Sponsored by..

Thursday 5 December 2013

Something unpleasant on 89.248.164.219 and 217.23.2.233

The IPs 89.248.164.219 (Ecatel, Netherlands) and 217.23.2.233 and (Worldstream, Netherlands) appear to be hosting some sort of bogus Firefox and Media Player downloads. (You can see the VirusTotal reports here and here).

All the domains in use appear at first glance to be genuine but are basically some sort of typosquatting. A full list of all the subdomains I can find are at the end of the blog, but in the meantime I recommend using the following blocklist:
89.248.164.219
217.23.2.233
antivirous.co.uk
archictecture.com
bacharat.com
bankrupcyloans.com
beadedjewlry.com
blog-skin.com
buisinessplan.com
camgirslive.com
catalag.com
cheatscoads.com
cheepplaneticket.com
deadbeatmom.com
detroitresturants.com
diabeticreciepies.com
dictionairy.co.uk
dieselgeneraters.com
florenceaccomodation.com
forclosedhomelistings.com
franshising.com
freemagzine.com
freerngtones.com
freesudukogames.com
freexxxvideodownloads.com
genology.co.uk
gitaretab.com
guatars.com
itallianfood.com
ladyring.com
lesons.com
magneticjewlry.com
medicalpaymentsolutions.com
milffiles.com
monstercooks.com
mygirly.com
noebook.com
olineauction.com
pacmangames.co.uk
photogallary.co.uk
pokerstatergy.com
proverts.com
rentalaccomodation.com
songlyrices.com
swappingwifes.com
timehare.com
violn.com
wwwmotorcycleparts.com
wwwqwikster.com

I can see these following subdomains in use, although it is probably easier just to block the main domains:
exclusiverewards.antivirous.co.uk
exclusiverewards.genology.co.uk
ny4zz.exclusiverewards.itallianfood.com
xo9zz.exclusiverewards.itallianfood.com
jsazz.exclusiverewards.itallianfood.com
xabzz.exclusiverewards.itallianfood.com
tfdzz.exclusiverewards.itallianfood.com
vkizz.exclusiverewards.itallianfood.com
ibmzz.exclusiverewards.itallianfood.com
jtozz.exclusiverewards.itallianfood.com
ntvzz.exclusiverewards.itallianfood.com
ytyzz.exclusiverewards.itallianfood.com
porn-tube.ladyring.com
popularprizes.florenceaccomodation.com
portube.freexxxvideodownloads.com
2h2zz.exclusiverewards.songlyrices.com
hnezz.exclusiverewards.songlyrices.com
kwizz.exclusiverewards.songlyrices.com
o6mzz.exclusiverewards.songlyrices.com
6ppzz.exclusiverewards.songlyrices.com
wrqzz.exclusiverewards.songlyrices.com
3xszz.exclusiverewards.songlyrices.com
tnyzz.exclusiverewards.songlyrices.com
7yyzz.exclusiverewards.songlyrices.com
tszzz.exclusiverewards.songlyrices.com
md2zz.popularprizes.songlyrices.com
4f2zz.popularprizes.songlyrices.com
t43zz.popularprizes.songlyrices.com
rbazz.popularprizes.songlyrices.com
eqazz.popularprizes.songlyrices.com
iwazz.popularprizes.songlyrices.com
vdfzz.popularprizes.songlyrices.com
6kfzz.popularprizes.songlyrices.com
gfhzz.popularprizes.songlyrices.com
zyhzz.popularprizes.songlyrices.com
ukrzz.popularprizes.songlyrices.com
dorzz.popularprizes.songlyrices.com
2aszz.popularprizes.songlyrices.com
6hszz.popularprizes.songlyrices.com
qgtzz.popularprizes.songlyrices.com
3lwzz.popularprizes.songlyrices.com
bfzzz.popularprizes.songlyrices.com
5hzzz.popularprizes.songlyrices.com
bjzzz.popularprizes.songlyrices.com
aqzzz.popularprizes.songlyrices.com
txt-hotties.swappingwifes.com
rewardzone.monstercooks.com
exclusiverewards.guatars.com
popularprizes.dieselgeneraters.com
popularprizes.bacharat.com
popularprizes.beadedjewlry.com
www.exclusiverewards.dictionairy.co.uk
www1.exclusiverewards.dictionairy.co.uk
prizecentral.noebook.com
www.popularprizes.bacharat.com
ecig.timehare.com
cloud.timehare.com
popularprizes.blog-skin.com
pornvids.milffiles.com
porn-tube.camgirslive.com
rewardzone.cheatscoads.com
agentix.deadbeatmom.com
cleanse.deadbeatmom.com
442zz.popularprizes.songlyrices.com
4btzz.popularprizes.songlyrices.com
7yhzz.popularprizes.songlyrices.com
cfzzz.popularprizes.songlyrices.com
hmdzz.popularprizes.songlyrices.com
mpazz.popularprizes.songlyrices.com
nokzz.popularprizes.songlyrices.com
povzz.popularprizes.songlyrices.com
psmzz.popularprizes.songlyrices.com
u4wzz.popularprizes.songlyrices.com
vufzz.popularprizes.songlyrices.com
xehzz.popularprizes.songlyrices.com
rauzz.exclusiverewards.songlyrices.com
sywzz.exclusiverewards.songlyrices.com
wwbzz.exclusiverewards.songlyrices.com
download.wwwqwikster.com
www.download.wwwqwikster.com
www1.download.wwwqwikster.com
watchnow.freerngtones.com
watch-now.freerngtones.com
playingnow.freerngtones.com
watching-now.freerngtones.com
0ozzz.exclusiverewards.itallianfood.com
3o9zz.exclusiverewards.itallianfood.com
bcvzz.exclusiverewards.itallianfood.com
n9vzz.exclusiverewards.itallianfood.com
oxwzz.exclusiverewards.itallianfood.com
yt5zz.exclusiverewards.itallianfood.com
www1.rewardzone.monstercooks.com
exclusive-rewards.dieselgeneraters.com
weightloss.diabeticreciepies.com
popularprizes.wwwmotorcycleparts.com
exclusiverewards.florenceaccomodation.com
www.securessl.forclosedhomelistings.com
congratulations.medicalpaymentsolutions.com
0eizz.exclusiverewards.songlyrices.com
3dxzz.exclusiverewards.songlyrices.com
6lzzz.exclusiverewards.songlyrices.com
7nrzz.exclusiverewards.songlyrices.com
watch-now.magneticjewlry.com
rewardzone.dieselgeneraters.com
popularprizes.pacmangames.co.uk
rewardzone.genology.co.uk
popularprizes.photogallary.co.uk
uh5zz.exclusiverewards.itallianfood.com
jd7zz.exclusiverewards.itallianfood.com
fe7zz.exclusiverewards.itallianfood.com
xxazz.exclusiverewards.itallianfood.com
tqdzz.exclusiverewards.itallianfood.com
mudzz.exclusiverewards.itallianfood.com
p8hzz.exclusiverewards.itallianfood.com
soizz.exclusiverewards.itallianfood.com
2hkzz.exclusiverewards.itallianfood.com
qpvzz.exclusiverewards.itallianfood.com
rewardzone.archictecture.com
rewardzone.florenceaccomodation.com
rewardzone.rentalaccomodation.com
uj8zz.exclusiverewards.songlyrices.com
usdzz.exclusiverewards.songlyrices.com
ashzz.exclusiverewards.songlyrices.com
cmkzz.exclusiverewards.songlyrices.com
6omzz.exclusiverewards.songlyrices.com
agqzz.exclusiverewards.songlyrices.com
vjszz.exclusiverewards.songlyrices.com
42wzz.exclusiverewards.songlyrices.com
sbxzz.exclusiverewards.songlyrices.com
ouxzz.exclusiverewards.songlyrices.com
gh0zz.popularprizes.songlyrices.com
oh3zz.popularprizes.songlyrices.com
vy3zz.popularprizes.songlyrices.com
nd4zz.popularprizes.songlyrices.com
zj8zz.popularprizes.songlyrices.com
jf9zz.popularprizes.songlyrices.com
knbzz.popularprizes.songlyrices.com
dtczz.popularprizes.songlyrices.com
ffdzz.popularprizes.songlyrices.com
xjezz.popularprizes.songlyrices.com
fofzz.popularprizes.songlyrices.com
dljzz.popularprizes.songlyrices.com
5wkzz.popularprizes.songlyrices.com
9zlzz.popularprizes.songlyrices.com
dxmzz.popularprizes.songlyrices.com
plnzz.popularprizes.songlyrices.com
xsozz.popularprizes.songlyrices.com
zwozz.popularprizes.songlyrices.com
gzozz.popularprizes.songlyrices.com
vrszz.popularprizes.songlyrices.com
t4tzz.popularprizes.songlyrices.com
99wzz.popularprizes.songlyrices.com
9swzz.popularprizes.songlyrices.com
ycxzz.popularprizes.songlyrices.com
securessl.forclosedhomelistings.com
news-alert.bankrupcyloans.com
exclusiverewards.medicalpaymentsolutions.com
popularprizes.medicalpaymentsolutions.com
surveycentral.pokerstatergy.com
popularprizes.genology.co.uk
exclusiverewards.dictionairy.co.uk
exclusiverewards.pacmangames.co.uk
rewardzone.violn.com
playgames.lesons.com
nowplay.catalag.com
txtpussy.mygirly.com
fucknow.proverts.com
xxxtube.proverts.com
win.timehare.com
agentixs.timehare.com
mensfitness.timehare.com
rewardzone.blog-skin.com
globalrewards.blog-skin.com
exclusive-rewards.blog-skin.com
exclusive-rewards.gitaretab.com
www.rewardzone.cheatscoads.com
download.franshising.com
nowplay.freemagzine.com
4cpzz.rewardzone.songlyrices.com
ehrzz.rewardzone.songlyrices.com
43uzz.popularprizes.songlyrices.com
a73zz.popularprizes.songlyrices.com
bnkzz.popularprizes.songlyrices.com
kvxzz.popularprizes.songlyrices.com
n5zzz.popularprizes.songlyrices.com
ntlzz.popularprizes.songlyrices.com
nx9zz.popularprizes.songlyrices.com
nzazz.popularprizes.songlyrices.com
obzzz.popularprizes.songlyrices.com
oyxzz.popularprizes.songlyrices.com
somzz.popularprizes.songlyrices.com
teizz.popularprizes.songlyrices.com
xjnzz.popularprizes.songlyrices.com
yt3zz.popularprizes.songlyrices.com
3z4zz.exclusiverewards.songlyrices.com
855zz.exclusiverewards.songlyrices.com
cqfzz.exclusiverewards.songlyrices.com
phjzz.exclusiverewards.songlyrices.com
q7gzz.exclusiverewards.songlyrices.com
tyvzz.exclusiverewards.songlyrices.com
z3nzz.exclusiverewards.songlyrices.com
hotmail.download.wwwqwikster.com
www1.watch-now.freerngtones.com
a5vzz.exclusiverewards.itallianfood.com
c7rzz.exclusiverewards.itallianfood.com
gnszz.exclusiverewards.itallianfood.com
hbjzz.exclusiverewards.itallianfood.com
i6jzz.exclusiverewards.itallianfood.com
okbzz.exclusiverewards.itallianfood.com
owozz.exclusiverewards.itallianfood.com
ucqzz.exclusiverewards.itallianfood.com
popularprizes.olineauction.com
rewardzone.buisinessplan.com
www1.surveycentral.pokerstatergy.com
globalpromotions.pokerstatergy.com
www1.news-alert.bankrupcyloans.com
www1.watch-now.magneticjewlry.com
congratulations.freesudukogames.com
exclusiverewards.freesudukogames.com
exclusive-rewards.cheepplaneticket.com
www1.rewardzone.dieselgeneraters.com
globalrewards.dieselgeneraters.com
exclusiverewards.dieselgeneraters.com
rewardzone.detroitresturants.com
www1.securessl.forclosedhomelistings.com
axizz.exclusiverewards.songlyrices.com
cqdzz.exclusiverewards.songlyrices.com

No comments: