Tech Talk

[Black Hole Exploit kit, Rogues, Trojans]

FYI...

Black Hole Exploit kit, Rogues, Trojans ...
- http://www.malwaredomains.com/wordpress/?p=2351
January 6th, 2012 - "Added domains from malwaredomainlist.com, emergingthreats.net, blog.dynamoo.com and other sources..."

 

[fakehdd, malicious javascript, malspam, TDL/TDSSC&C]

FYI...

fakehdd, malicious javascript, malspam, TDL/TDSSC&C
- http://www.malwaredomains.com/wordpress/?p=2357
January 8th, 2012 - "added about a hundred domains associated with TDL/TDSSC&C, rogue, fake HDD and other maliciousness. Sources include xylibox.blogspot.com, threatexpert.com, sucuri.net and others..."

 

[BPHoster, Zeus, Palevo, Trojan Domains]

FYI...

BPHoster, Zeus, Palevo, Trojan Domains
- http://www.malwaredomains.com/wordpress/?p=2367
January 11th, 2012 - "A small update but one containing BPHoster, Palevo, Zeus, Trojan, BH Exploit kit domains. Sources include amada.abuse.ch, securecast.co.kr, zeustracker.abuse.ch..."

 

[92 Domains]

FYI...

92 Domains
- http://www.malwaredomains.com/wordpress/?p=2370
January 13th, 2012 - "Added 92 domains associated with Alureon Trojan, rogue/fake AV, fastflux botnet, etc. Sources include zeustracker.abuse.ch, spamhaus.org, emergingthreats.net, amada.abuse.ch/blocklist.php?download=proactivelistings ..."

 

[HUGE Update: Ramnit and Redret malspam domains]

FYI...

HUGE Update: Ramnit and Redret malspam domains
- http://www.malwaredomains.com/wordpress/?p=2375
January 14th, 2012 - "Ramnit is Zeus-like malware with rootkit capabilities. Seculert* has a nice write-up about a financial variant which is steals Facebook credentials. According to Contiago**, samples have are being spread via Blackhole exploit kit. We’ve added over 200 Ramnit domains (thanks Kevin). As a bonus, 29 more “Redret” malspam domains from dynamoo*** have also been added to our malware blacklist. Please update your blocklists/sinkhole..."
* http://blog.seculert.com/2012/01/ramnit-goes-social.html

** http://contagiodump.blogspot.com/2012/01/blackhole-ramnit-samples-and-analysis.html

*** http://blog.dynamoo.com/2012/01/your-order-for-helicopter-for-weekend.html

   

[Black Hole Exploit Kit Domains, BPHoster*, sykipot**]

FYI...

Black Hole Exploit Kit Domains, BPHoster*, sykipot**
- http://www.malwaredomains.com/wordpress/?p=2383
January 17th, 2012 - "Added 111 domains associated with BPHoster, Sykipot, malvertising, BH Exploit Kit, and others. Sources include symantec.com, malwaredomainlist.com, isc.sans.org, amada.abuse.ch..."

* https://secure.wikimedia.org/wikipedia/en/wiki/Bulletproof_hosting

Sykipot steals Smart-Card credentials
** http://www.darkreading.com/taxonomy/index/printarticle/id/232400288

 

[220+ Ramnit, Rogue, Zbot Domains]

FYI...

Another Huge Update: 220+ Ramnit, Rogue, Zbot Domains
- http://www.malwaredomains.com/wordpress/?p=2387
January 19th, 2012 - "Added over 220 domains associated with zbot-bgz, rogue, ramnit and other badness. Sources include contagiodump.blogspot.com, sophos.com..."

 

[rbackdoor-pihar, bphoster, htaccessredirect domains]

FYI...

rbackdoor-pihar, bphoster, htaccessredirect domains
- http://www.malwaredomains.com/wordpress/?p=2401
January 22nd, 2012 - "Added 110 domains... associated with bphoster, zeus, drivebys, pihar and other badness. Sources include amada.abuse.ch, google safebrowsing, spamhaus.org..."

 

[BPhoster, Zeus, Fast Flux]

FYI...

BPhoster, Zeus, Fast Flux...
- http://www.malwaredomains.com/wordpress/?p=2416
January 25th, 2012 - "Added 101 domains associated with BPHoster, Zeus, Fast Flux, Hiloti, iceIX. Sources include amada.abuse.ch, exposure.iseclab.org, emergingthreats.net..."

 

[Trojan.Pidief, redret, phishing domains]

FYI...

Trojan.Pidief, redret, phishing domains
- http://www.malwaredomains.com/wordpress/?p=2420
January 27th, 2012 - "Over 150 malicious domains associated AS47583, Pidief, redret, phishing, etc added. Sources include blog.dynamoo.com, support.clean-mx.de, xylibox.blogspot.com..."

- http://www.google.com/safebrowsing/diagnostic?site=AS:47583

 

[1617 domains removed, 33 domains added]

FYI...

1617 domains removed, 33 domains added ...
- http://www.malwaredomains.com/wordpress/?p=2430
January 30th, 2012 - "1617 Domains have been removed; 33 domains have been added to the “immortal” domain lists. Please update your blocklists (... no reason to do it every hour like some people who will be blocked for continuous abuse)..."

 

[fastflux, malicious javascript, and spyeye]

FYI...

fastflux, malicious javascript, and spyeye...
- http://www.malwaredomains.com/wordpress/?p=2438
February 1st, 2012 - "Added 129 domains associated with malicious javascript, spyeye, pdf exploits, etc. Sources: www3.malekal.com/pdf.txt, exposure.iseclab.org, sucuri.net and others..."

 

[Incognito, malspam, purplehaze domains]

FYI...

Incognito, malspam, purplehaze domains
- http://www.malwaredomains.com/wordpress/?p=2444
February 3rd, 2012 - "Added 138 malicious domains associated with purple haze, Incognito, malspam, zeus, msupdater, etc. Sources include exposure.iseclab.org, zeustracker.abuse.ch, blog.dynamoo.com..."

 

[bhexploit, htaccess redirects, Incognito, PDF exploits]

FYI...

bhexploit, htaccess redirects, Incognito, PDF exploits
- http://www.malwaredomains.com/wordpress/?p=2451
February 6th, 2012 - "Added 119 domains listed on xylibox.blogspot.com, malekal.com, exposure.iseclab.org and others..."

 

[BH-DNS Update: 200+ Domains Added]

FYI...

BH-DNS Update: 200+ Domains Added
- http://www.malwaredomains.com/wordpress/?p=2455
February 8th, 2012 - "Added over 200 domains associated with Palevo, Fake AV,BPhoster, htaccess redirects, etc. Sources include zeustracker, xylibox, abuse.ch..."