Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- Thu, Nov 15 2013
- #DhiaLite - New set of suspicious short lived .pl subdomains shifted from 109.236.83.184 and 109.236.83.185 to start resolving to 109.236.83.186 today and still going on.
- Follow up to http://pastebin.com/s8ARXGd2
- and
- http://pastebin.com/hBS4u1cT
- Likely subdomains will shift to the next few contiguous IPs.
- Spike in traffic for these subdomains then they stop resolving.
- Possibly used for a similar Malvertising -> EK -> ransomware campaign as in
- http://www.malekal.com/2013/07/31/en-urausy-adultfriendzfinder-malvertising-banner/
- Yet to be confirmed.
- Possible Sakura EK based on suggestions from @MalwareSigs
- Currently about 130+ subdomains have resolved to this IP, and more are popping up.
- These subdomains are registered under the Polish city 2LDs
- pruszkow.pl
- #Sample of subdomains on 109.236.83.186
- znamo.taxidermy.pruszkow.pl
- yz67.grippro.pruszkow.pl
- youtu.musicvideoswiz.pruszkow.pl
- yingb.ngs55.pruszkow.pl
- xpres.grippro.pruszkow.pl
- wools.cambridgeaudio.pruszkow.pl
- wirec.modaskidka.pruszkow.pl
- westl.seligaparaiba.pruszkow.pl
- wella.modaskidka.pruszkow.pl
- webte.citybeat.pruszkow.pl
- webia.fadama.pruszkow.pl
- vwt4f.wtfgang.pruszkow.pl
- vrcep.fadama.pruszkow.pl
- vidpi.cambridgeaudio.pruszkow.pl
- venus.cambridgeaudio.pruszkow.pl
- vecto.alnatura.pruszkow.pl
- utpue.ngs55.pruszkow.pl
- ultim.wtfgang.pruszkow.pl
- tvsh2.seligaparaiba.pruszkow.pl
- tvmah.seligaparaiba.pruszkow.pl
- tusex.usefulbookmarks.pruszkow.pl
- trues.citybeat.pruszkow.pl
- trada.grippro.pruszkow.pl
- topcl.bowl.pruszkow.pl
- tntpa.alnatura.pruszkow.pl
- tcmba.citybeat.pruszkow.pl
- tbb.seligaparaiba.pruszkow.pl
- swell.artgrafica.pruszkow.pl
- subba.wtfgang.pruszkow.pl
- sozia.cambridgeaudio.pruszkow.pl
- skare.bowl.pruszkow.pl
- sitem.alnatura.pruszkow.pl
- sibit.alnatura.pruszkow.pl
- shopm.musicvideoswiz.pruszkow.pl
- shama.fadama.pruszkow.pl
- sexcs.eroticsnap.pruszkow.pl
- satur.seligaparaiba.pruszkow.pl
- sarut.citybeat.pruszkow.pl
- salir.cambridgeaudio.pruszkow.pl
- saint.citybeat.pruszkow.pl
- sagli.ngs55.pruszkow.pl
- rugcm.modaskidka.pruszkow.pl
- rsmit.seligaparaiba.pruszkow.pl
- reser.musicvideoswiz.pruszkow.pl
- remax.musicvideoswiz.pruszkow.pl
- reall.wtfgang.pruszkow.pl
- poire.citybeat.pruszkow.pl
- pitch.usefulbookmarks.pruszkow.pl
- penny.androiduipatterns.pruszkow.pl
- patta.alnatura.pruszkow.pl
- panel.fadama.pruszkow.pl
- openp.modaskidka.pruszkow.pl
- ocean.modaskidka.pruszkow.pl
- numbe.eroticsnap.pruszkow.pl
- nosso.grippro.pruszkow.pl
- neomo.citybeat.pruszkow.pl
- moibr.citybeat.pruszkow.pl
- miste.musicvideoswiz.pruszkow.pl
- meyda.bowl.pruszkow.pl
- metro.seligaparaiba.pruszkow.pl
- mende.eroticsnap.pruszkow.pl
- matri.grippro.pruszkow.pl
- mater.modaskidka.pruszkow.pl
- manua.alnatura.pruszkow.pl
- luxeb.cambridgeaudio.pruszkow.pl
- ltmco.wtfgang.pruszkow.pl
- lrcvi.usefulbookmarks.pruszkow.pl
- losmi.alnatura.pruszkow.pl
- loanw.bowl.pruszkow.pl
- linea.citybeat.pruszkow.pl
- lifes.modaskidka.pruszkow.pl
- lexus.wtfgang.pruszkow.pl
- lewis.fadama.pruszkow.pl
- leigh.musicvideoswiz.pruszkow.pl
- labor.musicvideoswiz.pruszkow.pl
- ko.ngs55.pruszkow.pl
- kolom.cambridgeaudio.pruszkow.pl
- kkcom.musicvideoswiz.pruszkow.pl
- ionwa.citybeat.pruszkow.pl
- infox.wtfgang.pruszkow.pl
- incom.usefulbookmarks.pruszkow.pl
- immmc.fadama.pruszkow.pl
- ihote.artgrafica.pruszkow.pl
- igrac.usefulbookmarks.pruszkow.pl
- igf.ngs55.pruszkow.pl
- ideas.ngs55.pruszkow.pl
- icepo.modaskidka.pruszkow.pl
- huffi.seligaparaiba.pruszkow.pl
- hostc.grippro.pruszkow.pl
- homeb.bowl.pruszkow.pl
- hitpi.grippro.pruszkow.pl
- hedmo.alnatura.pruszkow.pl
- hasto.bowl.pruszkow.pl
- globa.grippro.pruszkow.pl
- fueng.taxidermy.pruszkow.pl
- fourc.grippro.pruszkow.pl
- fmfor.bowl.pruszkow.pl
- flyer.grippro.pruszkow.pl
- flyde.musicvideoswiz.pruszkow.pl
- findh.seligaparaiba.pruszkow.pl
- ficou.bowl.pruszkow.pl
- fanta.eroticsnap.pruszkow.pl
- famil.grippro.pruszkow.pl
- eroti.androiduipatterns.pruszkow.pl
- embed.androiduipatterns.pruszkow.pl
- educa.androiduipatterns.pruszkow.pl
- dream.artgrafica.pruszkow.pl
- dotne.usefulbookmarks.pruszkow.pl
- dinne.grippro.pruszkow.pl
- dialo.seligaparaiba.pruszkow.pl
- destr.wtfgang.pruszkow.pl
- confe.ngs55.pruszkow.pl
- comid.artgrafica.pruszkow.pl
- coins.ngs55.pruszkow.pl
- clean.alnatura.pruszkow.pl
- chetu.cambridgeaudio.pruszkow.pl
- cbssi.seligaparaiba.pruszkow.pl
- casin.alnatura.pruszkow.pl
- cares.taxidermy.pruszkow.pl
- cardm.bowl.pruszkow.pl
- bycap.citybeat.pruszkow.pl
- bunke.bowl.pruszkow.pl
- brisy.modaskidka.pruszkow.pl
- bbuss.cambridgeaudio.pruszkow.pl
- bailk.bowl.pruszkow.pl
- azvi.citybeat.pruszkow.pl
- ausla.wtfgang.pruszkow.pl
- asxcf.fadama.pruszkow.pl
- askcm.eroticsnap.pruszkow.pl
- apren.ngs55.pruszkow.pl
- anime.androiduipatterns.pruszkow.pl
- alwaj.wtfgang.pruszkow.pl
- albat.bowl.pruszkow.pl
- alau.wtfgang.pruszkow.pl
- adams.musicvideoswiz.pruszkow.pl
- actti.citybeat.pruszkow.pl
- END
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement