[nsp-sec] Fast Fluxing Phish Nameservers

[Jose Nazario]

On Wed, 2 Sep 2009, Tim Wilde wrote:

> alliance-leicester???.com (where the ??? are three digits, a bunch of
> variations)

brute forced it, as of an hour ago these were live and fluxing:

alliance-leicester022.com
alliance-leicester028.com
alliance-leicester056.com
alliance-leicester065.com
alliance-leicester068.com
alliance-leicester072.com
alliance-leicester076.com
alliance-leicester080.com
alliance-leicester091.com
alliance-leicester115.com
alliance-leicester117.com
alliance-leicester120.com
alliance-leicester128.com
alliance-leicester136.com
alliance-leicester143.com
alliance-leicester174.com
alliance-leicester185.com
alliance-leicester189.com
alliance-leicester191.com
alliance-leicester210.com
alliance-leicester223.com
alliance-leicester238.com
alliance-leicester240.com
alliance-leicester259.com
alliance-leicester304.com
alliance-leicester308.com
alliance-leicester312.com
alliance-leicester348.com
alliance-leicester353.com
alliance-leicester366.com
alliance-leicester380.com
alliance-leicester395.com
alliance-leicester423.com
alliance-leicester427.com
alliance-leicester446.com
alliance-leicester457.com
alliance-leicester487.com
alliance-leicester492.com
alliance-leicester508.com
alliance-leicester512.com
alliance-leicester519.com
alliance-leicester520.com
alliance-leicester528.com
alliance-leicester536.com
alliance-leicester547.com
alliance-leicester551.com
alliance-leicester579.com
alliance-leicester588.com
alliance-leicester603.com
alliance-leicester615.com
alliance-leicester620.com
alliance-leicester625.com
alliance-leicester628.com
alliance-leicester641.com
alliance-leicester658.com
alliance-leicester718.com
alliance-leicester727.com
alliance-leicester777.com
alliance-leicester796.com
alliance-leicester808.com
alliance-leicester819.com
alliance-leicester830.com
alliance-leicester850.com
alliance-leicester851.com
alliance-leicester860.com
alliance-leicester872.com
alliance-leicester882.com
alliance-leicester885.com
alliance-leicester886.com
alliance-leicester890.com
alliance-leicester892.com
alliance-leicester907.com
alliance-leicester917.com
alliance-leicester940.com
alliance-leicester945.com
alliance-leicester963.com
alliance-leicester968.com
alliance-leicester974.com
alliance-leicester975.com

-------------------------------------------------------------
jose nazario, ph.d.     	<jose at arbor.net>
manager of security research 	arbor networks
v: (734) 821 1427 	      	http://asert.arbor.net/