seosaw.pw (betabot http botnet hosted by plusserver.de)

Resolved seosaw.pw to 188.138.125.103 Server:  seosaw.pw Gate file:  /wq782jwoqkQy19qkdh27hqudqj/order.php Alternate domains: microsoftgo.pw updateom.info seosaw.info googlerw.info Downloads what looks like Sefnit from hxxp://now.googlefast.pw/remote/index.php?u=48&istan Hosting info: http://whois.domaintools.com/188.138.125.103 Related md5s (Download sample from Malwr.com Betabot: daee8c5056fbbf1964588e70cb371fae Sefnit: b99ed8704716ab6ff273e3dc66fe3cfb

trik.su (Snk aspermod irc botnet hosted by midphase.com)

Resolved trik.su to 174.127.123.4 Server:  trik.su Port:  5050 Channel:  #trk #trk :.j #upd .u trk2 /120/126/99/107/25/61/37/112/72/120/110/67/113/123/122/115/35/64/118/114/35/123/85/74/78/111/125/83/8/55/46/39/32/63/42/55/63/35/44/11/42/38/32/37/120/110/121/ Channel:  #upd #upd :.u trk2 /120/126/99/107/25/61/37/103/86/99/120/83/100/118/123/98/98/13/108/108/35/123/85/74/15/107/97/69/ Hosting info: http://whois.domaintools.com/174.127.123.4 Related md5s (Download samples from Malwr.com) Aspermod: 1f876d3830527f22f84205069695d3d2

vvvhhhccc.com (Betabot http botnet hosted by dacentec.com)

Resolved vvvhhhccc.com to 192.111.153.98 Server:  vvvhhhccc.com Gate file:  /8/8/8/be/order.php Alternate domains: virusprotect.su virus-protector.net latinodancewears.com.vn He has a plasma http botnet on the same domain that he is using to mine dogecoins. Gate file:  /8/8/plasma/login.php Hosting info: http://whois.domaintools.com/192.111.153.98 Related md5s (Download samples from Malwr.com) Betabot: a58ddb7a7a3b823ff0ddd541f136d9f4 Plasma: 401459ef275cf0639a855a4dff234bf5 Mining info: Stratum+tcp://pool.dogechain.info:3333 -u latinodresses.plasmahttp -p x

199.187.121.82 (pBots hosted by databasebydesignllc.com)

Server:  199.187.121.82 Port:  7802 * There are 1 users and 3702 invisible on 1 servers * 127 :unknown connection(s) * 2 :channels formed * I have 3703 clients and 0 servers * Current Local Users: 3703 Max: 3785 * Current Global Users: 3703 Max: 3785 Channel:  #bom# Channel Users Topic #sick# 341 [+smntMu] #bom# 3385