aeonhf.net (Smoke loader http botnet proxied by cloudflare)

Resolved aeonhf.net to  173.245.60.168, 173.245.61.168 (Cloudflare ips)

Server:  aeonhf.net,
Alternate domain:  aminserve.info (Currently has non-responsive nameservers)
Gate file:  /admin/index.php

This is the latest skid who uses cloudflare to help host his botnet. Maybe this time they’ll do something about it?

Hosting infos: ecatel.info

Edit:

CloudFlare received your abuse report dated February 24, 2013 regarding:
aeonhf.net

CloudFlare is a pass-through network provider and, at most, automatically caches content for a limited period in order to improve network performance. CloudFlare is not a hosting provider and does not provide hosting services for the domain(s) in question or any other website except for cloudflare.com. Access to the phishing URL(s) in question has been blocked.

Site is hosted by  ecatel.info  -- abuse@ecatel.info

You should direct your request to:

1. The provider where aeonhf.net is hosted;
2. The owner listed in the WHOIS record for aeonhf.net and/or
3. The contact listed on the aeonhf.net site

Note -- a look up of the IPs for a website will show CloudFlare IPs because we're a pass-through network.  The actual website is still hosted at the web hosting provider indicated above. If the web host has any questions please have the web host contact us DIRECTLY regarding this site. We will only provide the web hosting provider with the IP of the web server if they contact us directly.

How am I supposed to report to ecatel if they don’t give me an ip?

Categories: Uncategorized