Author: I_Post_Ur_Info

florasister.com (Ice-9 banking malware hosted by neoweb.ru)

Uncategorized

Resolved florasister.com to 81.176.232.201 Server:  florasister.com Gate file:  gigling.php (backup hxxp://forandroid.tk/yandex.php (suspended)) Sites checked for configs (no droppers appear to be live): hxxp://www.jcurve.com/templates/beez/params.php hxxp://www.ivemon.es/templates/beez/params.php hxxp://www.justicecameroun.com/templates/beez/params.php hxxp://www.jackwalshcarpets.com/Joomla/templates/beez/params.php hxxp://www.kocaelidho.org.tr/templates/beez/params.php hxxp://www.moraditrade.com/en/templates/beez/params.php hxxp://www.mm-nn.com/main/templates/beez/params.php hxxp://www.jakmurowane.pl/templates/beez/params.php Also attempted to connect to bigdealworked.com on port 9702 Hosting infos: http://whois.domaintools.com/81.176.232.201

h.opennews.su (irc botnet hosted by qhoster.com)

Uncategorized

Resolved h.opennews.su to 5.45.181.254 Server:  h.opennews.su Port:  9000 Channel: #sp Channel password:  yop Topic for #sp is: !wB/smZJsKbDADvo5ab8sIF/r5RP7kkXfEsreBMH+9hiVs3ilngzFHh0Ph9sbgtC/EeqYw5x0Vj2IqRyb/knFS+LUzo6bf3cW/A1SyUXkVxz8ERDPS2K/qHObIS3TFyR2JAiWdnWc82S3KnAwUHQFMEb6h/kQqB9TcZElsKS4BnyDiGp1B19crjVgBes7+ilkHVmFLRRgoSPyUBx71ioiUporVdeOIEUhA547CIbp0odHxRQ41LK9wPz13N8KYZx6/QE//rZhBqCorPJqg3w= Topic for #sp set by SNK at Thu Apr 04 06:16:09 2013 Example bot nick:  n{USA-XPx86u}gjekbowg Alternate domains: f.eastmoon.pl gigasbh.org gigasphere.su o.dailyradio.su photobeat.su s.richlab.pl uranus.kei.su xixbh.com xixbh.net You may recognize some of the domains from previous postsRead more...

xixbh.net (ngrbot irc botnet hosted by oneandone.net)

Uncategorized

Resolved xixbh.net to 212.227.83.111, 213.165.68.138, 85.25.86.198 Server:  xixbh.net (alternate domains: xixbh.com gigasbh.org) Port:  1863 Server password:  jobs Channel:  #jobs Topic for #jobs is: !dl hxxp://hotfile.com/dl/200451226/2ff4c3f/orf4Duu.html Topic for #jobs set by x at Fri Mar 29 13:40:52 2013 SSL is required to connect to this server This is the same guy as these previous posts.