MalwareDomainsBlocklists - archived updates

MalwareDomains updated - 2010.05.23...

FYI...

Update: koobface,fastflux,zbot,zeus domains
- http://www.malwaredomains.com/wordpress/?p=976
May 23, 2010 - "Over 250 new domains associated with zbot, zeus,torpig,neosploit, koobface and other maliciousness. Sources include ddanchev.blogspot.com, atlas.arbor.net/summary/fastflux, www.malc0de.com, zeustracker.abuse.ch..."

- http://atlas.arbor.net/summary/fastflux
"... Currently monitoring 226 active fastflux domains..."

- http://www.malwaredomains.com/wordpress/?p=979
May 24, 2010 - "trendsecure.com is incorrectly listed and has been removed. Please remove from your blocklists ASAP."

:fear:
 
Last edited:
Urgent Block: credittreport-dot-info

FYI...

Urgent Block: credittreport-dot-info Clickjacking Attacks
- http://www.malwaredomains.com/wordpress/?p=1003
June 2, 2010 - "There has been an outbreak of clickjacking attacks on Facebook’s “Like” plugin. The target domain associated with the hidden iframe is credittreport. info. Please block that domain ASAP. Source:
- http://isc.sans.org/diary.html?storyid=8893
Last Updated: 2010-06-02 19:08:01 UTC

:mad::fear:
 
Last edited:
Urgent Block: ww-dot-robint-dot-us

FYI...

Urgent Block: ww-dot-robint-dot-us
- http://www.malwaredomains.com/wordpress/?p=1017
June 9, 2010 - "ww(dot)robint(dot)us has been injected into over 111,000 IIS/ASP sites. Please add this to your blocklist ASAP (or refresh your zone file, as last night’s update included that domain) Sources:
- http://blog.sucuri.net/2010/06/mass-infection-of-iisasp-sites-robint-us.html
- http://nsmjunkie.blogspot.com/2010/06/anatomy-of-latest-mass-iisasp-infection.html
- http://isc.sans.edu/diary.html?storyid=8935 "

- http://forums.spybot.info/showpost.php?p=373948&postcount=92

:fear::fear:
 
Last edited:
MalwareDomains updated - 2010.06.15...

FYI...

fastflux, zeus, trojan domains added
- http://www.malwaredomains.com/wordpress/?p=1044
June 15, 2010 - "sources include secuboxlabs.fr, atlas.arbor.net, malwaredomainlist.com, zeustracker.abuse.ch..."

- http://www.abuse.ch/?p=2568
May 17, 2010 - "... Arbor Networks... has added a fingerprint in their Peakflow product family to help Internet Service Providers (ISPs) and companies around the world to mitigate, protect and monitor malicious ZeuS C&C Botnet traffic within their Networks. The fingerprint provided by Arbor is being generated in cooperation with the ZeuS Tracker... If you are a network administrator and your company is runing Arbor Peakflow you just can activate the fingerprint using Arbor’s Active Threat Feed policies (ATF)."

:fear:
 
Last edited:
Urgent block: volgo-marun .cn & sicha-linna8 .com

FYI...

Urgent block: volgo-marun .cn & sicha-linna8 .com
- http://www.malwaredomains.com/wordpress/?p=1065
June 22, 2010 - "From cyberinsecure.com:
The support site of leading Chinese PC manufacturer Lenovo has been compromised by unknown attackers who injected a rogue IFrame into the pages over the weekend. Security researchers warn that unwary visitors looking for drivers are exposed to several exploits that install the Bredolab trojan onto their computers.
The IFrame points to an exploit kit hosted on a domain called volgo-marun. cn. After performing several checks to determine what vulnerable software they had installed on their computer, the visitors were served with exploits targeting older versions of Internet Explorer, Adobe Reader or Adobe Flash player... and receives commands from C&C server with domain sicha-linna8 .com "

:mad:
 
You must log in or register to reply here.
Back
Top