Exposing a Portfolio of Pay Per Install Rogue and Fraudulent and Malicious Affiliate Network Domains - An OSINT Analysis
0
Dear blog readers,
I've decided to share with everyone an in-depth historical OSINT analysis on some of the primary pay per install rogue fraudulent and malicious affiliate network based rogue and fraudulent revenue sharing scheme operating malicious software gangs that are known to have been active back in 2008 with the idea to assist everyone in their cyber campaign attribution efforts.
Sample portfolio of pay per install rogue fraudulent and malicious affiliate network domains known to have been in operation in 2008 include:
vipsoftcash[.]com
iframevip[.]com
avicash[.]com
softmonsters[.]biz
cashboom[.]biz
loader[.]cc
luxecash[.]com
iframepartners[.]com
installsforyou[.]biz
topsale2[.]ru
cashcodec[.]com
go-go-cash[.]com
oxocash[.]com
3xl-cash2[.]com
3xlpartnership[.]com
installs4sale[.]com
profitclick[.]org
megatraffer[.]com
oemcash[.]com
goldencashworld[.]biz
topsale[.]us
installsmarket[.]com
profit-cash[.]biz
ADWSearch[.]com
ovocash[.]com
loadsprofit[.]com
exerevenue[.]com
adwaredollars[.]com
yabucks[.]com
installing[.]cc
installconverter[.]com
topsale[.]us
bakasoftware[.]com
goldencashworld[.]net
niftystats[.]com
niftystats[.]com
royal-cash[.]com
dogmasoftware[.]com
3xlsoftware[.]com
rashacash[.]com
3xltop[.]com
vipinstall[.]cn
installercash[.]com
spicycodec[.]com
softwareprofit[.]com
codecmoney[.]biz
trafcash[.]com
smilecash[.]biz
bucksloads[.]com
traffic-converter[.]biz
eupays[.]com
seocash[.]us
vipppc[.]ru
cashwrestler[.]com
VipSoftCash[.]com
vscstatistics[.]com
vipsoftcashstats[.]com
Spy-Partners[.]com
vippirog[.]com
cashbotnet[.]com
installsforyou[.]biz
profit-cash[.]biz
bestcash[.]biz
VisitPay[.]com
partnerka[.]com
spy-partners[.]com
download4money[.]com
luxecash[.]net
iframe911[.]com
LOADBUCKS[.]BIZ
Cashpanic[.]com
longbucks[.]com
drugrevenue[.]com
evapharmacy[.]ru
bucksloads[.]com
spydevastator[.]com
softcash[.]org
3xlsoftware[.]com
rashacash[.]com
3xlcash[.]com
spicycodec[.]com
buckster[.]ru
trafficconverter2[.]biz
bucksware[.]com
bucksware-admin[.]com
mac-codec[.]com
traffic-converter[.]biz
klikadult[.]com
goldencash[.]com
payperinstall[.]org
pay-per-install[.]com
pay-per-install[.]org
zangocash[.]com
iframebiz[.]com
webmaster-money[.]org
cash4toolbar[.]com
toolbar4cash[.]com
bluechillies[.]com
adwaredollars[.]com
iframestat[.]org
snapinstalls[.]com
installercash[.]com
installcash[.]org
earnperinstall[.]com
dollarsengine[.]com
installercash[.]com
vombacash[.]com
softahead[.]com
iframestat[.]org
antispy[.]ws
sexprofit[.]com
evapharmacy-login[.]biz
vipsoftcash[.]com
glavmed[.]com
Sample name servers known to have been used by the same rogue fraudulent and malicious pay per install affiliate network domains include:
ns1[.]cgymwmlcaa[.]com A 85[.]17[.]136[.]135
ns1[.]cdpvaqnlod[.]com A 85[.]17[.]136[.]135
ns1[.]ccytvpbsdg[.]com A 85[.]17[.]136[.]135
ns1[.]cbfkzhtyik[.]com A 85[.]17[.]136[.]135
ns1[.]cezqtessjo[.]com A 85[.]17[.]136[.]135
ns1[.]cfsiqejclo[.]com A 85[.]17[.]136[.]135
ns1[.]catjepzcft[.]com A 85[.]17[.]136[.]135
ns1[.]dhxkycjmrg[.]net A 85[.]17[.]136[.]135
ns1[.]dglcxlcfmk[.]net A 85[.]17[.]136[.]135
ns1[.]damqrgldev[.]net A 85[.]17[.]136[.]135
ns1[.]dfhatnjfjw[.]net A 85[.]17[.]136[.]135
ns1[.]ddzmuatncz[.]net A 85[.]17[.]136[.]135
ns1[.]cgymwmlcaa[.]com A 72[.]232[.]184[.]10
ns1[.]cdpvaqnlod[.]com A 72[.]232[.]184[.]10
ns1[.]ccytvpbsdg[.]com A 72[.]232[.]184[.]10
ns1[.]cbfkzhtyik[.]com A 72[.]232[.]184[.]10
ns1[.]cezqtessjo[.]com A 72[.]232[.]184[.]10
ns1[.]cfsiqejclo[.]com A 72[.]232[.]184[.]10
ns1[.]chyaicpvxo[.]com A 72[.]232[.]184[.]10
ns1[.]catjepzcft[.]com A 72[.]232[.]184[.]10
ns1[.]dhxkycjmrg[.]net A 72[.]232[.]184[.]10
ns1[.]dcorbtfyni[.]net A 72[.]232[.]184[.]10
ns1[.]dglcxlcfmk[.]net A 72[.]232[.]184[.]10
ns1[.]detjstniup[.]net A 72[.]232[.]184[.]10
ns1[.]damqrgldev[.]net A 72[.]232[.]184[.]10
ns1[.]dfhatnjfjw[.]net A 72[.]232[.]184[.]10
ns1[.]dbsjxuvijx[.]net A 72[.]232[.]184[.]10
ns1[.]ddzmuatncz[.]net A 72[.]232[.]184[.]10
cgymwmlcaa[.]com A 195[.]2[.]253[.]247
cezqtessjo[.]com A 195[.]2[.]253[.]247
cfsiqejclo[.]com A 195[.]2[.]253[.]247
chyaicpvxo[.]com A 195[.]2[.]253[.]247
cdpvaqnlod[.]com A 195[.]2[.]253[.]246
ccytvpbsdg[.]com A 195[.]2[.]253[.]246
cbfkzhtyik[.]com A 195[.]2[.]253[.]246
catjepzcft[.]com A 195[.]2[.]253[.]246
http://catjepzcft[.]com
http://catjepzcft[.]com
http://damqrgldev[.]net
http://catjepzcft[.]com
http://damqrgldev[.]net
catjepzcft[.]com
damqrgldev[.]net 195[.]2[.]253[.]248
dcorbtfyni[.]net A 195[.]2[.]253[.]248
damqrgldev[.]net A 195[.]2[.]253[.]248
dbsjxuvijx[.]net A 195[.]2[.]253[.]248
ddzmuatncz[.]net A 195[.]2[.]253[.]248
dhxkycjmrg[.]net A 195[.]2[.]253[.]249
dglcxlcfmk[.]net A 195[.]2[.]253[.]249
detjstniup[.]net A 195[.]2[.]253[.]249
dfhatnjfjw[.]net A 195[.]2[.]253[.]249
dhxkycjmrg[.]net NS ns1[.]dhxkycjmrg[.]net
ns1[.]dhxkycjmrg[.]net A 72[.]232[.]184[.]10
ns1[.]dhxkycjmrg[.]net A 85[.]17[.]136[.]135
dcorbtfyni[.]net NS ns1[.]dhxkycjmrg[.]net
dglcxlcfmk[.]net NS ns1[.]dhxkycjmrg[.]net
detjstniup[.]net NS ns1[.]dhxkycjmrg[.]net
damqrgldev[.]net NS ns1[.]dhxkycjmrg[.]net
dfhatnjfjw[.]net NS ns1[.]dhxkycjmrg[.]net
dbsjxuvijx[.]net NS ns1[.]dhxkycjmrg[.]net
ddzmuatncz[.]net NS ns1[.]dhxkycjmrg[.]net
Related pay per install rogue fraudulent and malicious domains known to have been used back in 2008 for various rogue fraudulent and malicious purposes include:
drawn-cash[.]com
vippay[.]com
bucksware-admin[.]com
www[.]system-protector[.]net
sys-scan-1[.]biz
sys-scan-wiz[.]biz
topsale2[.]ru
earning4u[.]com
flashdollars[.]com
installing[.]cc
siteload[.]cn A 94[.]247[.]2[.]54
hostnsload[.]cn
siteinstall[.]cn
hostnsinstall[.]cn
jjupsport[.]ru
installz[.]cn
adware-help[.]com
fliporn[.]com
dailybucks[.]org
installloader[.]com
installaga[.]cn
georgenatas[.]in
naemnitibo[.]in
tirosanare[.]in
mialo-goodle[.]info
nailcash[.]com
ultraantivirus2009[.]com
nailcash[.]com A 64[.]86[.]17[.]9
virusalarmpro[.]com A 64[.]86[.]17[.]9
vmfastscanner[.]com A 64[.]86[.]17[.]9
mysuperviser[.]com A 64[.]86[.]17[.]9
virusmelt[.]com A 64[.]86[.]17[.]9
payvirusmelt[.]com A 64[.]86[.]17[.]9
updvmfnow[.]cn A 64[.]86[.]17[.]9
mysupervisor[.]net A 64[.]86[.]17[.]9
Related personal email accounts known to have been used for various related pay per install rogue fraudulent and malicious affiliate network domain registrations include:
pvc6168@sina[.]com
windinv@yahoo[.]com
new@loveplus[.]in
johnson8402@post[.]com
lmunozv1@live[.]com
ididid828@gmail[.]com
onlineprivacy@aol[.]com
alex@bnetworks[.]us
milen[.]radumilo@gmail[.]com
ztao72945@gmail[.]com
redsunray@hotmail[.]com
WINDINV@YAHOO[.]COM
tvmt2000@yahoo[.]com
325214476@qq[.]com
adxluxe@gmail[.]com
SexPicker@gmail[.]com
domainaccount@protonmail[.]com
ancientholdings@fastmail[.]fm
newseowork12@gmail[.]com
oem[.]myrian@gmail[.]com
229848501@qq[.]com
bdmailhere@gmail[.]com
danny9@gmail[.]com
phone49012@yahoo[.]com
miok2001@mail[.]ru
zuev@cmedia-online[.]ru
daniel[.]bastien@gmail[.]com
domainadmin1900@gmail[.]com
larsonown@gmail[.]com
ppcseo2@gmail[.]com
sima[.]jogminaite@inbox[.]lt
topsaleus@gmail[.]com
Stay tuned!
RSS Feed