This guy keep changing domainnames but he uses the same shit.
Resolved : [ inmrvogurin.ru ] To [ 163.53.247.144 ]
URL’S :
hxxp://inmrvogurin.ru/SY/test/gate.php
hxxp://inmrvogurin.ru/SY/test/admin.php TF leters in red maybe a tribute to trojanforge.
Sample here : hxxp://inmrvogurin.ru/SY/test/micro.exe
Hosting Infos :
http://whois.domaintools.com/163.53.247.144