Sponsored by..

Showing posts with label Transnistria. Show all posts
Showing posts with label Transnistria. Show all posts

Friday, 20 June 2014

bumerang.cc spam - possible Joe Job?

As with the writer of the excellent My Online Security blog I had a couple of odd-looking spams that looked like they might be malicious.

The first spam was a bit of a fail as it didn't have the link, the second spam contained a link the the bumerang.cc website.

From:     News
Date:     19 June 2014 21:40
subject:     World Political News

You can see all World Political News at our web site.Just click on link below

Invoice

------

From:     Customer support
Date:     19 June 2014 13:43
Subject:     Your invoice for June 2014

See your invoice for June 2014 by click on link below

Invoice


The link in the second email goes to the amusingly-named www.bumerang.cc/asdaa/sploit.php - amusing because "sploit" is of course slang for "exploit". Although I have seen exploit kits that contain obvious things like this as a sort of joke, it is also a bit obvious don't you think?

But there is no exploit kit at this "sploit.php" location.. it 404s. But in fact I can see no evidence that there has ever been an exploit in this location, this URLquery report from yesterday (the earliest I can find) also shows a 404. So perhaps the exploit has been deleted? Or perhaps it was never there in the first place..


As I mentioned, there are a pair of emails. The one with the working link looks like a fake invoice malspam, but the other one has the subject "World Political News" and the body "You can see all World Political News at our web site.Just click on link below".

It turns out that bumerang.cc is a news site, covering topics of interest in Moldova in the Romanian, English and Russian languages. Unlike most multilingual news sites, the content is different depending on the language.. and the default Russian language part of the site has a lot of articles on the rather corrupt breakaway region of Transnistria which is strongly pro-Russian and which seems to be getting drawn in to the godawful mess that is the Ukraine crisis.

Transnistria has a reputation for corruption and organised crime, so perhaps bumerang.cc has published something that somebody in Transnistria doesn't like. Joe Jobs against sites dealing in Russian politics are quite common, and the messages do bear several hallmarks of being fakes.

Given that there is no evidence of malware on this site, the fishy nature of the spam and the topic areas of the site itself then I am minded to think that this is a Joe Job and bumerang.cc are not behind this spam run.

UPDATE 1 2014-06-24. Another variant..

From:     Bumerang News
Date:     24 June 2014 21:24
Subject:     SENSATION NEWS!Ukraine Will Wage War With Russia

Russia's War Against Ukraine! All at our web site. Just click on link below

">http://www.bumerang.cc/



Monday, 13 August 2012

Even more malware sites to block on 194.28.115.150

More evil sites to block on 194.28.115.150 (Specialist ISP) following on from these:

idi42nga.rr.nu
kprud89entia.rr.nu
hin66gof.rr.nu
iste03dengi.rr.nu
hing30emplo.rr.nu
ize84dso.rr.nu
ind42icat.rr.nu
lack33andw.rr.nu

Friday, 10 August 2012

Yet more malware sites to block on 194.28.115.150

Another batch of malware sites to block on 194.28.115.150 following on from these.. although to be franking, blocking access to 91.211.200.0/22  and 194.28.112.0/22 (Specialist ISP) plus all .rr.nu domains would be even better.

uresre17covered.rr.nu
ented89cable.rr.nu
erstor69msconse.rr.nu
gph46ili.rr.nu
nsu83lti.rr.nu
entl77ymail.rr.nu
rren48tlyvo.rr.nu
ersinq54uiries.rr.nu
sgradu88atevis.rr.nu
arrayt78emperat.rr.nu
ieddis18tribut.rr.nu

Wednesday, 8 August 2012

More malware sites to block on 194.28.115.150

Yet more malware sites hosted on the same IP of 194.28.115.150 address from black hat host Specialist ISP in Transnistria, in addition to these and these. Blocking their entire ranges of 91.211.200.0/22  and 194.28.112.0/22 could save you a lot of grief.

vat19ica.rr.nu
rtr83eaga.rr.nu
utur33esma.rr.nu
rho99dena.rr.nu
sori10gina.rr.nu
spons91orapa.rr.nu
stingh58ousedra.rr.nu
rpci22nsta.rr.nu
slat80edeb.rr.nu
rmil91annob.rr.nu
ttedbr13oadplac.rr.nu
stric59tionac.rr.nu
rsob51stac.rr.nu
tssi48lenc.rr.nu
rned93airc.rr.nu
wishp97roduc.rr.nu
rop67ded.rr.nu
velysu88pported.rr.nu
tow03ard.rr.nu
urist44anford.rr.nu
stim49atesd.rr.nu
ting41peace.rr.nu
reser76veacce.rr.nu
stenn82essee.rr.nu
tro50lle.rr.nu
urech03rysle.rr.nu
rpl51ane.rr.nu
tsre36fere.rr.nu
rsgua98rante.rr.nu
sac11tive.rr.nu
rssol40elyhig.rr.nu
rmee55ting.rr.nu
sdoo02rdaug.rr.nu
rsqbsi32mplersh.rr.nu
ilsa05mpli.rr.nu
tfun34dedmi.rr.nu
rizat57ionmi.rr.nu
rov75isi.rr.nu
topse63curiti.rr.nu
tingsi83llegal.rr.nu
tid69rugm.rr.nu
robert62sultim.rr.nu
tion96gamm.rr.nu
tigato91rsonesm.rr.nu
teract53borlan.rr.nu
teb84ran.rr.nu
turere98presen.rr.nu
ssent69encin.rr.nu
rtro39ommin.rr.nu
ydet43ermin.rr.nu
ute37drin.rr.nu
tadve42rtisin.rr.nu
rre52nwin.rr.nu
ston80esco.rr.nu
shel27lsco.rr.nu
tton77stheo.rr.nu
sgill34ettewo.rr.nu
yield83ingap.rr.nu
wind89scomp.rr.nu
yin78gsp.rr.nu
ssdel12iversp.rr.nu
ustg99ener.rr.nu
steal73gener.rr.nu
sea12tfr.rr.nu
rgye90xpor.rr.nu
urroun55dingpr.rr.nu
riv58erpr.rr.nu
tici69ansr.rr.nu
uncert96aintyr.rr.nu
reque26ncies.rr.nu
ylor83cons.rr.nu
sframe80scarlos.rr.nu
zar00dous.rr.nu
tpro52duct.rr.nu
saryho39pingit.rr.nu
siveu11nlimit.rr.nu
striki53ngbent.rr.nu
state60potent.rr.nu
uff84erst.rr.nu
veacce31ssedrev.rr.nu
tandin81gfairv.rr.nu
ushed29isdrex.rr.nu
sre80pay.rr.nu

Update: a couple of new ones via the ISC:
tentsf05luxfig.rr.nu
ksstar.rr.nu

Tuesday, 7 August 2012

Malware sites to block on 194.28.115.150

This is an updated list of evil domains on 194.28.115.150 (Specialist ISP in Transnistria). Blocking all of 194.28.112.0 - 194.28.115.255 (194.28.112.0/22) is the best idea, and blocking traffic to .rr.nu ain't a bad one either. But if you can only block by domains names then this is the latest list of malware-laden sites to avoid:

xinthesidersdown.com
sweepstakesandcontestsdo.com
ens122zzzddazz.com
ssi11fica.rr.nu
ari55nea.rr.nu
sre13vea.rr.nu
tartis78tscolla.rr.nu
djust16scotla.rr.nu
courie90rhydra.rr.nu
idaysc65artera.rr.nu
x1010thta.rr.nu
ealis86ticeva.rr.nu
sfl20ewwa.rr.nu
rece76iptsb.rr.nu
xvarfo29urdayec.rr.nu
res11tric.rr.nu
ake60rsc.rr.nu
like90varyc.rr.nu
popre01versed.rr.nu
atr56aid.rr.nu
mentme03talsind.rr.nu
rasvi52llage.rr.nu
inglon03grange.rr.nu
senior78custome.rr.nu
sbandb46aninve.rr.nu
surpr54iseove.rr.nu
tes364rdaf.rr.nu
seamer47icadiff.rr.nu
veryt17hingof.rr.nu
ailway42staging.rr.nu
didat35egraph.rr.nu
nals02south.rr.nu
tampas71overei.rr.nu
ekendd69espitei.rr.nu
funct78ionali.rr.nu
artyi03nflati.rr.nu
ofess10ional.rr.nu
ful26qual.rr.nu
var64iabl.rr.nu
ins62ail.rr.nu
orig10inall.rr.nu
ulty75cream.rr.nu
lco16mpan.rr.nu
refi88nedn.rr.nu
ariney05aleteen.rr.nu
ital10namen.rr.nu
ymi87nin.rr.nu
olddo85esgoin.rr.nu
reque83ntlyin.rr.nu
atchp64ension.rr.nu
ional93phaco.rr.nu
eathin54gcashdo.rr.nu
ati31ngpo.rr.nu
atsda53ngero.rr.nu
ein77gyo.rr.nu
getth82rowapp.rr.nu
tsoc11ketp.rr.nu
vin04gup.rr.nu
tsroy47alpar.rr.nu
eri56orar.rr.nu
andsto57cksstar.rr.nu
train59tsafer.rr.nu
ariae54ither.rr.nu
eighbo02rsbarr.rr.nu
ing80entr.rr.nu
brown74emphas.rr.nu
sto32rybs.rr.nu
ncom24pares.rr.nu
ctab59uwes.rr.nu
spr71ings.rr.nu
ssig49nals.rr.nu
ght91ers.rr.nu
elop28ments.rr.nu
acons09olidat.rr.nu
omp25let.rr.nu
tinc31omeu.rr.nu
cello11rassu.rr.nu
pre86view.rr.nu
ns1.hoperjoper.ru
ns2.hoperjoper.ru

Wednesday, 1 August 2012

xinthesidersdown.com injection attack in progress

There is currently an injection attack using a script pointing to [donotclick]xinthesidersdown.com/sl.php  doing the rounds. The malicious code is hosted on 194.28.115.150, the same IP address as used in this attack yesterday.

Tuesday, 31 July 2012

Something evil on 194.28.115.150 and lasimp04risoned.rr.nu

The following domains appear to be part of an ongoing injection attack (using lasimp04risoned.rr.nu at present). They are hosted by black-hat web host Specialist ISP in Transnistria. Block the IP range of 194.28.112.0 - 194.28.115.255 (194.28.112.0/22) is a very good idea as this is one of the worst netblocks I know of.

aelis30greek.rr.nu
aff29ili.rr.nu
aljo73hnsto.rr.nu
ambers00supplem.rr.nu
ano98the.rr.nu
appoin62tmentba.rr.nu
asciia28rmcover.rr.nu
ati92oni.rr.nu
ation82gamma.rr.nu
avia83resou.rr.nu
bear37sall.rr.nu
bitr07aryc.rr.nu
bles41steve.rr.nu
carrie01rskans.rr.nu
che59mica.rr.nu
chn34olo.rr.nu
comme17rcial.rr.nu
cons63isten.rr.nu
cos69tbu.rr.nu
cov59erm.rr.nu
cthu85srisc.rr.nu
ctsc60anli.rr.nu
eates01publi.rr.nu
ection18depres.rr.nu
elew72isst.rr.nu
enedm79ultina.rr.nu
enegat43ivecon.rr.nu
engag75edfol.rr.nu
enge75sfra.rr.nu
enormousw1illa.com
ens122zzzddazz.com
entio21nsamba.rr.nu
esgen48erally.rr.nu
eside00ntwin.rr.nu
fee89edi.rr.nu
gra98desi.rr.nu
hitam41ultime.rr.nu
hoperjoper.ru
iab35ilit.rr.nu
ialac93idcod.rr.nu
icans11deskto.rr.nu
ident08winner.rr.nu
impo82rtse.rr.nu
int99onin.rr.nu
ion68you.rr.nu
ited51pala.rr.nu
ive23lit.rr.nu
kpo82stp.rr.nu
lasimp04risoned.rr.nu
lighte93dnickel.rr.nu
limina94tedefi.rr.nu
mainglobilisi.com
mals30ynta.rr.nu
mpa89qaut.rr.nu
mtube-ssl.com
ncomp97aredli.rr.nu
neou44slypa.rr.nu
ngsin45dividu.rr.nu
nstitu42tional.rr.nu
nting91uncle.rr.nu
nusi60ngmus.rr.nu
ocat47edha.rr.nu
ocum04entat.rr.nu
oneflo30orcall.rr.nu
onsco10mdexpo.rr.nu
ort26ibm.rr.nu
ort53hori.rr.nu
ovie26tther.rr.nu
pxm-tube.com
qtr49exis.rr.nu
raff60icke.rr.nu
rlyspa21rcleona.rr.nu
rsm95ario.rr.nu
scue08doral.rr.nu
selle33rsjunk.rr.nu
sicb79enef.rr.nu
sor52tium.rr.nu
ssic2061thligh.rr.nu
ssmo24king.rr.nu
sweepstakesandcontestsdo.com
sweepstakesandcontestsinfo.com
syno98nepet.rr.nu
takeo46versav.rr.nu
tanswe24ringni.rr.nu
tarts63exten.rr.nu
timel08arges.rr.nu
tiona82lclos.rr.nu
tormco48nstitu.rr.nu
tssign51stechno.rr.nu
vada86subje.rr.nu
velit30eratu.rr.nu
viv17eddr.rr.nu
whyi70splay.rr.nu
yint60eres.rr.nu
ysoci94alspec.rr.nu
zbol42lahg.rr.nu

Thursday, 9 February 2012

Evil network revisited (again): Specialist Ltd / Specialist-ISP-PI2 AS48691(194.28.112.0/22)

Specialist ISP is a black hat hosting company in Transnistria that I have covered before. Things have been a bit quiet on that front for a while until today when the malware site enswdzq112aazz.com came to my attention.

A lot of the bad sites have migrated from Specialist recently, but one unusual thing about Specialist is that all the sites are bad sites. So where are all those bad sites now?

These sites are still hosted by Specialist ISP:

194.28.112.11
cliffordtravel.biz

194.28.113.26
sekurepays.org

194.28.114.102
ation72histor.rr.nu
comm98andsp.rr.nu
doutl31inesst.rr.nu
earni61ngunde.rr.nu
enormousw1illa.com
ens122zzzddazz.com
ensm60erch.rr.nu
enswdzq112aazz.com
eorge00gamee.rr.nu
ggesti51ngbina.rr.nu
globalpoweringgathering.com
globalpoweringgatheringit.com
globalpoweringgatheringon.com
h102-114.net.lan-rybnitsa.com
hoperjoper.ru
iess70elec.rr.nu
ift72hbot.rr.nu
ilto27nint.rr.nu
infoitpoweringgathering.com
infoitpoweringgatheringit.com
infoitpoweringgatheringon.com
inful07commi.rr.nu
lessthenaminutehandle.com
lessthenaseconddeal.com
llowe31dmeth.rr.nu
mail.sweepstakesandcontestsinfo.com
ns1.hoperjoper.ru
ns2.hoperjoper.ru
root.sweepstakesandcontestsinfo.com
sical59lymemo.rr.nu
sokoloperkovuske.com
sokoloperkovuskeci.com
sokoloperkovuskedi.com
sweepstakesandcontestsdo.com
sweepstakesandcontestsinfo.com
tyco93uplin.rr.nu
wbesnancer.org

Bad sites that have moved elsewhere:

46.4.31.134 (Hetzner Online Germany)
boskoop2nepal.info
bossal.info
bramrozafestival.info
brand-central.info
childsurvival.info
creedenceclearwatersurvival.info
damesfutsal.info
datadigital.info
farmsurvival.info
haaglandia-futsal.info
hvdwal.info
josal.info
kadefestival.info
literatuurfestival.info
mvanderwal.info
noordelijkkoorfestival.info
oordfestival.info
paulvosdewael.info
petstotal.info
rebootfestival.info
spankabel.info
stiltefestival.info
tinkel-bel.info
vetstival.info
vicl.info
worldfuneral.info

199.59.241.235 (Bodis LLC, China)
2ti0pv3y.ru
bim6xe3t.ru
nl6fa53.com
twqhde3i.ru

The majority of other sites are parked or don't resolve. It is not surprising at all to see the Hetzner and Bodis are taking up the slack. You may want to block those IP addresses or even their whole netblocks.

Monday, 12 December 2011

Evil network revisited: Specialist Ltd / Specialist-ISP-PI2 AS48691(194.28.112.0/22)

Specialist Ltd is a small Black Hat hosting company in Transnistria, a breakaway part of the former Soviet Republic of Moldavia. No UN members recognise Transnistria, and effectively it sits beyond the reach of international law enforcement. Quite a handy place for criminals to do business then.

I first wrote about this block last year, but it recently came into my sights again as the host for a very widespread injection attack using the lilupophilupop.com domain.

Since last year the number of malicious sites has dropped, but there is still not a legitimate site in sight. Most of the bad sites are currently on 194.28.114.102 but you should block access to 194.28.112.0/22 (194.28.112.0 - 194.28.115.255) if you can, because this range of IP addresses is nothing but trouble.

A list of sites hosted in this range is at the end of this post, or you can download a CSV with the MyWOT ratings and IP addresses from here.

Google's prognosis of this block is pretty horrible:

Safe Browsing
Diagnostic page for AS48691 (SPECIALIST)


What happened when Google visited sites hosted on this network?

    Of the 44 site(s) we tested on this network over the past 90 days, 1 site(s), including, for example, rthur87seeks.rr.nu/, served content that resulted in malicious software being downloaded and installed without user consent.

    The last time Google tested a site on this network was on 2011-12-12, and the last time suspicious content was found was on 2011-12-12.

Has this network hosted sites acting as intermediaries for further malware distribution?

    Over the past 90 days, we found 15 site(s) on this network, including, for example, lilupophilupop.com/, sweepstakesandcontestsinfo.com/, sweepstakesandcontestsnow.com/, that appeared to function as intermediaries for the infection of 190 other site(s) including, for example, teas.com.au/, rogersplus.ca/, cicomra.org.ar/.

Has this network hosted sites that have distributed malware?

    Yes, this network has hosted sites that have distributed malicious software in the past 90 days. We found 30 site(s), including, for example, lilupophilupop.com/, sweepstakesandcontestsinfo.com/, sweepstakesandcontestsnow.com/, that infected 2524 other site(s), including, for example, jri.ir/, psu.ac.th/, longoservice.it/.

The WHOIS details for the bloack are:

inetnum:         194.28.112.0 - 194.28.115.255
netname:         Specialist-ISP-PI2
descr:           Specialist, Ltd.
country:         MD
org:             ORG-SL206-RIPE
admin-c:         VP2841-RIPE
tech-c:          AB16163-RIPE
status:          ASSIGNED PI
mnt-by:          RIPE-NCC-END-MNT
mnt-lower:       RIPE-NCC-END-MNT
mnt-by:          SPECIALIST-MNT
mnt-routes:      SPECIALIST-MNT
mnt-domains:     SPECIALIST-MNT
source:          RIPE # Filtered

organisation:   ORG-SL206-RIPE
org-name:       Specialist, Ltd
org-type:       OTHER
descr:          Specialist, Ltd, Rybnitsa, MD
address:        I. Soltysa 12, Rybnitsa, MD
phone:          +373-777-12921
phone:          +373-693-18189
phone:          +373-777-65071
fax-no:         +373-555-43073
mnt-ref:        MONITORING-MNT
abuse-mailbox:  abuse@lan-rybnitsa.com
mnt-by:         SPECIALIST-MNT
source:         RIPE # Filtered

person:         Vladimir Pilan
address:        I. Soltysa 12, Rybnitsa, MD
phone:          +373-777-12921
fax-no:         +373-555-43073
nic-hdl:        VP2841-RIPE
source:         RIPE # Filtered
mnt-by:         SPECIALIST-MNT

person:         Anatoly Belitsky
address:        I. Soltysa 12, Rybnitsa, MD
phone:          +373-777-65071
fax-no:         +373-555-43073
nic-hdl:        AB16163-RIPE
source:         RIPE # Filtered
mnt-by:         SPECIALIST-MNT

route:          194.28.112.0/22
descr:          Specialst-route2
origin:         AS48691
mnt-by:         SPECIALIST-MNT
source:         RIPE # Filtered

Some domains and sites hosted in this block are:



ation72histor.rr.nu
blogsvk.ru
cliffordtravel.biz
comm98andsp.rr.nu
doutl31inesst.rr.nu
earni61ngunde.rr.nu
ensm60erch.rr.nu
eorge00gamee.rr.nu
ggesti51ngbina.rr.nu
globalpoweringgathering.com
globalpoweringgatheringit.com
globalpoweringgatheringon.com
h102-114.net.lan-rybnitsa.com
hoperjoper.ru
iess70elec.rr.nu
ift72hbot.rr.nu
ilto27nint.rr.nu
infoitpoweringgathering.com
infoitpoweringgatheringit.com
infoitpoweringgatheringon.com
inful07commi.rr.nu
lessthenaminutehandle.com
lessthenaseconddeal.com
lilupophilupop.com
lilypophilypop.com
llowe31dmeth.rr.nu
mail.lilupophilupop.com
mail.sweepstakesandcontestsinfo.com
ns1.hoperjoper.ru
ns2.hoperjoper.ru
root.sweepstakesandcontestsinfo.com
sekurepays.org
sical59lymemo.rr.nu
sokoloperkovuske.com
sokoloperkovuskeci.com
sokoloperkovuskedi.com
sweepstakesandcontestsdo.com
sweepstakesandcontestsinfo.com
sweepstakesandcontestsnow.com
tyco93uplin.rr.nu
wbesnancer.org
welcometotheglobaliscom.com
welcometotheglobalisnet.com
welcometotheglobalisorg.com
zevkblog.ru

Monday, 11 October 2010

Evil network: Specialist Ltd / Specialist-ISP-PI2 AS48691(194.28.112.0/22)

Specialist Ltd is a fairly large netblock containing a small number of very bad hosts and nothing else. Registered to a company in Moldova, Specialist looks like another part of the Latvia / Moldovan / Bosnian black hat network which supports all sorts of organised crime.

inetnum:         194.28.112.0 - 194.28.115.255
netname:         Specialist-ISP-PI2
descr:           Specialist, Ltd.
country:         MD
org:             ORG-SL206-RIPE
admin-c:         VP2841-RIPE
tech-c:          AB16163-RIPE
status:          ASSIGNED PI
mnt-by:          RIPE-NCC-HM-PI-MNT
mnt-lower:       RIPE-NCC-HM-PI-MNT
mnt-by:          SPECIALIST-MNT
mnt-routes:      SPECIALIST-MNT
mnt-domains:     SPECIALIST-MNT
source:          RIPE # Filtered

organisation:    ORG-SL206-RIPE
org-name:        Specialist, Ltd
org-type:        OTHER
descr:           Specialist, Ltd, Rybnitsa, MD
address:         I. Soltysa 12, Rybnitsa, MD
phone:           +373-777-12921
phone:           +373-693-18189
phone:           +373-777-65071
fax-no:          +373-555-43073
mnt-ref:         MONITORING-MNT
abuse-mailbox:   abuse@lan-rybnitsa.com
mnt-by:          SPECIALIST-MNT
source:          RIPE # Filtered

person:          Vladimir Pilan
address:         I. Soltysa 12, Rybnitsa, MD
phone:           +373-777-12921
fax-no:          +373-555-43073
nic-hdl:         VP2841-RIPE
source:          RIPE # Filtered
mnt-by:          SPECIALIST-MNT

person:          Anatoly Belitsky
address:         I. Soltysa 12, Rybnitsa, MD
phone:           +373-777-65071
fax-no:          +373-555-43073
nic-hdl:         AB16163-RIPE
source:          RIPE # Filtered
mnt-by:          SPECIALIST-MNT

% Information related to '194.28.112.0/22AS48691'

route:           194.28.112.0/22
descr:           Specialst-route2
origin:          AS48691
mnt-by:          SPECIALIST-MNT
source:          RIPE # Filtered


Google's Safe Browsing diagnostics only show part of the story:

Safe Browsing
Diagnostic page for AS48691 (SPECIALIST)

What happened when Google visited sites hosted on this network?

    Of the 28 site(s) we tested on this network over the past 90 days, none served content that resulted in malicious software being downloaded and installed without user consent.

    The last time Google tested a site on this network was on 2010-10-09, and the last time suspicious content was found was on 2010-10-09.

Has this network hosted sites acting as intermediaries for further malware distribution?

    Over the past 90 days, we found 3 site(s) on this network, including, for example, 0jiqjmk3.ru/, fngmadopx.ru/, bingosyssaver24.com/, that appeared to function as intermediaries for the infection of 2 other site(s) including, for example, rttattorneys.com/, mygooglephotos.webs.com/.

Has this network hosted sites that have distributed malware?

    Yes, this network has hosted sites that have distributed malicious software in the past 90 days. We found 15 site(s), including, for example, 194.28.112.0/, xebetak.ru/, bingosyssaver24.com/, that infected 865 other site(s), including, for example, slutdrive.com/, stvid.com/, amatura.com/.
The MyWOT reputation of the sites on this network is very bad [CSV]. It is unlikely that this netblock will be used for anything other than evil purposes, so blocking 194.28.112.0 - 194.28.115.255 (194.28.112.0/22) is probably a good idea, or block the domains listed below.

Globdomain.ru
Greenter.ru
Photois.org
Style-vk.com
Vkstyle.net
07tqqwem.ru
0jiqjmk3.ru
0qhe7y6o.ru
0scoubpk.ru
0st44x7z.ru
0w6scx6a.ru
1001jimm.ru
23qjmdic.ru
27wuxt37.ru
28iue5ri.ru
28jnbuak.ru
2be-trends.ru
2poaxz3k.ru
2ti0pv3y.ru
2zm5mcep.ru
30zcz8ot.ru
32iafdnp.ru
3a0stbqe.ru
3jruf6nc.ru
40ktc2tn.ru
4hp2ag6c.ru
4jfhywir.ru
4mausx2w.ru
4y8pqcby.ru
5c4aiwcs.ru
5gsco2w5.ru
5q4eyd2w.ru
5znhff2s.ru
6dpg3khy.ru
6ojj8sks.ru
6pgsqndh.ru
777wxpc7.ru
78w88epi.ru
83qndvnj.ru
868r5e0b.ru
8n7pnyyr.ru
8reclame.ru
Alwaysprokladka.com
Artenhart.ru
Artiestenloket.ru
Ashcbzbbbz.ru
Aslkjhqeqw.ru
Atyyyopg.ru
Azaamdwo.ru
Bim6xe3t.ru
Bjpfk0rm.ru
Boskoop2nepal.info
Bossal.info
Bramrozafestival.info
Brand-central.info
Bvo62o0i.ru
Bwzz5c32.ru
C28xd2ck.ru
C6iv0x3j.ru
Cafetariaroyal.info
Cateredchaletfrankrijk.ru
Cf8sagkn.ru
Childsurvival.info
Creedenceclearwatersurvival.info
Crosslinks-services.ru
Csokolom.ru
Cw5k47ye.ru
D6vjbbv6.ru
Damesfutsal.info
Datadigital.info
Dekeukenbouwer.ru
Dotyuzcifl.ru
Duz5n2ca.ru
Dwunvuum.ru
Ea7xh4vw.ru
Ef6j6u0r.ru
F50rbdb8.ru
Farmsurvival.info
Fbbktj2z.ru
Fhlaenyxor.ru
Fimpvs8t.ru
Fppf2h28.ru
Freemobiledns.mobi
Gayq8rgx.ru
Gdwre766.ru
Gopchicken.ru
Gscrystal.info
H6poe6or.ru
Haaglandia-futsal.info
Hc6zxms4.ru
Hem3oxjh.ru
Henness.ru
Hetkwispelaartje.ru
Hotcrystal.info
Huisenenergielabel.info
Hvdwal.info
I4nhjopf.ru
I7in0b64.ru
Ic2u8kk0.ru
Ihbkbzcm.ru
Ihcswgcz.ru
Ihjddgqs.ru
Inventivecapital.info
Io060fcn.ru
Io0yfyc8.ru
J6kb3pfa.ru
J7k6xze2.ru
J7oc5v3o.ru
Jbsc.ru
Jimakolo.ru
Jimm2rusru.ru
Jimmbly.ru
Jimmdlyadjimmru.ru
Jimmdlyasamsa.ru
Jimmdns1.ru
Jimmdns3.ru
Jimmdns4.ru
Jimmdns5.ru
Jimmdnsru.ru
Jimmfanfik.ru
Jimmfantasy2.ru
Jimmfaqru.ru
Jimmforyouru.ru
Jimmfreeru.ru
Jimmgps.ru
Jimmgpsru.ru
Jimmhobbyrus.ru
Jimmhostoryru.ru
Jimmhtcru.ru
Jimmicqlop.ru
Jimmkolipo12.ru
Jimmkonstructru.ru
Jimmlocationrus.ru
Jimmlocationss.ru
Jimmlokolok.ru
Jimmmobru2.ru
Jimmmobru4.ru
Jimmnewsru.ru
Jimmokiloi.ru
Jimmonlineru.ru
Jimmonlinerus.ru
Jimmosuk.ru
Jimmplanetka.ru
Jimmpolice12.ru
Jimmpolomba.ru
Jimmpoloniy.ru
Jimmpozor.ru
Jimmprofile.ru
Jimmprofilerus.ru
Jimmrurus.ru
Jimmsamsungru.ru
Jimmtebepii.ru
Jimmtrahaet.ru
Jimmvmozg.ru
Jimmyblo.ru
Jnano5gh.ru
Jokerjokk.ru
Jongfcmp.ru
Josal.info
Joy-adventure.ru
Kadefestival.info
Kefpvbsi.ru
Kfgemaae.ru
Kleinhengstdael.info
Kojvdspw.ru
Koliander.ru
Langsdewal.info
Liononlinensd.ru
Lipsticpi.ru
Listikjimm.ru
Literatuurfestival.info
Lokipol.ru
Lopolok.ru
Macdental.info
Maruuhp2.ru
Meeenti.ru
Mipolok.ru
Mjbims7m.ru
Mokojikol.ru
Momomom.ru
Mrt0zqcb.ru
Multimediamagazine.ru
Mvanderwal.info
Mxek5t5g.ru
N7wg0g5w.ru
Naaminkristal.info
Noordelijkkoorfestival.info
Nv8os6yt.ru
Nxo48a7g.ru
O3wg4sya.ru
Ocggnaif.ru
Ofz5qzgu.ru
Oh7iumr7.ru
Ohjbkyudil.ru
Ojimmx4.ru
Ojimmx6.ru
Okiolk.ru
Onlinecheapsdo.ru
Onlinefeeds.ru
Onlinefreeze.ru
Onlinegearsd.ru
Onlinegop.ru
Onlinejimmmovse.ru
Onlinejobsfrees.ru
Onlinelongjorn.ru
Onlineonlkiok.ru
Onlinerujimm.ru
Onlineteammaster.ru
Onlinetechnicals.ru
Onlineworkers.ru
Onlinkrt.ru
Oordfestival.info
Orthocapelle.ru
Patronah.ru
Paulvosdewael.info
Petstotal.info
Piscine-ecologique.ru
Pororkol.ru
Praktijkdebergkristal.info
Prc6t7z3.ru
Psxdv0nr.ru
Pvbsiy5y.ru
Q2auv3at.ru
Q3ysg05s.ru
Q8juhmhh.ru
Qbecqe0s.ru
Qec5beqn.ru
Qzhvlpso.ru
Rebootfestival.info
Renarental.info
Retrosensual.info
Rickenchantal.info
Rietfestival.info
Rikosdhu.ru
Ronaldknol.ru
Rs3gpd0m.ru
Rudjimmdjimm.ru
Rvvcoal.info
S4gvhd35.ru
S748eop4.ru
Sadjbamn.ru
Sadjkadkasj.ru
Schutrups.ru
Selavis.ru
Sgivnn0t.ru
Smart-accountant.ru
Spankabel.info
Srowig.ru
Stichtingderevival.info
Stiltefestival.info
Stpf6qpv.ru
Sv4wmtxj.ru
T0a2afyq.ru
T3tzynvj.ru
T8hftjx8.ru
Tinkel-bel.info
Transfusionfestival.info
Trustincompanies.ru
Twqhde3i.ru
U5fyfzjt.ru
Ucf47vnu.ru
Uplcash.com
Vaxlgfsb.ru
Vdmi2fz8.ru
Vecgndv8.ru
Vetstival.info
Vgksry7k.ru
Vicl.info
Vk0urcvu.ru
Vroegop.ru
W8iroomb.ru
Webeval.info
Wiiqiieiqa.ru
Worldfuneral.info
Wsewf0rw.ru
Wyvbe7vg.ru
X7p03g0j.ru
X8zv6433.ru
Xni27ftd.ru
Xthjrgxz.ru
Xu44i03y.ru
Yearsforfan.ru
Yi0ewtmd.ru
Yldpkozfmi.ru
Yo4nyzyc.ru
Yp7o07nq.ru
Z26hggcb.ru
Z7u4wtfe.ru
Zatuhnichmo.com
Zsrd4xj5.ru
Zumbafestival.info
Zxcvsbrds.ru
Zznks8fh.ru
Fijicool.com
1l1i16b0.com
Nl6fa53.com
Fruitboss.ru
Katamizo.info
Promoup.info
Partnerspromo.info
Zumnox.info
Bingosyssaver21.com
Bingosyssaver22.com
Bingosyssaver23.com
Bingosyssaver24.com
Bingosyssaver25.com
Bingosyssaver26.com
Bingosyssaver27.com
Bingosyssaver28.com
Bingosyssaver29.com
Bingosyssaver30.com
Freerobertodefeater.com
Myrobertodefeater.com
Newrobertodefeater.com
Robertodefeater.com
Robertodefeaternow.com
Robertodefeateronline.com
Robertodefeaters.com
Robertodefeatersite.com
Robertodefeaterstore.com
Therobertodefeater.com
Claerprotection11.com
Claerprotection12.com
Claerprotection13.com
Claerprotection14.com
Claerprotection15.com
Claerprotection16.com
Claerprotection17.com
Claerprotection18.com