(Smoke loader http botnet proxied by cloudflare)

Resolved to, (Cloudflare ips)

Alternate domain: (Currently has non-responsive nameservers)
Gate file:  /admin/index.php

This is the latest skid who uses cloudflare to help host his botnet. Maybe this time they’ll do something about it?

Hosting infos:


CloudFlare received your abuse report dated February 24, 2013 regarding:

CloudFlare is a pass-through network provider and, at most, automatically caches content for a limited period in order to improve network performance. CloudFlare is not a hosting provider and does not provide hosting services for the domain(s) in question or any other website except for Access to the phishing URL(s) in question has been blocked.

Site is hosted by  --

You should direct your request to:

1. The provider where is hosted;
2. The owner listed in the WHOIS record for and/or
3. The contact listed on the site

Note -- a look up of the IPs for a website will show CloudFlare IPs because we're a pass-through network.  The actual website is still hosted at the web hosting provider indicated above. If the web host has any questions please have the web host contact us DIRECTLY regarding this site. We will only provide the web hosting provider with the IP of the web server if they contact us directly.

How am I supposed to report to ecatel if they don’t give me an ip?

Categories: Uncategorized