Sample Apophis C&C domains circa 2010 based on my research include:
hxxp://mystabcounter.info
hxxp://555traff.biz
hxxp://555traff.org
hxxp://555traff.net
hxxp://911traff.com
hxxp://911traff.org
hxxp://911traff.com
hxxp://555traff.ws
hxxp://nod32-spl.net
hxxp://kusik-tusik-trf.com
hxxp://spamh0use.com
hxxp://norton-av2007.com
Sample domain registrant email address account known to have been used in the campaign:
slhdns@gmail.com
Related malicious and fraudulent domains known to have been involved in the campaign include:
hxxp://free-adult-movies.us
hxxp://ellweb.biz
hxxp://flightlesson.us
hxxp://e-on.us
hxxp://masteryourselfandothers.biz
hxxp://sexychannal.biz
hxxp://fkooo.biz
hxxp://le-showroom.biz
hxxp://elwebbz.biz
hxxp://sensorama.us
hxxp://healingmassage.us
hxxp://lisa19.biz
hxxp://free-games-downloads.biz
hxxp://emaszyny.biz
hxxp://free-bizzz.biz
hxxp://ellwebs.biz
hxxp://fsone.us
hxxp://banddindependence.biz
hxxp://freestylecamera.biz
hxxp://wtter.biz
hxxp://little-lolitas.biz
hxxp://a-1express.us
hxxp://sex-total.biz
hxxp://misterfixit.us
hxxp://pantie-fetish.biz
hxxp://wantedbabes.biz
hxxp://papmperedchef.biz
hxxp://webmailccisd.us
hxxp://funi-games.biz
hxxp://karatzikos.biz
hxxp://fuckphotos.biz
hxxp://best-oem-sellers.biz
hxxp://powerstocks.biz
hxxp://connect-group.biz
hxxp://pptsys.biz
hxxp://lambrakis.biz
hxxp://hsmvstatefl.us
hxxp://computerselectronics.us
hxxp://premierprop.biz
hxxp://coloriez.biz
hxxp://crazy-holiday.biz
hxxp://images-porno.biz
hxxp://talentsmodels.biz
hxxp://sukebe.biz
hxxp://taydo.biz
hxxp://texas--holdem.biz
hxxp://mr-rx.biz
hxxp://cptraders.biz
hxxp://financialcareer.biz
hxxp://smallgirls.biz
hxxp://plastercrafts.biz
hxxp://lchs.us
hxxp://poopka.biz
hxxp://solarnet.biz
hxxp://hormonetreatment.us
hxxp://spammed.us
hxxp://photos-pucelles.biz
hxxp://signaturehomesstyles.biz
hxxp://marbleworks.biz
hxxp://simplyuniforms.biz
hxxp://pinballsites.biz
hxxp://cuyahogacouny.us
hxxp://pinkpoodlepets.biz
hxxp://cuyahagacounty.us
hxxp://rachaels.biz
hxxp://kentonkyschools.us
hxxp://iginteinc.biz
hxxp://caimon.us
hxxp://lonestarjewelry.biz
hxxp://vietghost.us
hxxp://igniteing.biz
hxxp://buytickets1.us
hxxp://agame.biz
hxxp://uighurlar.biz
hxxp://joshosler.biz
hxxp://variance.us
hxxp://qudos.biz
hxxp://ketsamil.us
hxxp://quebecauction.biz
hxxp://verumcom.biz
hxxp://privatpornoz.biz
hxxp://trasy.biz
hxxp://fightnight.us
hxxp://trueterm.biz
hxxp://arablusic.us
hxxp://cdcover.us
hxxp://httpimageshack.us
hxxp://iprosper.us
hxxp://prepaid2u.biz
hxxp://kylakeproperty.us
hxxp://printsmart.us
hxxp://inmarcet.biz
hxxp://privatevoicemail.us
hxxp://koicarp.us
hxxp://11burogu.biz
hxxp://traivan.us
hxxp://eroxia.us
hxxp://assmat.biz
hxxp://sauvageonne.biz
hxxp://articlexchange.biz
hxxp://scottsphotography.biz
hxxp://project-management-tools.biz
hxxp://mini-games.biz
hxxp://aqarium-fish.biz
hxxp://imageashack.us
hxxp://beanb.biz
hxxp://rmpnfotec.biz
hxxp://azadari.biz
hxxp://europauto.biz
hxxp://autosourse.biz
hxxp://rowanlaw.us
hxxp://autocadsites.biz
hxxp://renewpcstore.biz
hxxp://whatswhat.us
hxxp://f0reverhealthy.biz
hxxp://boa-constrictor.biz
hxxp://f-chan.us
hxxp://bestemateur.biz
hxxp://everysearch.us
hxxp://wnetwork.biz
hxxp://fanmial.biz
hxxp://brutalfemdom.biz
hxxp://realitywise.biz
hxxp://breadmaker.biz
hxxp://realy-models.biz
hxxp://webform.us
hxxp://lolabbs.biz
hxxp://weknow.us
hxxp://jlove.us
hxxp://zowmebel.biz
hxxp://1001night.biz
hxxp://zodiacpowerring.biz
hxxp://wwwsignaturehomestyles.biz
hxxp://a-deco.biz
hxxp://analized.us
hxxp://ishikari.biz
hxxp://xteenx.biz
hxxp://ffivideo.biz
hxxp://allthingscatholic.us
hxxp://puffgames.biz
hxxp://actiongames.us
hxxp://ffunny-games.biz
hxxp://coasthomes.biz
hxxp://clearhabor.biz
hxxp://at-crew.biz
hxxp://animal-info.biz
hxxp://anoria.biz
hxxp://cl55.biz
hxxp://amitenergy.biz
hxxp://bestcounter.biz
hxxp://bionexus.biz
hxxp://4only.biz
hxxp://bellgard.biz
hxxp://bairo.biz
hxxp://banjosites.biz
hxxp://clthumane.biz
hxxp://autorepairmanuels.biz
hxxp://city-info.biz
hxxp://anywhere-wireless.biz
hxxp://casadellabomboniera.biz
hxxp://centerforrenewal.biz
hxxp://cuteloblog.biz
hxxp://buckneranimalclinic.biz
hxxp://bona-stto.biz
hxxp://1sp.biz
hxxp://easycalender.biz
hxxp://etudiantes-vicieuses.biz
hxxp://fannygames.biz
hxxp://bizibypass.biz
hxxp://ddl-warez.biz
hxxp://fainmail.biz
hxxp://farmersandmerchantsbank.biz
hxxp://atomakayan.biz
hxxp://youxxx.us
hxxp://wmata.us
hxxp://mailarlingtonva.us
hxxp://sexyblackpussy.biz
hxxp://funnygamse.biz
hxxp://funnygaes.biz
hxxp://freetgp.biz
hxxp://www4usonly.biz
hxxp://hena.biz
hxxp://gentrees.biz
hxxp://ignitein.biz
hxxp://hentai-movie.biz
hxxp://igniteic.biz
hxxp://headcutterssalon.biz
hxxp://fuunny-games.biz
hxxp://igniteenergy.biz
hxxp://hrna.biz
hxxp://free-voyeur-cam.biz
hxxp://goldenretire.biz
hxxp://inkkraft.biz
hxxp://heproject.biz
hxxp://funny-gemes.biz
hxxp://ice-out.biz
hxxp://adogslife.biz
hxxp://alterego3d.biz
hxxp://americanriverbikes.biz
hxxp://ecstazy.biz
hxxp://harna.biz
hxxp://africantradebeads.biz
hxxp://funy-game.biz
hxxp://free-gay-movies.biz
hxxp://inginteinc.biz
hxxp://wwwsexbabes.biz
hxxp://wwwmoscarossa.biz
hxxp://wwwsearch.biz
hxxp://funygame.biz
hxxp://fuuny-game.biz
hxxp://e-dict.biz
hxxp://interskay.biz
hxxp://bbw-fat-woman.biz
hxxp://sexbabs.biz
hxxp://youniquedesigns.biz
hxxp://visiongloval.biz
hxxp://seekme.biz
hxxp://pamperedcheff.biz
hxxp://streetdrugs.biz
hxxp://northportrealtor.biz
hxxp://young-peaches.biz
hxxp://boysvids.us
hxxp://coolchasers.us
hxxp://avse.us
hxxp://clearsil.us
hxxp://celebmovie.us
hxxp://myffl.biz
hxxp://sexbabez.biz
hxxp://sexbabies.biz
hxxp://free-search.biz
hxxp://free-voyeur-web.biz
hxxp://sukuname.biz
hxxp://mattun.biz
hxxp://wmclick.biz
hxxp://jun1.biz
hxxp://try-this-search.biz
hxxp://best-search.us
hxxp://topkds.biz
hxxp://traffmoney.biz
hxxp://no-nudes.biz
hxxp://ownmyhome.us
hxxp://teenboyboy.biz
hxxp://may5.biz
hxxp://kisslola.biz
hxxp://mature-sex-pic.biz
hxxp://logocorean.biz
hxxp://medsbymail.biz
hxxp://melissacam.biz
hxxp://mcommuniti.biz
hxxp://katreen.biz
hxxp://nextdoorteens.us
hxxp://viasatelital.us
hxxp://onestoplettingshop.biz
hxxp://hotmapouka.biz
hxxp://agsoftware.biz
hxxp://bun1.biz
hxxp://bsabikesites.biz
hxxp://fragments.biz
hxxp://lovely-nymphets.biz
hxxp://proliferator.biz
hxxp://puertolaboca.us
hxxp://blackandpussy.biz
hxxp://ford-dealers.biz
hxxp://hlplmanhds.biz
hxxp://baosteel.biz
hxxp://begard.biz
hxxp://erotik-geschichten.biz
hxxp://djahmet.biz
hxxp://fonny-games.biz
hxxp://togetherwestand.us
hxxp://fantasy4u.us
hxxp://tympani.us
hxxp://victoryautosales.us
hxxp://veld.us
hxxp://hartlandschool.us
hxxp://whisperedsecrets.us
hxxp://receptor.us
hxxp://sese.us
hxxp://industrialwoodproducts.us
hxxp://cutyourexpenses.us
hxxp://first-school.us
hxxp://cutexpenses.us
hxxp://future4.us
hxxp://tvdirectory.us
hxxp://fashioncamp.us
hxxp://madebyyou.us
hxxp://justleather.us
hxxp://iamhot.us
hxxp://datedetective.us
hxxp://phonetranslators.us
hxxp://eurosport.us
hxxp://lloll.us
hxxp://embelsira.us
hxxp://mainsqueezelove.biz
hxxp://privatporn.biz
hxxp://porn-photo.biz
hxxp://radim.us
hxxp://porn-fotos.biz
hxxp://niceleads.biz
hxxp://spaceresort.us
hxxp://filmscore.us
hxxp://hatachi.us
hxxp://lanciasites.biz
hxxp://needcracks.us
hxxp://muddle.us
hxxp://negaheno.biz
hxxp://truyennguoilon.us
hxxp://net-gams.biz
hxxp://videospornoblog.biz
hxxp://chezbaycakes.biz
hxxp://vb3.biz
hxxp://n0-ip.biz
hxxp://nailwarehouse.biz
hxxp://mynameislolita.biz
hxxp://mountainlakeresort.us
hxxp://hardcore-family-incest.biz
hxxp://hi-web.biz
hxxp://passace.com
hxxp://smartergirl.com
hxxp://howtofixyourharley.com
hxxp://sirevil.us
hxxp://mychices.biz
hxxp://sfondipc.biz
hxxp://wealth-4-u.biz
hxxp://avenge.biz
hxxp://arlingonva.us
hxxp://americawide.us
hxxp://11xp.us
hxxp://arlintonva.us
hxxp://animefans.us
hxxp://genescan.us
hxxp://hallmarkkeepsake.com
hxxp://sundaramusic.com
hxxp://gros-culs.biz
hxxp://moneyconnection.biz
hxxp://graephillips.biz
hxxp://wwwbiehealth.us
hxxp://hollywoodmadam.us
hxxp://enblock.biz
hxxp://oynuyoruz.biz
hxxp://sexbabys.biz
hxxp://nop-ip.biz
hxxp://klinische-forschung.biz
hxxp://grupxtrem.biz
hxxp://vestalgirls.biz
hxxp://nudeliving.us
hxxp://buellsites.biz
hxxp://mcclaincountyassessor.us
hxxp://went2.us
hxxp://mcpsk12md.us
hxxp://muenzversand.biz
hxxp://nighteen.biz
hxxp://customelectronics.us
hxxp://hocsinhvn.biz
hxxp://city-realtor.biz
hxxp://no-p.biz
hxxp://transsahara.biz
hxxp://net-ganes.biz
hxxp://bevardclerk.us
hxxp://netgamez.biz
hxxp://healthfoodsstore.us
hxxp://hiphopcharts.us
hxxp://ebookgenerator.biz
hxxp://ni-ip.biz
hxxp://dataspot.biz
hxxp://moregirls.biz
hxxp://uscharts.us
hxxp://pampredchef.biz
hxxp://carefreehomesep.us
hxxp://fuun-games.biz
hxxp://kellyeducationalservices.us
hxxp://hollywoodsbest.us
hxxp://vintage-furniture.us
hxxp://pamperedche.biz
hxxp://cinacast.us
hxxp://gethitsfrom.us
hxxp://celebrityfuckfest.biz
hxxp://gentle-boys.biz
hxxp://trique-porno.biz
hxxp://pamperedchf.biz
hxxp://carwithheart.biz
hxxp://pamparedchef.biz
hxxp://soccersites.biz
hxxp://pamperchief.biz
hxxp://cutmyexpenses.us
hxxp://girlsseekingboys.com
hxxp://curiosity-shop.biz
hxxp://pamperedcef.biz
hxxp://thebookpeddler.us
hxxp://ozgurboard.us
hxxp://deshimasala.biz
hxxp://pamepredchef.biz
hxxp://shopedmap.biz
hxxp://goshoppingnow.biz
hxxp://dailycash.biz
hxxp://pamoeredchef.biz
hxxp://sleepygirls.us
hxxp://sexpain.biz
hxxp://japanese-kimonos.biz
hxxp://kwbw.biz
hxxp://knifesites.biz
hxxp://top-girlie.biz
hxxp://pcconnect.biz
hxxp://tiket2u.biz
hxxp://magicvideo.biz
hxxp://tankslapper.biz
hxxp://wolrdventures.biz
hxxp://555traff.biz
hxxp://assitante-maternelle.biz
hxxp://ambitenrgy.biz
hxxp://wcw2008.com
hxxp://yourxxxblog.biz
hxxp://ls-dreams.biz
hxxp://deai-joho.biz
hxxp://theadvanced348pills.biz
hxxp://privatporns.biz
hxxp://worldaventures.biz
hxxp://max-models.biz
hxxp://majornet.biz
hxxp://worldventrures.biz
hxxp://realincome4realpeople.biz
hxxp://miffi.biz
hxxp://lolitaskingdom.biz
hxxp://ratemyass.biz
hxxp://themillenium.biz
hxxp://love2005.biz
hxxp://worldventuers.biz
hxxp://worldventues.biz
hxxp://provoke.biz
hxxp://realadvanced348pills.biz
hxxp://wwwpartylite.biz
hxxp://armorgames.biz
hxxp://lampsites.biz
hxxp://labtesting.biz
hxxp://zagevqsoii.biz
hxxp://wwwherna.biz
hxxp://wwwsmartvalue.biz
hxxp://premierorlandoshow.biz
hxxp://xtremescooters.biz
hxxp://pharmaceu.biz
hxxp://patylite.biz
hxxp://pianosites.biz
hxxp://xgarden.biz
hxxp://xmature.biz
hxxp://wwwpamperedchef.biz
hxxp://logocorea.biz
hxxp://traffstats.biz
hxxp://myspaze.biz
hxxp://smartvalu.biz
hxxp://myangelfuns.biz
hxxp://pfshop.biz
hxxp://sinon.biz
hxxp://partylight.biz
hxxp://piscali.biz
hxxp://ventriloserver.biz
hxxp://vintage-lingerie.biz
hxxp://busybee-discounts.biz
hxxp://mycoices.biz
hxxp://tstats.biz
hxxp://rmpinfotecc.biz
hxxp://ruslolitas.biz
hxxp://only4us.biz
hxxp://rmpinfote.biz
hxxp://mo-ip.biz
hxxp://pamperechef.biz
hxxp://superfreak.biz
hxxp://mychoises.biz
hxxp://pamperedcheif.biz
hxxp://rock0em.biz
hxxp://videonymphets.biz
hxxp://lovers-lane.biz
hxxp://rmpinfotac.biz
hxxp://wisconsinapartment.biz
hxxp://sweet-girls.biz
hxxp://pameredchef.biz
hxxp://whiteslave.biz
hxxp://herohona.biz
hxxp://minecharm.biz
hxxp://skysat.biz
hxxp://boxmain.biz
hxxp://dynds.biz
hxxp://dremer.biz
hxxp://dragonpalace.biz
hxxp://doina-sirbu.biz
hxxp://4useonly.biz
hxxp://cccp-top.biz
hxxp://panoromicworld.biz
hxxp://ganntproject.biz
hxxp://sextop.biz
hxxp://pamperedhef.biz
hxxp://virtualzone.biz
hxxp://serendipityboutique.biz
hxxp://photololita.biz
hxxp://parylite.biz
hxxp://rmpinfotce.biz
hxxp://partlite.biz
hxxp://panperedchef.biz
hxxp://sexlagoon.biz
hxxp://mcmmunity.biz
hxxp://statrafongon.biz
hxxp://stockservice.biz
hxxp://jobsinmotors.biz
hxxp://torrent-portal.biz
hxxp://simwork.biz
hxxp://simmaster.biz
hxxp://partyite.biz
hxxp://opse.biz
hxxp://shocknews.biz
hxxp://worldvenures.biz
hxxp://funnigames.biz
Sample malicious MD5s known to have been involved in the campaign include:
375e8a6dd1b666f09f3602ed2e8e05eb
4634d5e104a26616b6666a43b5b1416c
014a6e2a4cc62df769c923f236f2934e
c7a2350a62497f743401946fd63ca25b
b118c68b72595f9c15bdce8fc77fea37
a616b67adbdad8870e751384dd070db5
ccd7b6b6a59bb9925e0af66d60de1e6d
d4627cf4de6a5905dde5df2e69f8944b
0de4b76312dc01ff2d2f473465020619
5ca52919915bbad976fef4165b3f4800
381b27cb8b9976e6820345a49d93fc3b
3cab5169156f2d062b84c519cf2b1802
bbf664bd279580aa717fcff0246b762c
06d0c3af7b80ea0001a5270d59348282
e4e494eff71ad9f14b1a369522fb4c94
No comments:
Post a Comment