mirror.servehalflife.com (Barracuda http botnet hosted by Netherlands Haarlem Leaseweb B.v.)

Resolved mirror.servehalflife.com to

Server:  mirror.servehalflife.com
Gate file:   /barra/bot.php

You may remember this no-ip from a previous post
Same shit is still in /files/ the only changes being that blackshades now connects on own3d-private.no-ip.org on port 55050, and it uses the no-ip files.serveblog.net to download the other files.

More links found by Xylitol:

Hosting infos: http://whois.domaintools.com/

Categories: Uncategorized