New Browlock domains - Nov 14, 2013

Thu, Nov 14 2013
#DhiaLite - New browser-based ransomware domains on 188.138.70.192. Trying to spook you with a fake "Mandiant" banner, and a threating President Obama look ;)

They started resolving to 188.138.70.192 3 days ago.

#Sample url of the Browloack page

http://bnghy.gregspottery.com/copyright/w_/bz5bWyAKCIFU0ZQO7RJ8CVC5ojLr2_/CLOfoBhfFELx05zGM1dZppq9YtFRwf/3aUgvNEz06Cv9PRKZ-Fnhd0w~~/OTM4ODEzMWQyNzRjMTIwNThiYzMzMzgzYjFhMTk0ZmQ

Same path will work for all domains below.

/copyright/w_/bz5bWyAKCIFU0ZQO7RJ8CVC5ojLr2_/CLOfoBhfFELx05zGM1dZppq9YtFRwf/3aUgvNEz06Cv9PRKZ-Fnhd0w~~/OTM4ODEzMWQyNzRjMTIwNThiYzMzMzgzYjFhMTk0ZmQ

Same old lame trick with a javascript loop that iterates 100 times that shows a pop-up when you try to leave the page.

#Sample domains on 188.138.70.192

yjyufuu.nexslimce.com
jnytt.nexslim.tv
sefcse.moderndoctorsmagazine.com
fertt.moderndentistmagazine.com
ferrfr.medicalemployeenetworking.com
edfe.moderndentistmagazine.com
dthy.nexslim.tv
cfvser.moderndoctorsmagazine.com
vdrfg.loseweightswfl.com
efgwe.medicalemployeenetworking.com
nyjhdtj.localeventsandthingstodo.com
dfzgvdf.loseweightswfl.com
yhdt.mamasstylekitchen.com
gyjty.localeventsandthingstodo.com
gvregr.doncom.net
nydtj.mamasstylekitchen.com
yjyuh.gregspottery.com
dfsef.doncom.net
bnghy.gregspottery.com

END