Nuclear Exploit Kit Mar 12
nserver: dns1.sledhike.com. | |
nserver: dns2.sledhike.com. | |
nserver: dns1.sneezetrunk.com. | |
nserver: dns2.sneezetrunk.com. | |
nserver: dns1.woolflight.com. | |
nserver: dns2.woolflight.com. | |
nserver: ns1.rutyplayme.ru. | |
nserver: ns2.rutyplayme.ru. | |
nserver: ns1.mulitdns.ru. | |
nserver: ns2.mulitdns.ru. | |
nserver: dns1.bitingairplane.com. | |
nserver: dns2.bitingairplane.com. | |
IPs observed: | |
198.27.114.69 (198.27.114.64/30 subnet, OVH) | |
198.50.231.207 (198.50.231.204/30 subnet, OVH) | |
198.50.186.234 (198.50.186.232/30 subnet, OVH) | |
198.50.186.238 (198.50.186.236/30 subnet, OVH) | |
198.27.114.18 (198.27.114.16/30 subnet, OVH) | |
198.50.186.252, 198.50.186.253 (198.50.186.252/30 subnet, OVH) | |
198.27.114.64/27, OVH | |
Sample rotator: hxxp://haptanboys.pw/css/look3.php on 188.226.155.102 from 162.210.193.233 | |
Update: haptangirls.pw - haptanboys.pw - haptangirls.pw rotators now all suspended :) | |
lakegullys.ru | |
summitcliff.ru | |
daleseashore.ru | |
slipperyflew.ru | |
besprav.ru | |
stovejet.ru | |
overshoesexcursion.ru | |
butconeu.ru | |
brutalo.ru | |
achilia.ru | |
broadua.ru | |
edpicas.ru | |
chillleisure.ru | |
abrastem.ru | |
ambrone.ru | |
arjanfr.ru | |
anodigga.ru | |
astrak.ru | |
atesne.ru | |
assauce.ru | |
Sample referrers: | |
http://www.claroline.net/demo-2 | |
3LD doesn't always use a dictionary any more. | |
For example: | |
384601:21 f239j38y5i7ev5pg7tz1-x2.brutalo.ru. 198.50.186.252 | |
387588:22 3ff8l67f4u012tf1s2-2ak.brutalo.ru. 198.50.186.252 | |
390314:23 fl9k9546z4l3x4-2.brutalo.ru. 198.50.186.252 | |
390733:24 a99jx54g643m4ox-ex2t.brutalo.ru. 198.50.186.252 | |
391028:25 w9t9wj5d46434w-2.brutalo.ru. 198.50.186.252 | |
391165:26 99ku5464tx3n4-2rv.brutalo.ru. 198.50.186.252 | |
391526:27 2i035ng4s42sz009n-2ek.butconeu.ru. 198.50.186.252 | |
392588:28 2j03ag5i44sn20an0gk9c-rr2n.butconeu.ru. 198.50.186.252 | |
392956:29 203gp5w4j4u2xt009-2.butconeu.ru. 198.50.186.252 | |
393116:30 mj20by3mc54y42009tz-ef2j.butconeu.ru. 198.50.186.252 | |
393986:33 i2d03544y2009a-bx2.butconeu.ru. 198.50.186.252 | |
395825:10 them.achilia.ru. 198.27.114.18 | |
396121:34 1ch423n9l3jo02pq52u-2hj.butconeu.ru. 198.50.186.252 | |
396729:36 5au8234a9ez920f-2.butconeu.ru. 198.50.186.252 | |
397583:37 be58e23wj4d992do0-l2a.butconeu.ru. 198.50.186.252 | |
399052:38 nh43in9yd1f5g2i9u3nc8-2b.butconeu.ru. 198.50.186.252 | |
399314:39 43os9j1529e38y-oa2.butconeu.ru. 198.50.186.252 | |
400488:40 fc439d1il5ow2lm9qj38tt-2.butconeu.ru. 198.50.186.252 | |
400797:41 4rl3n915j2k9ix3zk8-fo2.butconeu.ru. 198.50.186.252 | |
577060:27 po228u1ec48ca10cv8o2yk-2n.daleseashore.ru. 198.50.186.253 | |
577150:28 cc2019m0dk5b47i3ne8m-q2t.daleseashore.ru. 198.50.186.253 | |
577412:29 u2l0t1di9054fc738-2.daleseashore.ru. 198.50.186.253 | |
577551:30 20wr1e9vl05as473p8kv-kj2.daleseashore.ru. 198.50.186.253 | |
579445:31 39na97re8084n8x5-by2.daleseashore.ru. 198.50.186.253 | |
580010:33 v39978q08485-2.daleseashore.ru. 198.50.186.253 | |
580519:34 x2nn2fv814p81qk08aq2-2fs.daleseashore.ru. 198.50.186.253 | |
580588:35 oc2o2a8f1rg481i0m8c2kt-2.daleseashore.ru. 198.50.186.253 | |
581212:36 mc164hz4mu2085sp54q-c2.daleseashore.ru. 198.50.186.253 | |
581417:37 20665l43dd2mu3bm6rm-2.daleseashore.ru. 198.50.186.253 | |
581558:38 e2066sk5432w3yf6y-2.daleseashore.ru. 198.50.186.253 | |
582719:39 23vh9c20p46ns68lr5bv-ui2pe.daleseashore.ru. 198.50.186.253 | |
But it still uses a dictionary at the same time. For example: | |
not.achilia.ru | |
scientist.achilia.ru | |
young.achilia.ru | |
... |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment