myinstalls.info (Andromeda and kbot http botnets hiding behind cloudflare)

Resolved myinstalls.info to 199.27.134.49, 173.245.60.132

Andromeda
Server:  myinstalls.info
Gate file:  /neuro/image.php

kbot
Server:  myinstalls.info
Gate file:  /kb/gate.php

I’m glad to see Khant has recovered from having some malicious individual run rm -rf / as root on his server.
However I’m not sure if having bots connect through cloudflare is such a good idea.

Categories: Uncategorized