Sponsored by..

Wednesday 3 September 2008

"Bangui" malware domains

A whole set of domains distributing malware, currently based on 206.53.51.119 and allegedly registered to someone in Bangui (although most likely it is the RBN again). These domains are being used in blog spam and also what appears to be PHP and ASP injection attacks.

Unlike some injection attacks, the pages carry some scraped text that's relevant to the URL. Combine this with the inbound links created through spam and injection attacks and you have a very black hat SEO campaign. Yahoo! seems to be more prone to this type of SEO than Google.

The pages on these domains use a javascript redirector (menu.js) to end up at a set of fake video and rogue anti-malware sites that install all sorts of nasty things.. again, these endpoints have the hallmark of the RBN.

  • Afwwwf.info
  • Apostit.info
  • Bcuioc.info
  • Bglkhg.org
  • Bihuru.org
  • Biiwhw.info
  • Bikgfjr.info
  • Bioblor.info
  • Bioqw.info
  • Biowfr.info
  • Bkjksl.org
  • Bkssdoue.info
  • Bloiw.org
  • Bocaca.org
  • Cascaa.info
  • Cbasoa.info
  • Cbr1000rrxx.info
  • Csccons.org
  • Cskaa.org
  • Eomnb.info
  • Fasca.info
  • Fasfw555.info
  • Fasw.org
  • Fbkshk.org
  • Fdsaa.org
  • Firstnax.org
  • Fjkjfjoi.info
  • Fjwiojnc.info
  • Flsab.info
  • Foeww.org
  • Foxrat.info
  • Fsaff.org
  • Fsafvn.info
  • Fsancao.info
  • Fsanp.org
  • Fsaqq.info
  • Fsaw.org
  • Fsfa22rr.info
  • Fsfkg.info
  • Fsfworg
  • Fsgkle.org
  • Fsjklhg.info
  • Fskjhgkb.info
  • Fullmediabase.net
  • Fwe75r4fyf65.cn
  • Fwfds.org
  • Fwfisow.org
  • Fwjijc.org
  • Fwoijwh.org
  • Gcoigkm.org
  • Gewop.info
  • Gjgkgjhew.org
  • Golodnijya.org
  • Gucwd.org
  • Hellodolly5k.net
  • Hellodomy5k.net
  • Hhkjj.org
  • Hkljccc.info
  • Hodnejgreat.info
  • Hofhwbc.info
  • Hohotv.org
  • Homosapien5k.net
  • Hrr553.info
  • Hudinarjiii.cn
  • Itgfbn.org
  • Jfldsh.org
  • Jflhg.info
  • Jlbyuo.org
  • Jnbq.info
  • Jowely.org
  • Jplhnh.info
  • Juiok.org
  • Jumpsert.org
  • Jwionw.info
  • Kiwedox.org
  • Kjhiofw.org
  • Kjhlfsh.org
  • Knwponc.org
  • Madnes.info
  • Mazafaker.com
  • Mfpwjmc.org
  • Mkmcsss.org
  • Mpfwmcs.org
  • Mpkcmzz.org
  • Mpmccz.org
  • Mybestz5k.net
  • Nado1000traffa.info
  • Nfeow.org
  • Nfwojw.org
  • Nfwon.org
  • Nhphpkj.info
  • Nifa422.info
  • Njpaw.info
  • Nosdsh.org
  • Pokoder.org
  • Sonvfs.org
  • Werbin.org
  • Wfwcn.org
  • Wn59whgp3w.cn
  • Workfox.info
  • Yzfr1yamahad.info

No comments: