mirror.servehalflife.com (Barracuda http botnet hosted by Netherlands Haarlem Leaseweb B.v.)

Resolved mirror.servehalflife.com to 95.211.209.178

Server:  mirror.servehalflife.com
Gate file:   /barra/bot.php

You may remember this no-ip from a previous post
Same shit is still in /files/ the only changes being that blackshades now connects on own3d-private.no-ip.org on port 55050, and it uses the no-ip files.serveblog.net to download the other files.

More links found by Xylitol:
hxxp://mirror.servehalflife.com/torrent/

Hosting infos: http://whois.domaintools.com/95.211.209.178

Categories: Uncategorized