I don't know quite what the exploit kit of the month is here, but the IP addresses 31.210.96.155, 31.210.96.156, 31.210.96.157 and 31.210.96.158 are currently serving up malware using hijacked GoDaddy domains, and are targeting victim websites by altering their .htaccess files to intercept traffic coming from search engines such as Google.
These IP addresses have been used for malware for some time and certainly historically they have been used for Ponmocup. I can't confirm that this is still the case, but given the bad IP and the obvious .htaccess hijack then it passed the Duck Test.
These IPs are allocated to Radore Veri Merkezi Hizmetleri A.S. in Turkey who control 31.210.64.0/18 which is a large block, so these IPs are probably a customer or even a customer of a customer.
VirusTotal reports for these IPs are pretty poor [1] [2] [3] [4]. I assume that they form part of an allocation 31.210.96.152/29 which I would very strongly recommend blocking that range, or indeed the entire /24 looks pretty worth
These domains all use the GoDaddy domaincontrol.com nameservers, which naturally means most of them are GoDaddy domains.. but not all of them, some are from other registrars. This list [pastebin] includes a selection of active subdomains that I can find.
I recommend permablocking the following IP range and temporarily blocking the following domains:
31.210.96.152/29
12stepdates.com
2cuonline.com
4runnerliftkits.com
8jutawan.com
advertisementdevil.com
allknowingpsychic.com
alloyfurnacerolls.com
alloymuffles.com
alloyradianttubes.com
allprodelta.com
alternateolympics.com
alternativeolympics.com
ancestorworshippublishing.com
antonzuponcic.com
aredietsok.com
assistlist.com
atvguidebooks.com
atvtrailguides.com
autoeventregistration.com
automotiveeventregistration.com
automotiveservicesavings.com
autoserviceevent.com
aylesburyironing.com
bahenasteel.com
barbeveragesla.com
basicmechanical.net
be3ne.com
be3ni.com
be3ny.com
benahavisrealestate.com
bestsilvercufflinks.com
blurlight.com
boeckman.net
bristolblog.com
buynewaz.com
bvvk.com
caninecolorgenetics.com
castlelawpa.com
charlesawells.com
chrisvessey.com
concept-kw.com
connectmetv.com
coreywasley.com
craigslistpads.com
cruzeonover.com
custom-chocolate-favors.com
customerdevil.com
dealerholidayevent.com
deliveredbythedevil.com
devilforacause.com
devilwithacause.com
djbobbyktoronto.com
drinkbluphoria.com
drinkcalories.net
dunstablekitchens.com
egunt.com
ellagphotography.com
encepha.net
enhancementlasers.com
enhancementlasers.net
e-squares.com
exceltoner.com
fantasyintro.com
fathersnsons.com
fatlosstoolkit.com
fortheloveofgadgets.com
gamezalot.com
gaybeefcake.com
gaybromance.com
gayconspiracy.com
gillspools.com
girlsgoneglamis.com
gliscastings.net
gliscentrifugal.com
glisfabrications.com
glisinc.com
golfironworks.com
golfnewsarkansas.com
golfnewscolorado.com
golfnewsconnecticut.com
golfnewsdelaware.com
golfnewsgeorgia.com
golfnewsindiana.com
golfnewsiowa.com
golfnewskansas.com
golfnewslouisiana.com
golfnewsmississippi.com
golfnewsmontana.com
golfnewsnebraska.com
golfnewsnewengland.com
golfnewsnewhampshire.com
golfnewsnewjersey.com
golfnewsnewyork.com
golfnewsohio.com
golfnewsoklahoma.com
golfnewssouthcarolina.com
golfnewstennessee.com
golfnewsutah.com
golfnewsvermont.com
golfnewswestvirginia.com
golfnewswisconsin.com
grafikcase.com
grafik-devils.com
gravittyproductions.com
greatserviceforless.com
gregorylknox.net
gryphonaz.com
gryphonus.com
gssportspics.com
hartford-capital.com
heattreatalloy.com
historyhobbybooks.com
hockeydoneright.com
hugesavingsevent.com
imfamousontheinternet.com
inboccaproductions.com
ingressgamer.com
inkandtonersale.com
italy-in-bocca.com
javaemulator.com
jaysonkrausenetwork.com
joannheilman.com
joeamericashow.com
joechenphoto.com
joeywilliamsdrums.com
jordandowney.com
jordandowney.net
juddnelsonstudio.com
kaitlinsplayground.com
killpoet.com
kokobon.com
ksupridewrestling.com
ksuwrestling.net
lakehousetimberranch.com
laser-enhancements.com
letseatinitaly.com
lifestylology.com
lindseytoothman.com
lionizetheworld.com
lions-mark.com
lsclinks.com
magicalmoods.com
makingwaves-salon.com
matthewstarner.com
memorialdaysavingsevent.com
menbeingsexy.com
middlefieldma.net
midnightastronomy.com
momsagainstmercury.com
mrsstyleseeker.com
musicjester.com
mwhiteman.com
myabadi.com
mycameraleash.com
myfuturephysique.com
mygaycrush.com
mystagingbox.com
myteacuppiggies.com
nacprint.com
newcarsat.com
newlogiq.com
newyorkjester.com
newyorkmascot.com
ngage-games.com
nutritionbydesign.com
oharvest.net
omobia.net
onlybetterdeal.com
organixharvest.com
panochevalleysolar.net
pascocountyhitmen.com
paxamericanaspirits.com
peekaboopumpkin.com
prestigehonda.net
propertiespain.com
realdealpsychic.com
reikisolar.com
renzograciemexico.com
restoremystuff.com
rled.net
roaringlion.com
room-depot.com
savedalyfield.com
schonbjj.com
sciencehunk.com
searchengineverified.com
secretmanclub.com
sellitandforgetittoday.com
snuffbottleworld.net
softmn.com
southvalleyrugby.com
sportdoneright.com
springcleaningevent.com
stainlessfabrications.com
strongpsychic.com
sullivan-county.com
tagdeed-translation.com
techsupportauction.com
telecomchicago.com
telecomillinois.com
telecomindiana.com
telecommichigan.com
thecinema6.com
thecollegeaddressshop.com
theeveningjoker.com
theknowledgekingdom.com
thenightlyjoker.com
thinkadmit.com
thisishowthisworks.com
thruellaseyes.com
timkennywebdesign.com
timsicecreamtruck.com
timsroadtrip.com
tri-swelding.com
uksportbook.com
usedcarsat.com
usedmobi.com
valentinesalesevent.com
vehicleexchangeprogram.com
vehicleservicediscount.com
vipoverload.com
virtualsofts.com
webrunchhard.com
wenerdhard.com
whhholdingusainc.com
whhusainc.net
whichcameratookthis.com
whybuyanewhome.com
workoutebook.com
worldblogsite.com
wrightdunbar.com
xn--80afcbdab0arg8e4c.com
xn--h1adlaje.net
yourcakedecoratingclass.com
yourcrystalball.com
yourspartanmovers.com
zoomtoner.com
zoopoints.com
z-sat.com
Note that the following domains have been cleaned up and are probably now safe.
apossibletruth.com
arrozconbeans.com
brads-test-site.com
casabodamia.com
catclinicgreensboro.com
charlestonremembered.com
chelseyfatula.com
creepyninja.com
ditchwindows.com
drdekloet.com
ebookleads.com
electhillary2016.com
evergentleonmymind.com
fasttwitterfollowers.com
foreverlivingon.com
gaycharacter.com
goldenpridewrestling.com
greensboroveterinarian.net
jcbsunglasses.com
jpcolton.com
kalkaneventfactory.com
newskase.com
pitstopmotorclub.com
registerforautoevent.com
remembercharleston.com
ridchinacne.com
saving53k.com
southernwakeautomotive.com
theneighborhoodaddressshop.com
ux-designer.com
williespage.com
windmuff.com
No comments:
Post a Comment