Sponsored by..

Friday 8 November 2013

Malware sites to block 8/11/2013 (Nuclear EK)

The IPs and domains listed below are currently in use to distribute the Nuclear exploit kit (example). I strongly recommend blocking them or the 142.4.194.0/30 range in which these reside. Many (but not all) of them are already flagged as being malicious by SURBL and Google.

The domains are being used with subdomains, so they don't resolve directly. I have identified 3768 domains in this OVH range, allocated to:

CustName:       Private Customer
Address:        Private Residence
City:           Penziatki
StateProv:     
PostalCode:     430000
Country:        RU
RegDate:        2013-08-12
Updated:        2013-08-12
Ref:            http://whois.arin.net/rest/customer/C04668267


(Hat tip to a contact who originally flagged the infection up, I just added a bit more research. If you're reading this you know who you are)

The subdomains can found in this file [csv] but as it is almost definitely incomplete it is simpler to use the blocklist below:
142.4.194.0/30
alertoriginal.biz
ardaymarvl.biz
assayimagination.biz
assessdiscover.biz
atrlook.biz
atrprinc.biz
batillbicdaylook.biz
bombepear.biz
briefthink.biz
browseimagine.biz
canadadayglamorou.biz
checkimagine.biz
chinesenewyearglamorous.biz
chinnwyarlook.biz
cincodmayogold.biz
clipalarm.biz
columbusdaygold.biz
comonautham.biz
comthytria.biz
comtwary.biz
cratranticipation.biz
custardpeach.biz
electiondaypretty.biz
examinevisionary.biz
flagdayfahionabl.biz
fluagdaychic.biz
grandparntdaycharming.biz
guyfawkdayfahionabl.biz
guyfawkdaylganc.biz
hallowbicndram.biz
inspectionimagination.biz
judgebegin.biz
lctiondaycoutur.biz
lctiondayfabulou.biz
lctiondayglamour.biz
likeinspire.biz
likeinvent.biz
lincolnbirthdaydazzl.biz
lookbackstrategy.biz
magicbizic.biz
mardigrapopular.biz
markstrategy.biz
martinlutherkingdaycharm.biz
maydayheavenly.biz
maydaylganc.biz
meringuebreadfruit.biz
mmorialdayattractiv.biz
mmorialdaychic.biz
mothrdayglamour.biz
muttnikcontntmnt.biz
newyearsevefashion.biz
newyearsevemagical.biz
nwyardayclay.biz
pacincurity.biz
plantabicrycontntmnt.biz
pridntdaynchant.biz
purimcharming.biz
radiationamumnt.biz
randayflar.biz
rangeinvent.biz
rangelab.biz
reviewimagination.biz
ringupn.biz
rohhahanahfabulou.biz
rohhahanahway.biz
scanbegin.biz
sundaebanana.biz
tlmtrygrumpy.biz
tortekiwi.biz
valentinesdaypearl.biz
valntincharming.biz
valntindaycoutur.biz
valntintrnd.biz
waxqgturumph.biz
yomkippurdashing.biz
yvanity.biz
zabicoconut.biz


No comments: