f0010.info (ngr irc botnet hosted by perfectip.net)

Resolved f0010.info to 64.56.64.29, 64.56.64.26

Server:  f0010.info
Port:  1887
Server Password:   leonis
Channel:  #pool
Channel password:  leonis
* Topic for #pool is: ~pu hxxp://www.sendspace.com/pro/dl/ishh04 1f88bb85c51290b759d16dda9fff692d ~s -o ~s
* Topic for #pool set by google at Mon Dec 17 12:16:33 2012
Bots also join the channel for their county, eg #US, and operating system, eg
* Topic for is: ~dw hxxp://www.sendspace.com/pro/dl/5rub3f a3c6fd5dd8b39bbb11046773fa6dd249 ~dw hxxp://www.sendspace.com/pro/dl/p4845c 9058b28e95c9e620ff6fc019e145b55e
* Topic for set by google at Mon Dec 17 12:16:33 2012

This is the same net posted here, f0010.info is just the second dns set in the bot.
Click fraud is still being conducted via 2musicaonline.com

Hosting infos:
http://whois.domaintools.com/64.56.64.26
http://whois.domaintools.com/64.56.64.29

Categories: Uncategorized