[nsp-sec] Mebroot/Torpig (AS 25653, 15083, 32475)
Tom Fischer
tfischer at bfk.de
Tue Jun 23 05:33:59 EDT 2009
Hi,
anyone able to null route the following Mebroot/Torpig domains/hosts?
Mebroot c&c:
------------
2009-06-14 18:13:00 2009-06-20 17:34:21 txktutwh.biz A 208.116.54.26
2009-06-21 11:25:59 2009-06-22 16:40:53 kcfdwwdc.biz A 208.116.54.26
2009-06-23 dtgjfkxi.biz A 208.116.54.26
2009-06-07 08:41:57 2009-06-10 23:54:51 gktduivh.biz A 208.116.54.26
AS | IP | AS Name
25653 | 208.116.54.26 | FORTRESSITX - FortressITX
PEER_AS | IP | AS Name
1239 | 208.116.54.26 | SPRINTLINK - Sprint
1299 | 208.116.54.26 | TELIANET TeliaNet Global Network
3356 | 208.116.54.26 | LEVEL3 Level 3 Communications
3561 | 208.116.54.26 | SAVVIS - Savvis
4436 | 208.116.54.26 | AS-NLAYER - nLayer Communications, Inc.
Domain Name: DTGJFKXI.BIZ
Domain ID: D32480825-BIZ
Sponsoring Registrar: ONLINENIC, INC. D/B/A CHINA-CHANNEL.COM
Sponsoring Registrar IANA ID: 82
Domain Status: clientTransferProhibited
Registrant ID: OLNI_185176_0_1
Registrant Name: Ron Falk
Registrant Organization: NA
Registrant Address1: 4th Ave N 11
Registrant City: Seatle
Registrant State/Province: Washington
Registrant Postal Code: 48952
Registrant Country: United States
Registrant Country Code: US
Registrant Phone Number: +1.69452375212
Registrant Facsimile Number: +1.69452375212
Registrant Email: falk_ron_2006 at msn.com
Domain Name: KCFDWWDC.BIZ
Domain ID: D32480820-BIZ
Sponsoring Registrar: ONLINENIC, INC. D/B/A CHINA-CHANNEL.COM
Sponsoring Registrar IANA ID: 82
Domain Status: clientTransferProhibited
Registrant ID: OLNI_185176_0_0
Registrant Name: Ron Falk
Registrant Organization: NA
Registrant Address1: 4th Ave N 11
Registrant City: Seatle
Registrant State/Province: Washington
Registrant Postal Code: 48952
Registrant Country: United States
Registrant Country Code: US
Registrant Phone Number: +1.69452375212
Registrant Facsimile Number: +1.69452375212
Registrant Email: falk_ron_2006 at msn.com
Domain Name: TXKTUTWH.BIZ
Domain ID: D32381483-BIZ
Sponsoring Registrar: ONLINENIC, INC. D/B/A CHINA-CHANNEL.COM
Sponsoring Registrar IANA ID: 82
Domain Status: clientTransferProhibited
Registrant ID: OLNI_184942_0_1
Registrant Name: KIra Nilson
Registrant Organization: NA
Registrant Address1: Queen st. 23/4
Registrant City: Melbourne
Registrant State/Province: Melbourne
Registrant Postal Code: 27953
Registrant Country: Australia
Registrant Country Code: AU
Registrant Phone Number: +4.3691593654
Registrant Facsimile Number: +4.3691593654
Registrant Email: Nilson_design at yahoo.com
Domain Name: GKTDUIVH.BIZ
Domain ID: D32252549-BIZ
Sponsoring Registrar: ONLINENIC, INC. D/B/A CHINA-CHANNEL.COM
Sponsoring Registrar IANA ID: 82
Domain Status: clientTransferProhibited
Registrant ID: OLNI_184681_0_0
Registrant Name: Tim Borton
Registrant Organization: NA
Registrant Address1: E Broad St 45
Registrant City: Richmond
Registrant State/Province: Virginia
Registrant Postal Code: 23457
Registrant Country: United States
Registrant Country Code: US
Registrant Phone Number: +1.54796312569
Torpig c&c:
-----------
yhesdnuj.biz. 60 IN A 190.120.227.112
yhesdnuj.net. 7 IN A 190.120.227.112
ngehrnuj.net. 60 IN A 190.120.227.112
AS | IP | AS Name
15083 | 190.120.227.112 | INFOLINK-MIA-US - Infolink Information Services Inc.
PEER_AS | IP | AS Name
3549 | 190.120.227.112 | GBLX Global Crossing Ltd.
Domain Name: NGEHRNUJ.NET
Registrar: ONLINENIC, INC.
Whois Server: whois.onlinenic.com
Referral URL: http://www.OnlineNIC.com
Name Server: NS1.DNS-DIY.NET
Name Server: NS2.DNS-DIY.NET
Status: clientTransferProhibited
Updated Date: 19-jun-2009
Creation Date: 19-jun-2009
Expiration Date: 19-jun-2010
Registrant:
Martin Scorceza marscor at msn.com +1.36752685241
na
Via. Re Um 25
Brasilia,Brasilia,BR 85953
Domain Name: YHESDNUJ.BIZ
Domain ID: D32381488-BIZ
Sponsoring Registrar: ONLINENIC, INC. D/B/A CHINA-CHANNEL.COM
Sponsoring Registrar IANA ID: 82
Domain Status: clientTransferProhibited
Registrant ID: OLNI_184942_0_2
Registrant Name: KIra Nilson
Registrant Organization: NA
Registrant Address1: Queen st. 23/4
Registrant City: Melbourne
Registrant State/Province: Melbourne
Registrant Postal Code: 27953
Registrant Country: Australia
Registrant Country Code: AU
Registrant Phone Number: +4.3691593654
Registrant Facsimile Number: +4.3691593654
Registrant Email: Nilson_design at yahoo.com
Domain Name: YHESDNUJ.NET
Registrar: ONLINENIC, INC.
Whois Server: whois.onlinenic.com
Referral URL: http://www.OnlineNIC.com
Name Server: NS1.DNS-DIY.NET
Name Server: NS2.DNS-DIY.NET
Status: clientTransferProhibited
Updated Date: 13-jun-2009
Creation Date: 13-jun-2009
Expiration Date: 13-jun-2010
Registrant:
Net Denew nettydenew at yahoo.com +5.69715465452
MA
Lange Str/ 12/2
Frankfurt,Frankfurt,DE 23564
twitter based iframe domains:
-----------------------------
2009-06-19 09:14:27 2009-06-19 09:14:27 bctdohpxes.com A 69.175.10.74
2009-06-15 11:47:22 2009-06-22 06:49:39 efhgdupxes.com A 69.175.10.74
2009-06-22 11:57:16 2009-06-22 12:47:52 ghtdrhgxes.com A 69.175.10.74
2009-06-06 11:41:24 2009-06-22 17:37:13 ijlfhysxes.com A 69.175.10.74
2009-06-15 11:51:24 2009-06-22 23:00:32 fgxcilgxes.com A 69.175.10.74
2009-06-04 18:32:49 2009-06-23 01:54:33 fgnribaxes.com A 69.175.10.74
2009-06-17 07:48:11 2009-06-23 02:05:01 degaxtdxes.com A 69.175.10.74
2009-06-04 22:12:09 2009-06-23 03:19:56 jahgrumxes.com A 69.175.10.74
2009-06-22 11:40:27 2009-06-23 03:37:18 efhghuvxes.com A 69.175.10.74
2009-06-15 09:07:55 2009-06-23 05:05:18 jarqrfsxes.com A 69.175.10.74
2009-06-09 11:33:14 2009-06-23 06:08:14 abimovdxes.com A 69.175.10.74
AS | IP | AS Name
32475 | 69.175.10.74 | SINGLEHOP-INC - SingleHop
PEER_AS | IP | AS Name
4436 | 69.175.10.74 | AS-NLAYER - nLayer Communications, Inc.
23352 | 69.175.10.74 | SERVERCENTRAL - Server Central Network
Domain Name: IJQKGESXES.COM
Registrar: ONLINENIC, INC.
Whois Server: whois.onlinenic.com
Referral URL: http://www.OnlineNIC.com
Name Server: NS1.DNS-DIY.NET
Name Server: NS2.DNS-DIY.NET
Status: clientTransferProhibited
Updated Date: 22-jun-2009
Creation Date: 22-jun-2009
Expiration Date: 22-jun-2010
Registrant:
Mike Stanton greatestmike at gmail.com +1.54796316561
NA
E Broad St 10
Richmond,Virginia,UNITED STATES 23456
Domain Name: GHTDRHGXES.COM
Registrar: ONLINENIC, INC.
Whois Server: whois.onlinenic.com
Referral URL: http://www.OnlineNIC.com
Name Server: NS1.DNS-DIY.NET
Name Server: NS2.DNS-DIY.NET
Status: clientTransferProhibited
Updated Date: 20-jun-2009
Creation Date: 20-jun-2009
Expiration Date: 20-jun-2010
Registrant:
Martin Lotorez Lotorez_martin_angel at msn.com +1.65492136711
NA
Grand ave 3/1
Phoenix,Arizona,US 49853
--
Tom Fischer
BFK edv-consulting GmbH tel: +49 721 962 01-1
Kriegsstr. 100, D-76133 Karlsruhe fax: +49 721 962 01-99
More information about the nsp-security
mailing list