204.240/30
91.134.204.244/30
91.134.204.248/30
91.134.204.252/30
164.132.223.192/30


OVH have been pretty good at cleaning up this sort of thing lately (unlike PlusServer) so hopefully they will get this under control.

If you want to find other Angler EK ranges then I have a bunch of 'em in my Pastebin.

Tuesday, 12 April 2016

PlusServer has a PlusSized problem with Angler

PlusServer GmbH is a legitimate German hosting company. But unfortunately, the bad guys keep hosting Angler EK sites in their IP ranges over and over again.

So far I have seen many /24 blocks which have effectively been burned by out-of-control Angler (and other EK) infections. There are many individual IPs too, but below I list some of the worst blocks (links go to Pastebin).

85.25.102.0/24
85.25.107.0/24
85.25.160.0/24 
85.93.93.0/24
188.138.17.0/24
188.138.70.0/24 
188.138.71.0/24
188.138.75.0/24
188.138.102.0/24
188.138.105.0/24 
188.138.125.0/24 
217.172.189.0/24
217.172.190.0/24

Blocking these ranges will block some legitimate sites, but if Angler is causing you a problem then I would lean towards blocking those ranges and accepting the chance of some minor or moderate collateral damage. There are other bad ranges here for other hosts too.

UPDATE 2016-04-25

Here are some more PlusServer ranges where Angler has been rampant:

85.25.218.0/24
85.25.237.0/24
188.138.25.0/24
188.138.68.0/24

UPDATE 2016-05-10

Heavy Angler activity has also been spotted in the following ranges:

62.75.203.0/24
62.75.207.0/24
85.25.43.0/24 
85.25.79.0/24
85.25.159.0/24
85.25.217.0/24
188.138.33.0/24
188.138.68.0/24
188.138.125.0/24

In addition, some Angler activity has been observed in the following ranges but is not yet widespread (I will update if I see more activity):

62.75.167.0/24
85.25.41.0/24

85.25.74.0/24

85.25.106.0/24
85.25.207.0/24

188.138.41.0/24
188.138.57.0/24
188.138.69.0/24
188.138.102.0/24

PlusServer (or more likely one or more of their resellers) appear to be responsible for a large number of active Angler EK IPs (at a guesstimate, about a quarter). The problem is that some of these ranges are so badly infected (e.g. there are around 48 past and present bad IPs in 188.138.105.0/24) that the only safe option is to block traffic to those network ranges.

With black hat hosts such as Qhoster or Host Sailor and to some extent Agava you can block the entire network ranges and not block anything of value at all. In using PlusServer, the bad guys can hide their evil sites among legitimate sites where administration might fear to block something accidentally. My personal opinion is that admins need to be bold and block anyway.. it should usually be possible to block individual sites where needed.

Monday, 11 April 2016

Evil networks to block 2016-04-11

I realise it has been a while since my last list of bad networks you might want to block. Hopefully in the next couple of days I will have another list outlining some bad problems with PlusServer IP ranges, in the mean times here are a load of network blocks with a high concentration of Angler EK and other nastiness. (The links go to my Pastebin with more details).

31.148.99.0/24
51.255.61.48/30
51.255.96.56/30 
51.255.143.80/30
65.49.8.64/26
83.217.11.0/24
85.93.93.0/24
85.143.209.0/24
91.221.36.0/24 
92.83.104.0/21
93.115.38.0/24
94.242.206.0/24 
131.72.136.0/24 
178.57.217.0/24
185.46.9.0/24
185.46.10.0/24
185.49.68.0/24
185.75.46.0/23
185.104.8.0/22 
194.1.238.0/24
204.155.31.0/24 

Friday, 18 March 2016

Friday, 26 February 2016

Evil networks to block 2016-02-26

These networks are clusters of the Angler EK and other badness. I tend to Tweet about Angler IPs rather than blog about them. Following the #AnglerEK hashtag at Twitter can yield more information, often in realtime.

All the links go to Pastebin with more information about the IPs and the blocks. Note that a few of these blocks do contain some legitimate Russian-language sites, but if your users don't visit that sort of site then you should be OK to block them.

51.254.240.0/24
64.79.88.16/29
86.106.93.0/24
88.198.229.184/29
88.214.237.0/24
89.45.67.0/24
146.0.43.64/26
176.9.226.160/29
176.223.111.0/24
184.154.53.136/29
185.66.9.0/24
185.66.10.0/24
185.46.11.0/24
185.86.76.0/22
185.86.149.0/24
185.104.8.0/22
185.118.65.0/24
188.227.72.0/22
191.96.66.0/24 
195.128.125.0/24
204.45.251.128/26 
204.155.30.0/24
207.182.141.200/29
212.22.85.0/24
212.109.192.224/27

Wednesday, 24 February 2016

Evil network: 184.154.28.72/29 (Marko Cipovic / Singlehop) and liveadexchanger.com

liveadexchanger.com is an advertising network with a questionable reputation currently hosted on a Google IP of 146.148.46.20. The WHOIS details are anonymous, never a good sign for an ad network.

Seemingly running ads on the scummiest websites, liveadexchanger.com does things like trying to install fake Flash updates on visitors computers, as can be seen from this URLquery report... you might find the screenshot missing because of the complex URL, so here it is..


That landing page is on alwaysnewsoft.traffic-portal.net (part of an extraordinarily nasty network at 184.154.28.72/29) which then forwards unsuspecting visitors to a fake download at intva31.peripheraltest.info  which you will not be surprised to learn is hosted at the adware-pusher's faviourite host of Amazon AWS.

Of the 567 sites that have been hosted in this /29 (not all are there now), 378 of them are tagged as malicious in some way by Google (67%) and 157 (28%) are also tagged by SURBL as being malicious in some way. Overall then, 74% are marked as malicious by either Google or SURBL, which typically means that they just haven't caught up yet with the other bad domains. The raw data can be seen here [pastebin].

At the time of writing, the following websites appear to be live:

check4free.newperferctupgrade.net
testpc24.onlinelivevideo.org
getsoftnow.onlinelivevideo.org
newsoftready.onlinelivevideo.org
whenupdate.plugin2update.net
alwaysnew.updateforeveryone.net
free2update.newsafeupdatesfree.net
liveupdate.update4free.org
downgradepc.update4free.org
noteupgrade.update4free.org
newupdate.digit-services.org
lastversion.whensoftisclean.org
newupdate.set4newsearchupdate.com
upd24.free247updatetoolnow.com
24check.plugin-search2update.com
check4upgrade.plugin-search2update.com
softwareupdate.plugin-search2update.com
updateauto.theinlinelive.net
newsoftready.set2updatesnen.net
alwaysnewsoft.traffic-portal.net
checksoft.new24checkupgrade.net
legalsoft.perfectsafeupdate.net
checksoft.group4updating.org
checksoft.thesoft4updates.org
netapp.safeplugin-update.org
freedlupd.pcfreeupdates.club
softwareupdate.upgrades4free.org
freechecknow.onlinelivevideo.org
liveupdate.os-update.club
newupdate.update4free.net
checksoft.newsafeupdatesfree.net
workingupdate.digit-services.org
now.how2update4u.com
autoupdate.whenupgradeswork.com
setupgrade.set4freeupdates.xyz
update4soft.searchonly.online
updateauto.forfreeupgrades.org
autoupdate.soft-land.club
soft4update.soft-land.club
updateauto.newvideolive.club
newupdate.portal-update.club
maintainpc.perfectupdater.org
newupdate.downloadsoft24.club

The WHOIS details for this block:
%rwhois V-1.5:003eff:00 rwhois.singlehop.com (by Network Solutions, Inc. V-1.5.9.5)
network:Class-Name:network
network:ID:ORG-SINGL-8.184-154-28-72/29
network:Auth-Area:184.154.0.0/16
network:IP-Network:184.154.28.72/29
network:Organization:Marko Cipovic
network:Street-Address:Kralja Nikole 33
network:City:Podgorica
network:Postal-Code:81000
network:Country-Code:CS
network:Tech-Contact;I:NETWO1546-ARIN
network:Admin-Contact;I:NETWO1546-ARIN
network:Abuse-Contact;I:ABUSE2492-ARIN
network:Created:20150323
network:Updated:20150323


If you are using domain-based blocklists, this [pastebin] is the list of domains currently or formerly hosted on this block with the subdomains removed. Other than that, I would recommend the following blocklist:

liveadexchanger.com
184.154.28.72/29

Wednesday, 13 January 2016

Evil network: 46.30.40.0/21 / Eurobyte LLC and GoDaddy

Recently I kept coming across the name "Eurobyte LLC" when it came to hosting malware [1] [2] to an extent that I became rather suspicious about this Russian hosting company and what it is they actually do.

From looking around, it seemed that whoever Eurobyte rented servers to had an unhealthy interest in CryptoWall and the Angler EK. Eurobyte is a Russian hosting company, which in turn is a customer of Webzilla in the Netherlands. One of Webzilla's other customers is McHost.ru who also have a shitty reputation.

A look at Webzilla's AS35415 range shows that Eurobyte LLC is allocated the following blocks:

46.30.40.0/24
46.30.41.0/24
46.30.42.0/24
46.30.43.0/24
46.30.44.0/24
46.30.45.0/24
46.30.46.0/24
46.30.47.0/24

These coincide with a large-ish block of 46.30.40.0/21 which contains all the Eurobyte /24s.

Using DNSDB I found over 70,000 sites associated with this block. By associated I mean site currently hosted in the /21, or hosted there in the past few years. Crucially, that includes a lot of somedomains, nameservers and that sort of thing. In order to keep things manageable, I consolidated almost all the subdomains down into their main domains, leaving 18,260 domains and sites.

The next step was to take that data and look up the current IPs and Google prognosis (results here), giving 4048 sites with their main domains currently hosted at Eurobyte. Of this, only the following 16 appear to be malicious, 0.4% of the total.

promodoms.ru
androiddeff.ru
xpopkax.ru
xxxplayx.ru
justyoutube.ru
maineaquaventus.info
dallasdispute.com
waysecureforyou.pw
mammals.ru
101curtesty.pw
hitbambar.pw
topgradations.pw
getgradations.us
igrakon.biz
alwrgame.ru
igrakon-loads.ru

0.4% is a tiny amount.. I would typically expect to see about 1-2% on any network. So, Eurobyte LLC looks squeaky clean, yes?

In fact, this low number of malicious sites is misleading. If we go back to the original 18,260 domains and look at the number of malicious domains there, the total is 3,129. That's 17.1% of the original dataset.. a very high figure indeed.

The discrepancy appears to exist because there are thousands of subdomains hosted in the 46.30.40.0/21 range, where the main domain (e.g. www.) is hosted in a completely different location. The subdomains are then used to host malware such as the Angler Exploit Kit, while leaving the main domain completely untouched. The attack is known sometimes as domain shadowing.

Out of the malicious sites, 2793 are currently hosted at GoDaddy. That's 89.2% of the sites listed as malicious. But it turns out, that out of the other 336 sites taggest as malicious, about 300 are either registered with GoDaddy but hosted elsewhere, or use GoDaddy name servers. In other words, approximately 99% of the malicious sites belong to someone with a GoDaddy account.

But in fact, it is even worse than that. Looking at the domains that aren't tagged as malicious by Google reveals hundreds more similar hijacked GoDaddy domains. This list contains 5201 domains that are both parked on GoDaddy servers and have had malicious subdomains running in the Eurobyte LLC IP range. There are probably hundreds more that are hosted elsewhere.

What appears to be going on here is a domain shadowing attack on a massive scale, primarily leading victims to exploit kits.

There do appear to be some genuine Russian-language sites hosted in this block. But if you don't tend to send visitors to Russian sites, I would very strongly recommend blocking 46.30.40.0/21 from your network.

If you are a GoDaddy customer then enabling-two factor authentication might give you some additional protection against this type of attack.

While researching this topic, I discovered that Talos had done some similar work which also pointed a finger at Eurobyte and their very lax control over their network.

Monday, 4 January 2016

Evil network: 199.195.196.176/29 / Roman Alyabiev

199.195.196.176/29 is a small bunch of IPs hosting browser hijacker sites, belonging to Hosting Services, Inc. in Utah and suballocated to a customer.

Several domains are flagged by Google as leading to PUAs or malware [1] [2] [3] [4] [5] [6], and almost all those domains also have anonymous registrations.

However, the domain goforfiles.com does not have anonymous registration, and those details are:
Registry Registrant ID:
Registrant Name: Roman Alyabiev
Registrant Organization: Righway Technologies, Inc.
Registrant Street: 1740 H Dell Range Blvd #281
Registrant City: Cheyenne
Registrant State/Province:
Registrant Postal Code: 82009
Registrant Country: US
Registrant Phone: +1.3074590153
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: contact@goforfiles.com
Registry Admin ID: 
There is no such company as "Righway Technologies, Inc" but the name Roman Alyabiev matches the records for the IP block:
network:Network-Name:Dedicated Server
network:IP-Network:199.195.196.176/29
network:IP-Network-Block:199.195.196.176 - 199.195.196.183
network:Org-Name:Alyabiev, Roman
network:Street-Address:pr. Molodeznoi 7 kv. 101
network:City:Kemerovo
network:State:
network:Postal-Code:650044
network:Country-Code:RU
A full list of sites currently or recently hosted in this block can be found here. The domains in use for browser hijacking are:

bestfiledownload.biz
dailyfiledownload.biz
down4load.biz
down-loader.biz
esurf.biz
fansfile.biz
filedatabase.biz
gofor-files.biz
go-for-files.biz
interarchive.biz
loadarchive.biz
lucky-tab.biz
retailfile.biz
sprintload.biz
usedfile.biz
worldfiledownload.biz
yourfiledownloader.biz
archievedownload.com
down4loader.com
downweb-loader.com
express-downloader.com
express-files.com
failsmail.com
filearchieve.com
foryourwebs.com
goforfiles.com
go-for-files.com
houmpage.com
realdown4load.com
safesurfs.com
simple-files.com
smile-file.com
smile-files.com
webdown-loader.com
yfdownloader.com
yorfiled.com
yourfdownloader.com
yourfiledl.com
yourfiledownloader.com
yourfile-downloader.com
yourwebing.com
archievedownload.net
down4loading.net
down4loadist.net
foryourweb.net
goforfiles.net
gofor-files.net
lucky-tab.net
thefailsmail.net
yfdownloader.net
yourfaild.net
yourfdownloader.net
yourfiledownloader.net
yourfile-downloader.net
your-home-page.net
yourwebing.net
goforfiles.org
lucky-browse.org
yourfiledownloader.org

Blocking 199.195.196.176/29 or monitoring traffic to it might detect infected hosts, that appear to have a bunch of per-per-install crapware and other stuff installed.

Tuesday, 15 December 2015

Tainted network: Dmitry Shestakov / vds24.net on OVH

vds24.net (apparently belonging to "Dmitry Shestakov ") is a Russian reseller of OVH servers that has come up on my radar a few times in the past few days [1] [2] [3] in connection with domains supporting Teslacrypt malware and acting as landing pages for the Angler exploit kit.

Curious as to what was hosted on the vds24.net I set about trying to find out their IP address ranges. This proved to be somewhat difficult as they are spread in little chunks throughout OVH's IP space. I managed to identify:

5.135.58.216/29
5.135.254.224/29

51.254.10.128/29
51.254.162.80/30

51.255.131.64/30
149.202.234.116/30
149.202.234.144/30
149.202.234.188/30

149.202.237.68/30
176.31.24.28/30
178.32.95.152/29
178.33.200.128/26


Then using a reverse DNS function, I looked up all the domains associated with those ranges (there were a LOT) and then looked the see which were active plus their SURBL and Google ratings. You can see the results of the analysis here [csv].

There may well be legitimate domains in this range, but out of 1658 domains identified, 1287 (77.6%) are flagged by SURBL as being spammy. Only 11 (0.7%) are identified as malicious, but in reality I believe this to be much higher.

In particular, the following IP ranges seem to be clearly bad from those ratings:

51.254.10.131
51.254.162.81
51.255.131.66
51.255.142.101
149.202.234.190
149.202.237.68
178.33.200.138

I can see 61 active IPs in the vds24.net range, so perhaps it is only a small proportion. However, depending on your network stance, you may want to consider blocking all the IP ranges specified above just to be on the safe side.

UPDATE

One additional range has come to light, connected with the Dridex banking trojan:

51.254.51.176/30



Friday, 11 December 2015

Malware sites and evil networks to block (2015-12-11)

This group of domains and IPs are related to this Teslacrypt attack, sharing infrastructure with some of the malicious domains in question. In addition to Teslacrypt, some of these are connected with PoSeidon, Pony and Gozi malware.

The analysis [csv] includes SURBL and Google ratings, ISP information and a recommended blocklist.

Malicious domains:
auth-mail.ru
blagooooossss.com
brostosoosossss.com
chromedoors.ru
debatelocator.ru
ggergregre.com
growthtoys.ru
hagurowrob.ru
hedtheresran.ru
listfares.ru
littmahedtbo.ru
mikymaus.in
mytorsmired.ru
poponkia.com
soft2webextrain.com
softextrain64.com
softextrain644.com
toftevenghertbet.ru
wordlease.ru
workcccbiz.in

Partly or wholly malicious IPs:
46.166.168.106
80.87.202.52
96.8.119.3
104.232.34.141
149.202.234.190
176.103.48.223
185.18.53.247
185.118.64.182

Recommended blocklist:
46.166.168.64/26 (Duomenu Centras, UA)
80.87.202.0/24 (JSC Server, RU)
96.8.119.0/27 (New Wave NetConnect, US)
104.232.34.128/27 (Net3 Inc, US)
149.202.234.188/30 (OVH / Dmitry Shestakov, BZ)
176.103.48.0/20 (PE Ivanov Vitaliy Sergeevich, UA)
185.18.53.247 (Fornex Hosting, NL)
185.118.64.176/28 (CloudSol LLC, Russia)

I've blocked traffic to 176.103.48.0/20 for two years with no ill-effects, it seems to be a particularly bad network. There may be a few legitimate sites hosted in these ranges, they would mostly be Russian.. so if you don't usually visit Russian websites then the collateral damage might be acceptable.

Thursday, 24 September 2015

Evil network: 64.20.51.16/29 (Interserver Inc and Muhammad Naeem Nasir)

This DHL-themed phish got me looking at an IP address range of 64.20.51.16/29 which is a range belonging to Interserver Inc in the US, but which has been reallocated to a customer. But who? Because the WHOIS details for that block are not valid..
%rwhois V-1.5:003fff:00 city.trouble-free.net (by Network Solutions, Inc. V-1.5.9.5)
network:Class-Name:network
network:ID:NETBLK-INTSRV.64.20.32.0/19
network:Auth-Area:64.20.32.0/19
network:Network-Name:INTSRV-64.20.51.16
network:IP-Network:64.20.51.16/29
network:Org-Name:N/A N/A
network:Street-Address:N/A
network:City:N/A
network:State:na
network:Postal-Code:N/A
network:Country-Code:US
network:Created:20150624
network:Updated:20150922
network:Updated-By:abuse@interserver.net
Well, that's quite a sloppy move by Interserver to allow that, but it doesn't mean that the block is evil. However, an analysis of the sites currently and formerly hosted in that range indicate a very high proportion of phishing sites.. in fact, the range is a hotbed of sophisticated fraud sites, many of which seem to be undiscovered.

I combined current reverse IP data from DomainTools and current and historical data from DNSDB and then ran them through an IP lookup and a check against the Google Safe Browsing and SURBL reputations. The results [csv] show a very large number of sites flagged by SURBL in particular, amounting to 47 out of 167 sites (i.e. 28%) that I can identify as being currently hosted in that range.

In addition, a large number of phishing and other malicious sites have been hosted on 64.20.51.16/29 in the past and are now hosted elsewhere.

nswo.co.uk / "La Casa Limpia - a Balaeric Island Villa"


At first glance, some of the remaining sites look legitimate. Consider nswo.co.uk entitled "La Casa Limpia - a Balaeric Island Villa".

It looks utterly legitmate, although it is an odd domain name for a villa in Spain. Let's check those WHOIS details..

    Domain name:
        nswo.co.uk

    Registrant:
        P J Green

    Registrant type:
        UK Sole Trader

    Registrant's address:
        100 Malderen Road
        Islington
        London
        Greater London
        LN23 6AU
        United Kingdom

    Data validation:
        Nominet was able to match the registrant's name and address against a 3rd party data source on 10-Dec-2012
Despite Nominet claiming to verify the address, there is no such road as "Malderen Road" anywhere in the United Kingdom, and the post code of "LN23 6AU" is also completely invalid and exists nowhere in the UK. A bit of investigation shows that the site is almost a complete rip-off of  a legitimate site at palmyramenorca.com.. but with different contact details.

dominioncollege.ca / "Dominion College"


Consider also dominioncollege.ca - a professional looking website billing itself as Dominion College of Canada.


Apparently, Dominion College is the "Highest Ranking Creative Arts University". But there is no such university in Canada, and the domain for this "150 year old" institution was only registered in August 2015.

Domain name:           dominioncollege.ca
Domain status:         registered
Creation date:         2015/08/14
Expiry date:           2016/08/14
Updated date:          2015/08/19
DNSSEC:                Unsigned

Registrar:
    Name:              PublicDomainRegistry.com Inc
    Number:            3059041
The "About Us" page gives another clue.


That is actually Old Dominion University in Virginia, United States. A completely different and wholly legitimate institution.

hkbbr.org / "Hong Kong Business Bureau Registry"

Consider hkbbr.org billing itself as the Hong Kong Business Bureau Registry..

Yet a Google search for that term only returns hardly anything except content from the site itself, indicating that there is no such organisation.


The domain was registered in 2013 to an anonymous registrant. What is the point of this site? Well, it looks like it is a register of legitimate Hong Kong businesses. You can search for business in their online services page..


Well, it looks like a search.. but in fact it just loads results from a page www.hkbbr.org/entity/ which has an open directory.. so you can see that there actually only 43 companies in the database. One or more of which will be fake.

Presumably this forms part of a scam where the victim has to deal with a fake company, and the scammers use this web site to try to convince the victim that they are dealing with a legitimate company.

tricountysalesmexia.com / "Tri County Sales Mexia"


Consider tricountysalesmexia.com, entitled "Tri County Sales Mexia's Premier Pre-Owned Late Model Luxury and Exotic Vehicle Dealer - Mexia | Texas"


We added up the value of the cars listed on this "Tri County Sales" site. There were 218 cars valued at around $13.2 million, or around $60,000 per car.

Their website shows plush offices..


Now, Tri County Sales is a real company and I suspect a reliable vendor of used vehicles. But in reality the company's premises look like this:


Does it look like somewhere that stocks $13 million dollars worth of high-end exotic vehicles? Of course not. Let's take a look at one of the more notable cars on the website.


This is a pretty rare car. But look closely at the partial logo in the top left hand corner of the large photo..


It's the logo of Southlake Motorcars, where the image was stolen from..


Several of the other vehicles also turn up on other sites. You can be assured that although Tri County Sales is a real company, this website does not belong to them and is a scam.

goldwestgroup.com / "Gold West Group"

Consider goldwestgroup.com calling itself "Gold West Group"..


It's a bit vague about where it has mines, but the facility pictured at the top is the Obuasi Gold Mine in Ghana belonging exclusively to AngloGold Ashanti and no-one else.

The site itself mentions a Chile address, and the WHOIS details are consistent.

Registrant Name: Manu DeSouza
Registrant Organization: Gold West Group
Registrant Street: Europa Oficinas
Registrant Street: Guardia Vieja 255
Registrant City: Providencia
Registrant State/Province: Santiago
Registrant Postal Code: 2103
Registrant Country: Chile
Registrant Phone: +56.22997704
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: webmaster@goldwestgroup.com
But AngloGold Ashanti have no operations in Chile. This site is a scam.

edichem.com / "Edible Chemical Inc"

Consider edichem.com describing itself as "Edible Chemical Inc"..



This site is riddle with spelling errors and has some comically bad photo manipulation.

The offices in the picture actually belong to a company called APAG.

Let's have a look at that so-called CEO..


"Birningham University"? Quite a typo. And that photo is of a completely different person called Peter Westenthaler.

This fake company has even gone to the effort of setting up a Facebook page at www.facebook.com/edichem.biz:


cllinternational.com / "Courier Logistics Limited"

Consider cllinternational.com calling itself "Courier Logistics Limited":


In what way is this logo meant to reflect "Courier Logistics Limited"?

It doesn't.. it belongs to the IEEE Robotics and Automation Society.

The purpose of this site appears to be to generate fake courier tracking numbers, so a victim who has ordered a product will assume that it is actually on it's way. The tracking lookup seems to respond to a six-digit tracking code. The fake tracking site is on another IP, 185.24.233.16 in Ireland.


steadyprivateloan.com / "Steady Private Loan"

Most of the fake companies I have found so far have zero internet footprint. This fake finance company has at least attractive a couple of complaints:

Edmond L.
Beware !!! Do not deal with TERRANCE CLARK / CLARK BRIAN of Goldmine Private Loan now with a new name "Steady Private Loan". These are scam artist.
8 months ago

Sharon Todd
I agree. We fell for their Goldmine Loan and now Steady Private Loan owe us $21,195 ...They look fantastic but do not fall for them. We are reporting them to the FBI
7 months ago

Unlike some of the other sites, this is a bit more amateurish and generic.



It claims to be based in Delaware.



The bottom line here is that there is no such corporation as "Steady Private Loan" in Delaware. This site is a scam.

madrewson.net / "Madrewson Consult"

Consider madrewson.net calling itself "Madrewson Consult". This bills itself as some sort of HR consultancy, but you can guarantee that everythig it touches is fake.


There are a bunch of testimonials on the "About Us" page.

These are all attractive, well-photographed people aren't they? And they pop up in so many places. The photo of "Helen Pyzowski" turns up in a bunch of places. "Adam Smith" is a stock image. "Kristin Malie" turns up in a bunch of places. "John L. Skelley" turns up in a bunch of places. The testimonials are fake, as is this so-called company.

mobgifts.net / "Coca Cola Promo"


"Coca Cola" themed prize scams are well known (and documented on the Coca Cola corporate site) but I've never seen anyone go to the effort of creating a fake website to go with it.


There are several photos of people being handed cheques. But what is that cheque exactly?


This is someone winning a prize alright.. but for developing a mobile app, not a lottery. All the other pictures of people getting cheques are similarly bogus. There is no such thing a the Coca Cola Promo free lottery.

braincure-biotech.com / "Braincure Biotech"

Consider this so-called Taiwanese biochemistry firm, "Braincure Biotech" (braincure-biotech.com)


The site looks professional but very generic. But is it genuine? Unfortunately, the Taiwanese companies registry is in Chinese only and is quite difficult to use. So let's just Google it.


There are virtually zero references to this "company" apart from its own website. And by the time you look, probably this blog. A quick check of the body text of the site reveals that it is copied from other genuine biotech sites. This company does not exist, but presumably is there as part of an investment or employment scam.

What else is there?

Trawling through the IP address range shows many fake blogs (set up to promote goodness only knows what), some Bitcoin and make-money-fast sites and a whole load of sites that appear to be suspended. I cannot confirm a single legitimate site in this range.

Who is behind this?

Although the IP address range is owned by Interserver Inc it is allocated to a customer. However, Interserver seems to have displayed poor governance here because it not only has allocated the range to an anonymous registrant, but it has not acted on the extremely high concentration of fraudulent sites.

Looking at the range, I can see several nameservers..

ns3.boldhosts.com
64.20.51.18

ns4.boldhosts.com
64.20.51.19

ns2.paidhoster.com
64.20.51.20

ns1.ok2host.com
64.20.51.21

ns2.ok2host.com
64.20.51.22

ok2host.com has anonymous WHOIS details, but the other two are related:

BOLDHOSTS.COM
Registry Registrant ID:
Registrant Name: Abdul Razzaq
Registrant Organization: Boldhosts
Registrant Street: Street 18 Clifton Block 8  
Registrant City: Karachi
Registrant State/Province: Sind(en)
Registrant Postal Code: 75500
Registrant Country: PK
Registrant Phone: +92.2135491130
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: info@boldhosts.com


PAIDHOSTER.COM
Registrant Name: Sajid Mahmood
Registrant Organization: GroomHost
Registrant Street: Progressive Center Shahrah e Faisal  
Registrant City: Karachi
Registrant State/Province: Sind(en)
Registrant Postal Code: 75400
Registrant Country: PK
Registrant Phone: +92.215681734
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: info@boldhosts.com

Although paidhoster.com does not resolve, both boldhosts.com and ok2host.com do and are hosted on adjacent IPs of 76.73.85.141 and 76.73.85.142 respectively, indicating that they might be the same company. Groomhost.com is also mentioned in the WHOIS details above, and that is hosted on 76.73.85.140.

It turns out that there is another IP block of 76.73.85.136/29 hosting a variety of possibly white-label web hosts:

network:Auth-Area:76.73.0.0/17
network:Class-Name:network
network:OrgName:Naeem Nasir
network:OrgID;I:FDC-11211
network:Address:Street number 18 clifton block 8
network:City:Karachi
network:StateProv:Sindh
network:PostalCode:75500
network:Country:PK
network:NetRange:76.73.85.136 - 76.73.85.143
network:CIDR:76.73.85.136/29
network:NetName:FDC-11211-76.73.85.136

The WHOIS details for the IP range don't give a lot of data, but we can also find the same registrant details for the domain sandhost.com:

Registry Registrant ID:
Registrant Name: Muhammad Naeem Nasir
Registrant Organization:
Registrant Street: Street  18  clifton block 8
Registrant City: Karachi
Registrant State/Province: Sindh
Registrant Postal Code: 75500
Registrant Country: Pakistan
Registrant Phone:
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: naeem.nasir@yahoo.com
The AA419 database shows several hits for this email address going back to 2011, so it seems that whoever this Pakistani web host is, they have been tolerating this activity on their network for several years, even if they are just providing hosting services rather than perpetrating fraud.

Conclusion

I really just skimmed the surface with my analysis here, but it is clear that the 64.20.51.16/29 block is being used almost exclusively for fraud. Moreover, the fraud is extremely sophisticated involving things like fake business registries and couriers. It is also clear that the Pakistani web hosts apparently providing these services have been doing so for some time.

Recommended blocklist:
64.20.51.16/29
76.73.85.136/29
185.24.233.16