Resolved tri57jv3.biz to 94.247.168.151 Server: tri57jv3.biz Gate file: /path/order.php Alternate domains: ykf33ork.biz 5gkd690.bizufrtk67i.biz7gkmir75.biz87fguyh4.biz Hosting infos: http://whois.domaintools.com/94.247.168.151 Related md5s (Download samples from Malwr.com) Betabot: aacce65d6339496a14c86d21d81d37bb
javatube.net (Betabot http botnet hosted by ecatel.net)
Resolved javatube.net to 94.102.51.123 Server: javatube.net Gate file: /singers/song/singles.php Alternate domains: menbbs.netthepremiumsellers.comjuxtaposewhereami.no-ip.biz Hosting infos: http://whois.domaintools.com/94.102.51.123 Related md5s (Download samples from Malwr.com Betabot: 319fe02b18bd75e529bccc317712ad10
redwine.hopewill-imm.com (Betabot http botnet hosted by contabo.com)
Resolved redwine.hopewill-imm.com to 80.241.218.79 Server: redwine.hopewill-imm.com Gate file: /papernews/paperboard.php Alternate domains: artgallery.keramikart.ro jetplane.yangon-airways.com flight.yangon-airways.com abroad.laos-airlines.net plates.ceramic1.com Hosting infos: http://whois.domaintools.com/80.241.218.79 Related md5s (Download sample from Malwr.com) Betabot: 3d250757e1b306b899652ef3c5ef93a7
renterlocal.su (betabot http botnet hosted by fastflux botnet)
Server: renterlocal.su Gate file: /be/order.php Alternate domains: municipales.ru wmkdi.su dfntlk.su captioncodes.ru juliussdietz.ru Hosting infos: ; <<>> DiG 9.6.1-P1 <<>> renterlocal.su ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 8938 ;; flags: qr rd ra; QUERY: 1, ANSWER: 11, AUTHORITY: 4, ADDITIONAL: 12 ;; QUESTION SECTION: ;renterlocal.su. IN A ;;Read more...
24E1tRfQaf31.in (Betabot http botnet hosted by ecatel.net)
Resolved 24e1trfqaf31.in to 94.102.49.76 Server: 24e1trfqaf31.in Gate file: /Kuod_9381a/order.php Alternate domains: 24ttgaezrtawae.in 13893ygh1uvbad.inibfuo2t1g1qdewr3.in (Currently suspended) The WHOIS info for this domain is pretty interesting. Looks like someone copied the WHOIS info of a major hackforums scammer. Hosting infos: http://whois.domaintools.com/94.102.49.76 Related md5s (Download samples from Malwr.com) Betabot: b47a148b57ce6a7e6e57b039315c77d4
sloodam.in (Betabot http botnet proxied by cloudflare.com)
Server: sloodam.in Gate file: /lolserver/james/order.php Yet another scriptkiddie seems to think that cloudflare is the best place to host his botnet. Lets see how fast they shut this down. Related md5s (Search on Malwr.com to download samples) Betabot: faf473886ef8775d6514ab898a550b3e
llltd.ru (Betabot http botnet hosted by plusserver.de)
Resolved llltd.ru to 188.138.92.62 Server: llltd.ru Gate file: /order.php Alternate domain: lllink.ru Hosting infos: http://whois.domaintools.com/188.138.92.62 Related md5s (Search on Malwr.com to download samples) Betabot: d1945e16d2430c44c53e907b9a7f94a4
cf-fgdgwdvbs.com (Betabot http botnet hosted by server4.pro)
Resolved cf-fgdgwdvbs.com to 37.221.161.200 Server: cf-fgdgwdvbs.com Gate file: /content/design/in/images/ads/banner/order.php Alternate domains: (Currently registered) h1gh.to (Currently unregistered) vbt-one.bizchf-dfgsdfgplace.netded-rrwqwzjzjris.comseb-api.netswrgfderthgikhoplk.info greahthrhdse.infosab-rehrgfgdfg.org Hosting infos: http://whois.domaintools.com/37.221.161.200 Related md5s (Search on Malwr.com to download samples) Betabot: 4ecb1746a7a5b54d83f4b34cc23eb9fd
haveityourway.pw (betabot http botnet hosted by Alibabahost.com)
Resolved haveityourway.pw to 103.31.187.77 Server: haveityourway.pw Gate file: /members/order.php Alternate domains (currently not registered): thebestway42.pwitsoktohaveityourway.comlosmejoresburgers1.com The first domain was only registered yesterday. Hosting infos: http://whois.domaintools.com/103.31.187.77 Related md5s (Search on Malwr.com to download samples) Betabot: 3b0907c7bf881f8f5f9fa2190384d3dd
n18b7273u1j.in (Betabot http botnet hosted by worldstream.nl)
Resolved n18b7273u1j.in to 217.23.3.102 Server: n18b7273u1j.in Gate file: /M_jsh1/order.php Alternate domains: b19jdn167t.in This is betabot version 1.5. This is the second betabot 1.5 botnet I have found, but the other one was just a different path on an already posted botnet, so it wasn’t worth a new post. You may note that the domains usedRead more...