Showing posts with label Search Engine Optimization. Show all posts

Exposing a Diverse Portfolio of Malicious and Fraudulent Name Servers - An Analysis

0
December 12, 2020

Dear blog readers,

In this post I've decided to share a diverse portfolio of fraudulent and malicious name servers circa 2008 that are known to have participated in various rogue and malicious software serving campaigns. 

Sample portfolio of rogue fraudulent and malicious name servers known to have participated in rogue and malicious campaigns circa 2008:

ns0.adesuikintandefunhandesun.com

ns0.ahfywbz.com

ns0.bcrqhro.com

ns0.ckjdtybz.com

ns0.cnogaira.com

ns0.fyukbz.com

ns0.kerunhandgunfandesikuntun.com

ns0.rehogonro.com

ns0.uthvfybz.com 

ns0.wkakekod.com 

ns1.52352a0c60a9c29.com

ns1.6309a46.com 

ns1.adns2008.com 

ns1.b546ec5a89.com 

ns1.bestairusa.com

ns1.betotallyclear.com

ns1.callcityusa.com

ns1.chongdns99.com 

ns1.devinavy.com

ns1.dnsreal.com

ns1.docdns2008.com

ns1.fatiloquent.com 

ns1.fuscadns.com

ns1.holdsurface.com

ns1.img111dns.com  

ns1.kozel-soft.com  

ns1.krdns555.com 

ns1.laga-soft.com  

ns1.liabilityzul.com

ns1.metdns101.com

ns1.metdns99.com

ns1.mgrsu.com 

ns1.mycandydns.com  

ns1.mywowdns.com 

ns1.ns-martian.com

ns1.osel-soft.com 

ns1.penunmaimed.com

ns1.piradns.com

ns1.poertodas.com  

ns1.rokodns2008.com  

ns1.serbicephalous.com 

ns1.sobaka-soft.com

ns1.stardecagon.com

ns1.stookvol.com 

ns2.52352a0c60a9c29.com

ns2.6309a46.com

ns2.adns2008.com

ns2.b546ec5a89.com  

ns2.bestairusa.com

ns2.betotallyclear.com  

ns2.caccytoo.com 

ns2.callcityusa.com 

ns2.chongdns102.com  

ns2.chongdns99.com

ns2.dnsreal.com 

ns2.docdns2008.com

ns2.fatiloquent.com  

ns2.freesecondaryns.com 

ns2.fuscadns.com 

ns2.holdsurface.com 

ns2.img111dns.com

ns2.jaeb6mee.com  

ns2.kaihooho.com

ns2.kninuti.com 

ns2.kozel-soft.com 

ns2.krdns555.com

ns2.laga-soft.com 

ns2.metdns101.com 

ns2.metdns2008.com 

ns2.mgrsu.com 

ns2.mycandydns.com

ns2.mywowdns.com 

ns2.ns-martian.com 

ns2.palmyxer.com  

ns2.piradns.com  

ns2.rokodns2008.com 

ns2.sobaka-soft.com 

ns2.stookvol.com 

ns2.tantrarure.com  

ns3.52352a0c60a9c29.com 

ns3.6309a46.com  

ns3.b546ec5a89.com 

ns3.kninuti.com  

ns3.metdns101.com 

ns3.metdns2008.com 

ns3.metdns99.com  

ns3.mycandydns.com  

ns4.52352a0c60a9c29.com  

ns4.b546ec5a89.com 

ns4.kninuti.com  

ns4.metdns101.com 

ns4.metdns2008.com 

ns4.metdns99.com 

ns5.b546ec5a89.com 

ns5.mycandydns.com  

ns5.mywowdns.com

ns6.mywowdns.com 

ns7.mywowdns.com

ns5.icegifted.com

ns6.icegifted.com

ns3.maxigreat.com

ns4.maxigreat.com

ns1.savetangy.com

ns2.savetangy.com

a1.aromalucky.com

a1.aromasheer.com

a1.base-dns.com

a1.buyzest.com

a1.chicprize.com

a1.movercoy.com

a1.newfull.com

a1.treatzap.com

b2.alerttan.com

b2.aromalucky.com

b2.buyzest.com

b2.chicprize.com

b2.eageraware.com

b2.newfull.com

b2.peakchic.com

b2.spicyeager.com

b2.treatzap.com

c3.alerttan.com

c3.aromalucky.com

c3.awarewise.com

c3.buyzest.com

c3.modelenjoy.com

c3.spicyeager.com

c3.whizfab.com

d4.aromalucky.com

d4.newfull.com

d4.treatzap.com

dns1.advocacylife.com

dns1.believingunsurpassed.com

dns1.carryslip.com

dns1.colonysing.com

dns1.considerfeet.com

dns1.coolcontain.com

dns1.courageslave.com

dns1.directwit.com

dns1.feltverb.com

dns1.fingersame.com

dns1.fivebuild.com

dns1.hurrystring.com

dns1.instrumentinvent.com

dns1.legacyice.com

dns1.moleculetrain.com

dns1.namenear.com

dns1.ohpush.com

dns1.operatedefinition.com

dns1.otherinstrument.com

dns1.positionbusy.com

dns1.probableout.com

dns1.quickbefore.com

dns1.rowknow.com

dns1.shinefull.com

dns1.spendlift.com

dns1.substancelost.com

dns1.suddenyet.com

dns1.tenaciousscores.com

dns1.tenbusy.com

dns1.therereflection.com

dns1.thickcondition.com

dns1.thishe.com

dns1.triangleelse.com

dns1.vowelsimple.com

dns1.washfar.com

dns12.repentantdetached.com

dns2.advocacylife.com

dns2.appreciationseed.com

dns2.arespoke.com

dns2.considerfeet.com

dns2.coolcontain.com

dns2.courageslave.com

dns2.directwit.com

dns2.feltverb.com

dns2.fivebuild.com

dns2.foodwhy.com

dns2.headarrange.com

dns2.heardrest.com

dns2.hurrystring.com

dns2.instrumentinvent.com

dns2.ohpush.com

dns2.operatedefinition.com

dns2.operatelet.com

dns2.optimismdance.com

dns2.otherinstrument.com

dns2.positionbusy.com

dns2.quickbefore.com

dns2.shinefull.com

dns2.spendlift.com

dns2.substancelost.com

dns2.suddenyet.com

dns2.tenaciousscores.com

dns2.triangleelse.com

dns2.verycome.com

dns2.waitspirituality.com

dns2.whoachievement.com

dns2.windevery.com

dns21.aglowgreat.com

dns21.fearlesshelp.com

pt3.maxiultra.com

pt1.agreeextra.com

ns5.icegifted.com

ns3.prizekind.com

ns3.tansure.com

ns3.loftysure.com

pt3.piouswarm.com

ns3.greatwarm.com

ns3.primesheer.com

ns5.rollsheer.com

pt5.fossdns.com

pt5.upssdns.com

pt3.loyalbeats.com

ns3.maxigreat.com

pt3.adoresweet.com

pt3.eagersweet.com

ns3.spicyrest.com

ns3.kindhardy.com

ns3.lovetangy.com

pt3.tangytangy.com

63q00.speedultra.com   

m3h20.speedultra.com   

mvt20.speedultra.com   

lyg50.speedultra.com   

txq60.speedultra.com   

atrb0.speedultra.com   

lptb0.speedultra.com   

eepc0.speedultra.com   

sqwc0.speedultra.com   

y0od0.speedultra.com   

jzrf0.speedultra.com   

aavf0.speedultra.com   

zgcg0.speedultra.com   

vwxg0.speedultra.com   

xwal0.speedultra.com   

m01m0.speedultra.com   

711m0.speedultra.com   

xpbm0.speedultra.com   

rpqp0.speedultra.com   

umkq0.speedultra.com   

vvzs0.speedultra.com   

fyzs0.speedultra.com   

tkjt0.speedultra.com   

xkdu0.speedultra.com   

ac4x0.speedultra.com   

tchy0.speedultra.com   

qxbz0.speedultra.com   

twm21.speedultra.com   

xqh61.speedultra.com   

g1a1.speedultra.com   

dmza1.speedultra.com   

4pqb1.speedultra.com   

iumd1.speedultra.com   

ni2g1.speedultra.com   

jdxi1.speedultra.com   

w81j1.speedultra.com   

4hwm1.speedultra.com   

7rnq1.speedultra.com   

nskr1.speedultra.com   

0ltu1.speedultra.com   

gmyy1.speedultra.com   

4tiz1.speedultra.com   

cuf42.speedultra.com   

gtn92.speedultra.com   

difa2.speedultra.com   

mo2f2.speedultra.com   

psgf2.speedultra.com   

svvh2.speedultra.com   

pfjk2.speedultra.com   

oiwk2.speedultra.com   

guds2.speedultra.com   

ybwv2.speedultra.com   

opvw2.speedultra.com   

ryvw2.speedultra.com   

ixoy2.speedultra.com   

kzz2.speedultra.com   

7a083.speedultra.com   

0rz83.speedultra.com   

es93.speedultra.com   

zpta3.speedultra.com   

sygb3.speedultra.com   

2ezc3.speedultra.com   

zwqh3.speedultra.com   

m3ym3.speedultra.com   

ccwo3.speedultra.com   

zdgp3.speedultra.com   

0pqs3.speedultra.com   

dg5v3.speedultra.com   

o58x3.speedultra.com   

pyx3.speedultra.com   

vpp84.speedultra.com   

wcxb4.speedultra.com   

z7li4.speedultra.com   

hwfm4.speedultra.com   

wocr4.speedultra.com   

zwjr4.speedultra.com   

9fcx4.speedultra.com   

bnox4.speedultra.com   

snw15.speedultra.com   

wgg35.speedultra.com   

j6yf5.speedultra.com   

xqig5.speedultra.com   

cqh5.speedultra.com   

sukk5.speedultra.com   

9iml5.speedultra.com   

2tq5.speedultra.com   

tmnr5.speedultra.com   

nxgs5.speedultra.com   

yhft5.speedultra.com   

r4uv5.speedultra.com   

vw5.speedultra.com   

kvo06.speedultra.com   

wey36.speedultra.com   

wn456.speedultra.com   

lj186.speedultra.com   

1ta6.speedultra.com   

jqwa6.speedultra.com   

caid6.speedultra.com   

zh4e6.speedultra.com   

pt1g6.speedultra.com   

c0fg6.speedultra.com   

764n6.speedultra.com   

fhen6.speedultra.com   

imos6.speedultra.com   

seu6.speedultra.com   

nezu6.speedultra.com   

6m5w6.speedultra.com   

j3jw6.speedultra.com   

p7fy6.speedultra.com   

eks07.speedultra.com   

dyi17.speedultra.com   

rqra7.speedultra.com   

z41b7.speedultra.com   

i5me7.speedultra.com   

1rcj7.speedultra.com   

z0dm7.speedultra.com   

vom7.speedultra.com   

oi1q7.speedultra.com   

yhrt7.speedultra.com   

hwxu7.speedultra.com   

epuv7.speedultra.com   

t27w7.speedultra.com   

0tby7.speedultra.com   

yuj18.speedultra.com   

ifj28.speedultra.com   

xh368.speedultra.com   

4nt78.speedultra.com   

kj2e8.speedultra.com   

zoe8.speedultra.com   

ji3f8.speedultra.com   

sm0n8.speedultra.com   

yowq8.speedultra.com   

8fzq8.speedultra.com   

r0cu8.speedultra.com   

ho2w8.speedultra.com   

irlz8.speedultra.com   

dvt09.speedultra.com   

qgh19.speedultra.com   

5ez19.speedultra.com   

hto89.speedultra.com   

qay89.speedultra.com   

c0ua9.speedultra.com   

nwab9.speedultra.com   

oqb9.speedultra.com   

wu8c9.speedultra.com   

fjmd9.speedultra.com   

cfte9.speedultra.com   

shrf9.speedultra.com   

4ndi9.speedultra.com   

dakj9.speedultra.com   

azlj9.speedultra.com   

a4fk9.speedultra.com   

1ogk9.speedultra.com   

j2hv9.speedultra.com   

42tx9.speedultra.com   

2cg0a.speedultra.com   

8qvaa.speedultra.com   

u1jba.speedultra.com   

k46da.speedultra.com   

tjcea.speedultra.com   

bqiea.speedultra.com   

vwhfa.speedultra.com   

fq9ga.speedultra.com   

rksga.speedultra.com   

nkdha.speedultra.com   

h8oia.speedultra.com   

skka.speedultra.com   

lorla.speedultra.com   

wzcna.speedultra.com   

t4dna.speedultra.com   

6uvna.speedultra.com   

mb4oa.speedultra.com   

jhyoa.speedultra.com   

vbzra.speedultra.com   

y01sa.speedultra.com   

0ugsa.speedultra.com   

uxmsa.speedultra.com   

0v1ta.speedultra.com   

ptpta.speedultra.com   

bg5ua.speedultra.com   

tfhva.speedultra.com   

miva.speedultra.com   

yaixa.speedultra.com   

vkxa.speedultra.com

Stay tuned!

Continue reading →

Exposing a Massive and Diverse Portfolio of "Tax Forms" Themed Malware and Blackhat SEO Serving Domains

0
December 12, 2020

Dear blog readers,

I've decided to share a massive and diverse portfolio of rogue and potentially malicious domains portfolio utilized by cybercriminals while participating in a blackhat SEO tax forms themed rogue and malicious software serving campaigns circa 2008.

In this post I'll provide actionable intelligence on the infrastructure behind it and discuss in-depth the tactics techniques and procedures of the cybercriminals behind it.

Sample portfolio of rogue and malicious tax forms themed domains portfolio currently in circulation circa 2008:

http://free-1500-hicfa-form-printable.foper29i142.dynodns.net/

http://printable-free-contractor-bid-form.fuder29i160.dynodns.net/

http://form-ct-1040x-printable-version.fuder29i145.dynodns.net/

http://printable-irs-form-1040.fuder29i130.dynodns.net/

http://printable-irs-form-w-9.fuder29i133.dynodns.net/

http://form-irs-printable-tax.fasoe29i130.dynodns.net/

http://printable-tool-inventory-form.foper29i142.dynodns.net/

http://form-irs-printable.fuder29i142.dynodns.net/

http://1099-misc-printable-form.fuder29i130.dynodns.net/

http://printable-free-tax-form.fuder29i142.dynodns.net/

http://printable-and-edit-form-1040.fasoe29i139.dynodns.net/

http://printable-homeschool-transcript-form.foper29i130.dynodns.net/

http://printable-1040-form.fasoe29i136.dynodns.net/

http://blank-receipt-form-printable.fasoe29i127.dynodns.net/

http://printable-preschool-admission-form.fuder29i148.dynodns.net/

http://printable-irs-form-w-9.fasoe29i139.dynodns.net/

http://printable-immunization-form.fasoe29i136.dynodns.net/

http://printable-hippa-form.fasoe29i133.dynodns.net/

http://irs-1040ez-printable-form.fuder29i133.dynodns.net/

http://1040-ez-printable-form.foper29i130.dynodns.net/

http://printable-u-s-tax-form-1041.foper29i142.dynodns.net/

http://free-printable-creditl-form.fuder29i130.dynodns.net/

http://printable-ub-92-claim-form.fuder29i133.dynodns.net/

http://form-ssa-623-printable.fuder29i160.dynodns.net/

http://printable-copy-of-fafsa-form.fuder29i133.dynodns.net/

http://printable-foreclosure-form.foper29i130.dynodns.net/

http://1099-misc-form-printable.fuder29i145.dynodns.net/

http://free-rent-agrement-printable-form.fuder29i145.dynodns.net/

http://printable-1040x-form.fuder29i142.dynodns.net/

http://free-printable-health-claim-form.lasae29i211.dynodns.net/

http://printable-home-school-form.foper29i148.dynodns.net/

http://form-free-legal-ohio-printable.fuder29i154.dynodns.net/

http://cub-scout-den-dues-printable-form.fuder29i145.dynodns.net/

http://printable-work-schedule-form.fuder29i127.dynodns.net/

http://printable-schedule-form.fuder29i133.dynodns.net/

http://free-printable-divorce-form.fuder29i130.dynodns.net/

http://printable-ub92-form.fasoe29i127.dynodns.net/

http://blank-printable-info-form.fuder29i127.dynodns.net/

http://make-an-adobe-form-printable.fuder29i145.dynodns.net/

http://form-ds-11-printable.foper29i130.dynodns.net/

http://printable-blank-petition-form.fuder29i133.dynodns.net/

http://printable-blank-newsletter-form.fasoe29i127.dynodns.net/

http://blank-printable-info-form.foper29i130.dynodns.net/

http://printable-form-646-va.fuder29i142.dynodns.net/

http://2006-printable-federal-tax-form-1116.lasae29i211.dynodns.net/

http://printable-2006-1040-form.foper29i142.dynodns.net/

http://free-printable-employee-attendance-form.fuder29i145.dynodns.net/

http://eeo-form-printable-2007.fasoe29i133.dynodns.net/

http://free-printable-2008-w-2-forms.fuder29i142.dynodns.net/

http://free-printable-form-i-9.fasoe29i127.dynodns.net/

http://free-printable-invoice-form.fasoe29i130.dynodns.net/

http://bill-form-free-printable-sale.lasae29i211.dynodns.net/

http://osha-300a-printable-form.foper29i142.dynodns.net/

http://printable-automobile-estimate-form.fuder29i148.dynodns.net/

http://free-pantry-inventory-form-printable.lasae29i211.dynodns.net/

http://free-printable-w-9-forms.fasoe29i130.dynodns.net/

http://printable-form-646-veterans.foper29i142.dynodns.net/

http://free-printable-1040-tax-form.fuder29i148.dynodns.net/

http://homeschool-form-printable-free-checklist.fuder29i160.dynodns.net/

http://printable-irs-tax-forms-w-4.foper29i142.dynodns.net/

http://printable-check-request-form.fazer29i145.dynodns.net/

http://printable-voe-form.foper29i160.dynodns.net/

http://printable-copy-of-fafsa-form.fuder29i139.dynodns.net/

http://free-printable-order-form.fazer29i139.dynodns.net/

http://irs-140t-printable-form.fuder29i133.dynodns.net/

http://fisma-printable-report-form.lasae29i211.dynodns.net/

http://printable-state-of-indiana-beneficary-form.foper29i127.dynodns.net/

http://printable-copy-of-fafsa-form.fasoe29i139.dynodns.net/

http://deb-9091acon-printable-form.fasoe29i136.dynodns.net/

http://1040-ez-forms-printable.fuder29i145.dynodns.net/

http://free-printable-lease-form.foper29i151.dynodns.net/

http://printable-loan-application-form.foper29i127.dynodns.net/

http://free-printable-credit-rental-form.foper29i142.dynodns.net/

http://1820-printable-census-form.fuder29i139.dynodns.net/

http://north-carolina-printable-death-certificate-form.foper29i145.dynodns.net/

http://printable-work-schedule-form.foper29i139.dynodns.net/

http://eeo-form-printable-2007.fazer29i133.dynodns.net/

http://printable-time-tracking-form.fuder29i130.dynodns.net/

http://free-printable-grant-deed-form.fasoe29i139.dynodns.net/

http://free-printable-personal-accounting-form.foper29i145.dynodns.net/

http://printable-time-tracking-form.foper29i157.dynodns.net/

http://printable-w9-form.fuder29i139.dynodns.net/

http://printable-i-9-forms.fazer29i142.dynodns.net/

http://nc-dl-123-printable-form.fuder29i133.dynodns.net/

http://printable-girl-scout-cookie-form.fazer29i148.dynodns.net/

http://printable-iou-form.fasoe29i139.dynodns.net/

http://form-w-9-printable.fazer29i130.dynodns.net/

http://free-printable-bill-of-sale-form.foper29i142.dynodns.net/

http://find-printable-i-9-form.fazer29i133.dynodns.net/

http://printable-w9-form.foper29i154.dynodns.net/

http://printable-change-of-address-form.fazer29i148.dynodns.net/

http://ct-1040ez-printable-form.fazer29i130.dynodns.net/

http://printable-order-form-template-exel.fazer29i127.dynodns.net/

http://free-food-storage-inventory-form-printable.foper29i154.dynodns.net/

http://ds-11-printable-request-form.foper29i160.dynodns.net/

http://printable-2006-irs-1096-tax-form.fuder29i160.dynodns.net/

http://printable-and-open-form-poem.fuder29i148.dynodns.net/

http://pampered-chef-printable-order-form.foper29i160.dynodns.net/

http://free-printable-w-9-form.fuder29i136.dynodns.net/


http://elemental-form.pasbirrada.com/

http://form-heirship.pasbirrada.com/

http://referee-form.pasbirrada.com/

http://form-procedure.pasbirrada.com/

http://intent-form.pasbirrada.com/

http://ub-form.pasbirrada.com/

http://form-946.pasbirrada.com/

http://suport-form.pasbirrada.com/

http://form-jamie.pasbirrada.com/

http://485-form.pasbirrada.com/

http://hqda-form.pasbirrada.com/

http://sas70-form.pasbirrada.com/

http://voyuer-form.pasbirrada.com/

http://objection-form.pasbirrada.com/

http://form-unload.pasbirrada.com/

http://ss-form.pasbirrada.com/

http://form-8130.pasbirrada.com/

http://idpa-form.pasbirrada.com/

http://hours-form.pasbirrada.com/

http://dvla-form.pasbirrada.com/

http://rfid-form.pasbirrada.com/

http://form-4761.pasbirrada.com/

http://form-psychology.pasbirrada.com/

http://fillable-form.pasbirrada.com/

http://raci-form.pasbirrada.com/

http://form-5300.pasbirrada.com/

http://form-thickness.pasbirrada.com/

http://form-174.pasbirrada.com/

http://form-rx3.pasbirrada.com/

http://quadra-form.pasbirrada.com/

http://sart-form.pasbirrada.com/

http://prenuptual-form.pasbirrada.com/

http://asset-form.pasbirrada.com/

http://form-8081.pasbirrada.com/

http://form-1338.pasbirrada.com/

http://roadliner-form.pasbirrada.com/

http://bellybutton-form.pasbirrada.com/

http://form-modal.pasbirrada.com/

http://form-539.pasbirrada.com/

http://form-iata.pasbirrada.com/

http://form-tx.pasbirrada.com/

http://risk-form.pasbirrada.com/

http://cpmt-form.pasbirrada.com/

http://form-additional.pasbirrada.com/

http://movie-form.pasbirrada.com/

http://bia-form.pasbirrada.com/

http://form-672.pasbirrada.com/

http://hsmp-visa-form.pasbirrada.com/

http://jsp-form-tutorial.pasbirrada.com/

http://p50-tax-form.pasbirrada.com/

http://car-form-rr.pasbirrada.com/

http://long-form-sf3.pasbirrada.com/

http://sba-form-1919.pasbirrada.com/

http://link-exchange-form.pasbirrada.com/

http://asp-form-post.pasbirrada.com/

http://form-cancel-button.pasbirrada.com/

http://noscript-form-submit.pasbirrada.com/

http://evisa-form-state.pasbirrada.com/

http://ss4-form-irs.pasbirrada.com/

http://exquisit-form-2563.pasbirrada.com/

http://speech-critique-form.pasbirrada.com/

http://form-1040a-irs.pasbirrada.com/

http://form-540-ca.pasbirrada.com/

http://501-tax-form.pasbirrada.com/

http://540-tax-form.pasbirrada.com/

http://form-and-pheremone.pasbirrada.com/

http://samung-d600-form.pasbirrada.com/

http://http-input-form.pasbirrada.com/

http://form-wtc-100.pasbirrada.com/

http://software-licensing-form.pasbirrada.com/

http://uf-form-3072.pasbirrada.com/

http://disk-form-scaring.pasbirrada.com/

http://form-15-surety.pasbirrada.com/

http://clause-form-logic.pasbirrada.com/

http://mortgage-form-1008.pasbirrada.com/

http://form-1120-cm.pasbirrada.com/

http://glenco-order-form.pasbirrada.com/

http://car-quote-form.pasbirrada.com/

http://free-survey-form.pasbirrada.com/

http://form-mail-cgi.pasbirrada.com/

http://bcbs-otr-form.pasbirrada.com/

http://dea-hemp-form.pasbirrada.com/

http://word-form-letter.pasbirrada.com/

http://af-form-10.pasbirrada.com/

http://quill-survey-form.pasbirrada.com/

http://fafsa-form-renewals.pasbirrada.com/

http://dd-form-saar.pasbirrada.com/

http://hsc-form-104.pasbirrada.com/

http://short-quote-form.pasbirrada.com/

http://brest-form-stoor.pasbirrada.com/

http://web-form-help.pasbirrada.com/

http://boa-multipart-form.pasbirrada.com/

http://time-worked-form.pasbirrada.com/

http://form-2848-fax.pasbirrada.com/

http://cash-payment-form.pasbirrada.com/

http://tri-form-r.pasbirrada.com/

http://form-lc-50.pasbirrada.com/

http://irs-llc-form.pasbirrada.com/

http://url-proxy-form.pasbirrada.com/

http://email-web-form.pasbirrada.com/


http://php-form-validations.fequervo.com/

http://form-html.fequervo.com/

http://form.fequervo.com/

http://general-agreement-form-free.fequervo.com/

http://tax-form.fequervo.com/

http://free-rental-contract-form.fequervo.com/

http://form-gabon.fequervo.com/

http://hr-form.fequervo.com/

http://form-handler-example.fequervo.com/

http://how-and-where-do-hurricanes-form.fequervo.com/

http://form-probate-wa.fequervo.com/

http://php-form.fequervo.com/

http://business-form-ny.fequervo.com/

http://form-php.fequervo.com/

http://form-free.fequervo.com/

http://form-code.fequervo.com/

http://php-form-processer.fequervo.com/

http://customer-feedback-form.fequervo.com/

http://easy-form.fequervo.com/

http://general-affidavit-form-free.fequervo.com/

http://form-elements-html.fequervo.com/

http://form-tax.fequervo.com/

http://printable-budget-form.fequervo.com/

http://blank-receipt-invoice-form.fequervo.com/

http://form-online-survey.fequervo.com/

http://form-email-html.fequervo.com/

http://form-separation-agreements.fequervo.com/

http://da-form-2407-electronic-version.fequervo.com/

http://form-submit-script.fequervo.com/

http://stephan-form.fequervo.com/

http://explain-how-clouds-form.fequervo.com/

http://reprint-and-permissions-form.fequervo.com/

http://blank-form-schedule.fequervo.com/

http://last-will-and-testament-printable-form.fequervo.com/

http://auot-bill-of-sale-form.fequervo.com/

http://legal-form-letter-sample.fequervo.com/

http://manuscript-form.fequervo.com/

http://oldham-sixth-form-college-website.fequervo.com/

http://how-form.fequervo.com/

http://free-menu-planner-form.fequervo.com/

http://ira-form-8863.fequervo.com/

http://form-mail.fequervo.com/

http://web-form.fequervo.com/

http://sample-form-of-questionnaire.fequervo.com/

http://free-form-pennsylvania-limited-liability-company.fequervo.com/

http://standard-quote-form-for-contractor-work.fequervo.com/

http://income-tax-return-1040ez-form.fequervo.com/

http://form-s.fequervo.com/

http://1096-form-tax.fequervo.com/

http://css-form-font-color.fequervo.com/

http://html-form-two-button-actions.fequervo.com/

http://event-form.fequervo.com/

http://html-form-software.fequervo.com/

http://asp-validate-form.fequervo.com/

http://cake-form.fequervo.com/

http://usa-form-processing-companies.fequervo.com/

http://car-repair-appointment-form.fequervo.com/

http://classroom-news-form.fequervo.com/

http://inc-business-entity-form.fequervo.com/

http://irs-form.fequervo.com/

http://ohio-form.fequervo.com/

http://hr-evaluation-form.fequervo.com/

http://encyclopedia-of-form-and-precedent.fequervo.com/

http://irs-6251-form.fequervo.com/

http://rhyme-form.fequervo.com/

http://sexual-harassment-interrogatories-form.fequervo.com/

http://efficient-running-form.fequervo.com/

http://uscg-aux-order-form.fequervo.com/

http://access-form-messages.fequervo.com/

http://a-form.fequervo.com/

http://wills-and-living-trust-form.fequervo.com/

http://1003-form.fequervo.com/

http://affidavit-form-free-illinois.fequervo.com/

http://irs-form-1120-schedule.fequervo.com/

http://html-form-mailto-action.fequervo.com/

http://schedule-a-form-1040-tax-form.fequervo.com/

http://form-cgi.fequervo.com/

http://us-form.fequervo.com/

http://free-purchase-order-form.fequervo.com/

http://bill-blank-form-lading.fequervo.com/

http://small-form-factor-forum.fequervo.com/

http://af-form.fequervo.com/

http://e111-form.fequervo.com/

http://mobipocket-reader-form.fequervo.com/

http://h-form-jsf.fequervo.com/

http://form-vs.fequervo.com/

http://nonce-form.fequervo.com/

http://free-cohabitation-agreement-form.fequervo.com/

http://black-cohosh-in-liquid-form.fequervo.com/

http://cube-form-concrete.fequervo.com/

http://form-e111.fequervo.com/

http://electronic-receipt-form.fequervo.com/

http://opm-form.fequervo.com/

http://1096-form.fequervo.com/

http://wood-dress-form.fequervo.com/

http://e-form.fequervo.com/

http://form-pta.fequervo.com/

http://fill-form.fequervo.com/

http://california-long-form-540-nr.fequervo.com/

http://blank-w3-form.fequervo.com/


http://die-form.reychohica.com/

http://st-dominics-sixth-form.reychohica.com/

http://profile-form.reychohica.com/

http://alabama-tax-form.reychohica.com/

http://form-onsubmit-return.reychohica.com/

http://sss-form.reychohica.com/

http://indiana-renter-form.reychohica.com/

http://wholesale-pillow-form.reychohica.com/

http://renters-contract-form.reychohica.com/

http://form-survey-word.reychohica.com/

http://form-menu-designs.reychohica.com/

http://form-petition-free.reychohica.com/

http://form-b7.reychohica.com/

http://deadlifting-form.reychohica.com/

http://government-form-8880.reychohica.com/

http://vme-form-factor.reychohica.com/

http://form-pet-sitter.reychohica.com/

http://da-form-7566-word.reychohica.com/

http://how-do-eathquakes-form.reychohica.com/

http://company-equipment-form.reychohica.com/

http://tax-form-to-download.reychohica.com/

http://meeting-feedback-form.reychohica.com/

http://form-question-solutions.reychohica.com/

http://ez-form-filler.reychohica.com/

http://e111-application-form.reychohica.com/

http://form-30.reychohica.com/

http://uk-passport-form.reychohica.com/

http://bigfoot-concrete-form.reychohica.com/

http://utah-w4-form-i-9-form.reychohica.com/

http://form-4684.reychohica.com/

http://access-form-control.reychohica.com/

http://financial-aid-form-faf.reychohica.com/

http://requirement-for-w2-form.reychohica.com/

http://spelling-test-form.reychohica.com/

http://form-element-type.reychohica.com/

http://1040-practice-form.reychohica.com/

http://marital-status-form.reychohica.com/

http://apartment-search-form.reychohica.com/

http://il-income-tax-form.reychohica.com/

http://form-input-css.reychohica.com/

http://form-field-input.reychohica.com/

http://teema-form.reychohica.com/

http://bill-of-sale-form-template.reychohica.com/

http://form-michigan-probate.reychohica.com/

http://web-form-templates.reychohica.com/

http://ira-1040ez-tax-form.reychohica.com/

http://plural-form-of-ox.reychohica.com/

http://commision-form.reychohica.com/

http://oregon-form-132.reychohica.com/

http://baseball-lineup-form.reychohica.com/

http://twcc-form.reychohica.com/

http://of-business-form.reychohica.com/

http://form-10k-sec.reychohica.com/

http://jsp-checkbox-form.reychohica.com/

http://javascript-form-field.reychohica.com/

http://ics-form-213.reychohica.com/

http://form-1099g-ny.reychohica.com/

http://sba-form-172.reychohica.com/

http://form-music-element.reychohica.com/

http://vehicle-purchase-form.reychohica.com/

http://mileage-form.reychohica.com/

http://how-did-the-earth-form.reychohica.com/

http://copyright-form-example.reychohica.com/

http://i-360-form.reychohica.com/

http://hdo-form-material.reychohica.com/

http://federal-tax-form-schedule-a.reychohica.com/

http://us-visit-visa-form.reychohica.com/

http://form-ui-340.reychohica.com/

http://embed-form-into-outlook.reychohica.com/

http://atf-form-3400.reychohica.com/

http://human-art-form-photo.reychohica.com/

http://event-feedback-form.reychohica.com/

http://code-email-form-html.reychohica.com/

http://irs-2290-form.reychohica.com/

http://bcbs-claim-form.reychohica.com/

http://dot-form-hs-7.reychohica.com/

http://signed-document-notification-form.reychohica.com/

http://online-fill-in-tax-form.reychohica.com/

http://consent-form-thesis.reychohica.com/

http://post-form-script-free.reychohica.com/

http://form-d20.reychohica.com/

http://walkathon-sponsor-form.reychohica.com/

http://verification-form.reychohica.com/

http://how-to-download-form.reychohica.com/

http://hi-vol-sampling-form.reychohica.com/

http://estate-form-real-tampa.reychohica.com/

http://filing-form-1099-misc.reychohica.com/

http://movie-critique-form.reychohica.com/

http://nys-withholding-form.reychohica.com/

http://louisiana-oath-of-office-form.reychohica.com/

http://files-form-sp4.reychohica.com/

http://generic-form-of-cartia.reychohica.com/

http://wi-homestead-tax-form.reychohica.com/

http://small-business-notes-the-legal-form.reychohica.com/

http://autopsy-consent-form.reychohica.com/

http://element-in-pure-form.reychohica.com/

http://printing-w2-form-online.reychohica.com/

http://reference-form-letter.reychohica.com/

http://form-irs-1099.reychohica.com/

http://gmac-claim-form.reychohica.com/


http://resumae-form.tebdigasbi.com/

http://free-online-form-software.tebdigasbi.com/

http://form-microsoft-access.tebdigasbi.com/

http://racing-form-guides.tebdigasbi.com/

http://estimate-form-for-builder.tebdigasbi.com/

http://ruby-form.tebdigasbi.com/

http://irs-941-form.tebdigasbi.com/

http://form-all.tebdigasbi.com/

http://field-form-java-script.tebdigasbi.com/

http://form-pro-review-treadmill.tebdigasbi.com/

http://free-auto-maintenance-form.tebdigasbi.com/

http://scantron-test-form.tebdigasbi.com/

http://form-760-adj.tebdigasbi.com/

http://concrete-form-info-insulated.tebdigasbi.com/

http://cincinnati-tax-form.tebdigasbi.com/

http://library-evaluation-form.tebdigasbi.com/

http://application-form-template.tebdigasbi.com/

http://windows-form-datagrid-control.tebdigasbi.com/

http://form-values.tebdigasbi.com/

http://appoinment-schedule-form.tebdigasbi.com/

http://ajax-form-processing.tebdigasbi.com/

http://connecticut-tax-form-2210.tebdigasbi.com/

http://cms-form-339.tebdigasbi.com/

http://pdf-form-templates.tebdigasbi.com/

http://form-herritage.tebdigasbi.com/

http://free-work-order-request-form.tebdigasbi.com/

http://alien-lifer-form.tebdigasbi.com/

http://illinois-irs-tax-form.tebdigasbi.com/

http://employers-form.tebdigasbi.com/

http://software-problem-report-form.tebdigasbi.com/

http://form-radio-button.tebdigasbi.com/

http://bill-of-sale-business-form.tebdigasbi.com/

http://construction-release-of-lien-form.tebdigasbi.com/

http://md-tax-form-2004.tebdigasbi.com/

http://form-b4.tebdigasbi.com/

http://calfironia-marital-settlement-form.tebdigasbi.com/

http://true-to-form-by-elizabeth-berg.tebdigasbi.com/

http://partnership-form.tebdigasbi.com/

http://maxima-form.tebdigasbi.com/

http://civil-form-lawsuit.tebdigasbi.com/

http://building-a-simons-concrete-form.tebdigasbi.com/

http://irs-1040a-form.tebdigasbi.com/

http://washer-form-b.tebdigasbi.com/

http://meeting-planning-form.tebdigasbi.com/

http://arkansas-voter-registration-form.tebdigasbi.com/

http://us-passport-application-form-uk.tebdigasbi.com/

http://hereford-sixth-form-college-jobs.tebdigasbi.com/

http://uk-greyhound-form.tebdigasbi.com/

http://irs-tax-form-extention.tebdigasbi.com/

http://appilcation-form.tebdigasbi.com/

http://schedule-e-form.tebdigasbi.com/

http://volcanoes-how-they-form.tebdigasbi.com/

http://ea-form.tebdigasbi.com/

http://form-8109-deposit-coupon.tebdigasbi.com/

http://attorney-form-free-landlord.tebdigasbi.com/

http://1040-booklet-form-instruction.tebdigasbi.com/

http://access-center-form-microsoft.tebdigasbi.com/

http://sand-form-concrete.tebdigasbi.com/

http://uk-e111-form.tebdigasbi.com/

http://form-sf.tebdigasbi.com/

http://form-nc-w4.tebdigasbi.com/

http://form-motor-credit.tebdigasbi.com/

http://form-processor-pro-free-download.tebdigasbi.com/

http://plato-form-good.tebdigasbi.com/

http://instant-poem-form.tebdigasbi.com/

http://insurance-application-form.tebdigasbi.com/

http://php-post-form-tutorial.tebdigasbi.com/

http://return-of-service-form.tebdigasbi.com/

http://firearm-free-legal-form.tebdigasbi.com/

http://mantle-form.tebdigasbi.com/

http://scion-form.tebdigasbi.com/

http://putting-on-a-breast-form.tebdigasbi.com/

http://how-petroleum-form.tebdigasbi.com/

http://poor-form-design.tebdigasbi.com/

http://mt-form.tebdigasbi.com/

http://correction-officer-application-form.tebdigasbi.com/

http://html-question-form.tebdigasbi.com/

http://funny-suggestion-form.tebdigasbi.com/

http://montana-legal-pleadings-form.tebdigasbi.com/

http://ohio-real-estate-closing-form.tebdigasbi.com/

http://form-itin-w7.tebdigasbi.com/

http://massachusetts-ez-tax-return-form.tebdigasbi.com/

http://math-grade-5-expanded-form.tebdigasbi.com/

http://nonresident-form-hawaii-vehicle.tebdigasbi.com/

http://escrow-form.tebdigasbi.com/

http://student-feedback-form.tebdigasbi.com/

http://php-form-handling-sample.tebdigasbi.com/

http://real-estate-listing-form.tebdigasbi.com/

http://form-keydown.tebdigasbi.com/

http://mail-form-results.tebdigasbi.com/

http://additional-child-credit-form-tax.tebdigasbi.com/

http://general-petition-form.tebdigasbi.com/

http://lottery-syndicate-agreement-form.tebdigasbi.com/

http://need-print-free-lease-form.tebdigasbi.com/

http://lesson-plan-blank-form.tebdigasbi.com/

http://latex-breast-form.tebdigasbi.com/

http://narrative-form-of-teaching.tebdigasbi.com/

http://musher-form.tebdigasbi.com/

http://proxy-form-template.tebdigasbi.com/

http://quote-form-to-send-to-vendors.tebdigasbi.com/


http://tax-form-8582-instructions.trodlocho.com/

http://arizona-tax-form-a-4.trodlocho.com/

http://mcd-property-tax-form.trodlocho.com/

http://income-tax-form-information.trodlocho.com/

http://d-400-nc-tax-form.trodlocho.com/

http://food-tax-form.trodlocho.com/

http://md-state-tax-form.trodlocho.com/

http://irs-tax-form-8621.trodlocho.com/

http://tax-form-1120-instructions.trodlocho.com/

http://pennsylvania-tax-form-pa100.trodlocho.com/

http://wal-mart-w2-tax-form.trodlocho.com/

http://irs-tax-form-104a.trodlocho.com/

http://free-1099-tax-form-nevada.trodlocho.com/

http://540ez-tax-form-instructions.trodlocho.com/

http://state-of-maine-tax-form.trodlocho.com/

http://1040a-tax-form-printable.trodlocho.com/

http://irs-tax-form-1040a.trodlocho.com/

http://nys-tax-form-it-272.trodlocho.com/

http://fed-tax-form-8863.trodlocho.com/

http://federal-payroll-tax-form.trodlocho.com/

http://turbo-tax-form-5498.trodlocho.com/

http://child-release-tax-form.trodlocho.com/

http://income-tax-form-schedule-a.trodlocho.com/

http://irs-tax-form-2441.trodlocho.com/

http://pa-state-income-tax-form.trodlocho.com/

http://5329-tax-form-instructions.trodlocho.com/

http://hawaii-income-tax-form.trodlocho.com/

http://federal-estate-tax-form.trodlocho.com/

http://oregon-non-resident-tax-form.trodlocho.com/

http://conneticut-state-tax-form-withholding.trodlocho.com/

http://nc-income-tax-form-d-400.trodlocho.com/

http://w-4-tax-form.trodlocho.com/

http://illinois-estimated-tax-form.trodlocho.com/

http://of-cincinnati-tax-form.trodlocho.com/

http://state-of-michigan-individual-tax-form.trodlocho.com/

http://federal-tax-form-for-2007.trodlocho.com/

http://tax-form-ids.trodlocho.com/

http://new-york-city-income-tax-form.trodlocho.com/

http://federal-tax-1099-form.trodlocho.com/

http://download-federal-form-tax.trodlocho.com/

http://2005-form-free-tax.trodlocho.com/

http://fill-form-income-tax.trodlocho.com/

http://income-tax-1040-form.trodlocho.com/

http://tax-mass-form-w2.trodlocho.com/

http://2002-form-maine-tax.trodlocho.com/

http://1040-dog-form.trodlocho.com/

http://form-idaho-income-tax.trodlocho.com/

http://1-form-k-schedule-tax.trodlocho.com/

http://2005-form-michigan-tax.trodlocho.com/

http://saral-form-for-income-tax.trodlocho.com/

http://taxes-ez-form.trodlocho.com/

http://maryland-502-form.trodlocho.com/

http://gambling-income-irs-form.trodlocho.com/

http://form-16-a-income-tax.trodlocho.com/

http://form-945-tax-period.trodlocho.com/

http://2008-tax-exemtion-form.trodlocho.com/

http://service-tax-return-form.trodlocho.com/

http://form-d-400-instructions.trodlocho.com/

http://sc-1040-form.trodlocho.com/

http://dependent-form-income-tax.trodlocho.com/

http://form-poster-return-tax-unique.trodlocho.com/

http://w-4-tax-exempt-form.trodlocho.com/

http://il-1040ez-form.trodlocho.com/

http://form-8863-irs.trodlocho.com/

http://pa-form-276-online-payment.trodlocho.com/

http://irs-stock-form.trodlocho.com/

http://1040-schedule-a-b-form.trodlocho.com/

http://filling-out-irs-form-982.trodlocho.com/

http://irs-printable-form.trodlocho.com/

http://free-4506-irs-form.trodlocho.com/

http://form-injured-spouse.trodlocho.com/

http://t4-summary-form-download.trodlocho.com/

http://form-1040-amended.trodlocho.com/

http://what-is-a-k-1-form.trodlocho.com/

http://federal-form-8283.trodlocho.com/

http://2002-delaware-form-tax.trodlocho.com/

http://colorado-tax-return-form.trodlocho.com/

http://printable-form-5695.trodlocho.com/

http://schedule-d-irs-form.trodlocho.com/

http://georgia-w4-form.trodlocho.com/

http://filing-a-missed-1099-form.trodlocho.com/

http://w9-form-download-for-free.trodlocho.com/

http://wi-w-4-form.trodlocho.com/

http://irs-form-491.trodlocho.com/

http://form-4868-e-file.trodlocho.com/

http://form-1099-generation.trodlocho.com/

http://sc-probate-court-form-706.trodlocho.com/

http://state-of-ohio-w4-form.trodlocho.com/

http://irs-form-463.trodlocho.com/

http://form-1040-schedules.trodlocho.com/

http://franchise-tax-board-form-1131.trodlocho.com/

http://government-form-w9.trodlocho.com/

http://canada-gst-tax-refund-form.trodlocho.com/

http://order-w2-form-online.trodlocho.com/

http://how-to-complete-form-540x.trodlocho.com/

http://de-3-form-from-the-irs.trodlocho.com/

http://irs-form-2441.trodlocho.com/

http://form-8582-instructions.trodlocho.com/

http://nc-form-478.trodlocho.com/

http://1099-form-instructions.trodlocho.com/


http://free-irs-printable-tax-forms.fiter29i161.myftpsite.net/

http://free-printable-blank-1099-tax-forms.filer29i137.myftpsite.net/

http://1040a-printable-tax-forms.filer29i137.myftpsite.net/

http://printable-online-1099-tax-forms.fiter29i161.myftpsite.net/

http://printable-az-tax-forms.filer29i158.myftpsite.net/

http://printable-e-file-tax-forms.fiter29i158.myftpsite.net/

http://oklahoma-printable-income-tax-forms.filer29i143.myftpsite.net/

http://printable-irs-tax-forms.fiter29i149.myftpsite.net/

http://printable-state-tax-return-printable-forms.fiter29i155.myftpsite.net/

http://form-free-printable-tax.fiter29i158.myftpsite.net/

http://us-tax-forms-printable.filer29i134.myftpsite.net/

http://printable-oklahoma-state-tax-forms.fiter29i143.myftpsite.net/

http://free-printable-income-forms.fiter29i158.myftpsite.net/

http://printable-1040-ez-tax-forms.fiter29i161.myftpsite.net/

http://free-irs-printable-forms.fiter29i137.myftpsite.net/

http://free-printable-w2-tax-forms.filer29i137.myftpsite.net/

http://1040-ez-tax-printable.fiter29i149.myftpsite.net/

http://mississippi-state-income-tax-printable-forms.fiter29i158.myftpsite.net/

http://state-of-missouri-printable-forms.fiter29i143.myftpsite.net/

http://1040-ez-printable-forms.fiter29i140.myftpsite.net/

http://printable-1040-ez-form.fiter29i158.myftpsite.net/

http://10-40ez-tax-form-printable.fiter29i158.myftpsite.net/

http://blank-printable-1040-ez-form.filer29i155.myftpsite.net/

http://printable-tax-preparation-checklist.fiter29i161.myftpsite.net/

http://free-business-forms-blank-printable.filer29i143.myftpsite.net/

http://free-printable-employee-forms.filer29i158.myftpsite.net/

http://free-forms-printables.fiter29i143.myftpsite.net/

http://statement-printable-forms-for-free.filer29i158.myftpsite.net/

http://monroe-mi-dhs-printable-forms.fiter29i131.myftpsite.net/

http://1040ez-printable-form-irs.fiter29i149.myftpsite.net/

http://free-printable-volunteer-waiver-forms.fiter29i143.myftpsite.net/

http://free-printable-stock-market-forms.filer29i161.myftpsite.net/

http://printable-2007-nba-mock-draft.fiter29i143.myftpsite.net/

http://printable-michigan-i-9-employment-forms.fiter29i149.myftpsite.net/

http://free-printable-liability-contracts.filer29i134.myftpsite.net/

http://free-printable-waiver-of-damages-form.fiter29i143.myftpsite.net/

http://free-2008-printable-tax-forms.fiter29i161.myftpsite.net/

http://free-printable-worksheets-for-kindergardners.fiter29i158.myftpsite.net/

http://1040ez-printable-tax-forms-for-2006.filer29i146.myftpsite.net/

http://free-printable-tennessee-2005-tax-forms.fiter29i143.myftpsite.net/

http://free-printable-schedule-b.fiter29i161.myftpsite.net/

http://2008-whole-year-free-printable-calender.fiter29i158.myftpsite.net/

http://gok.jujas.myftpsite.net/?e-post-printable-form

http://free-printable-symmetric-shapes.fiter29i161.myftpsite.net/

http://printable-weegie-board.fiter29i128.myftpsite.net/

http://printable-blank-bill-of-sale.fiter29i161.myftpsite.net/

http://free-printable-living-wills-for-canada.fiter29i137.myftpsite.net/

http://free-online-printable-graduation-annoucements.filer29i143.myftpsite.net/

http://free-december-calendar-printable.fiter29i161.myftpsite.net/

http://free-printable-valentines-word-searches.fiter29i161.myftpsite.net/

http://marlboro-cigarette-coupons-printable-online.fiter29i146.myftpsite.net/

http://free-printable-daily-planner-fufu.filer29i158.myftpsite.net/

http://free-printable-humorous-greeting-cards.fiter29i155.myftpsite.net/

http://free-printable-border-art.fiter29i161.myftpsite.net/

http://fun-printable-kid-games.filer29i146.myftpsite.net/

http://printable-pre-writing-worksheets.filer29i137.myftpsite.net/

http://color-a-house-printable.fiter29i155.myftpsite.net/

http://communication-log-printable-free.filer29i158.myftpsite.net/

http://printable-space-puzzles.fiter29i155.myftpsite.net/

http://printable-reserved-table-cards.fiter29i137.myftpsite.net/

http://printable-pictures-of-alaska.fiter29i137.myftpsite.net/

http://printable-folkart-patterns.fiter29i161.myftpsite.net/

http://printable-papa-john-s-pizza-coupons.filer29i143.myftpsite.net/

http://printable-black-and-white-love-notes.filer29i143.myftpsite.net/

http://blue-springs-missouri-printable-coupons.fiter29i137.myftpsite.net/


http://printable-tax-forms-1099.filer29i153.dns2go.com/

http://i-need-printable-tax-forms.filer29i156.dns2go.com/

http://printable-1040a-tax-forms.fiter29i138.dns2go.com/

http://printable-tax-forms-w9.fiter29i132.dns2go.com/

http://printable-federal-income-tax-forms.filer29i129.dns2go.com/

http://printable-tax-forms-online.fiter29i138.dns2go.com/

http://printable-online-w2-tax-forms.filer29i159.dns2go.com/

http://printable-tax-forms-1099.filer29i135.dns2go.com/

http://free-printable-sales-tax-forms.fiter29i162.dns2go.com/

http://printable-tax-forms-1099-misc.filer29i159.dns2go.com/

http://printable-federal-and-state-tax-forms.fiter29i156.dns2go.com/

http://printable-federal-tax-forms-and-instructions.filer29i156.dns2go.com/

http://printable-michigan-tax-forms.filer29i129.dns2go.com/

http://printable-income-tax-forms-w-2.fiter29i162.dns2go.com/

http://free-printable-tax-expense-sheet.filer29i153.dns2go.com/

http://printable-free-tax-form.fiter29i141.dns2go.com/

http://form-irs-printable-tax.fiter29i141.dns2go.com/

http://printable-irs-forms.filer29i150.dns2go.com/

http://1040-easy-tax-form-printable.fiter29i138.dns2go.com/

http://state-of-missouri-printable-forms.fiter29i156.dns2go.com/

http://printable-tax-deduction-checklist.fiter29i153.dns2go.com/

http://printable-federal-tax-form-1040a.fiter29i132.dns2go.com/

http://free-printable-1040-ez.fiter29i144.dns2go.com/

http://blank-printable-1040ez-form.fiter29i132.dns2go.com/

http://printable-tax-deduction-checklist.fiter29i144.dns2go.com/

http://printable-federal-1040a-tax-form.filer29i138.dns2go.com/

http://free-printable-investment-forms.fiter29i144.dns2go.com/

http://1040-ez-free-printable.fiter29i141.dns2go.com/

http://free-printable-1099.filer29i135.dns2go.com/

http://state-of-missouri-printable-forms.filer29i156.dns2go.com/

http://printable-current-1040a-tax-form.filer29i162.dns2go.com/

http://irs-form-1040-printable.fiter29i156.dns2go.com/

http://free-printable-michigan-1040.fiter29i153.dns2go.com/

http://free-printable-information-release-forms.fiter29i132.dns2go.com/

http://free-printable-1040a-form.filer29i153.dns2go.com/

http://free-printable-w2.filer29i135.dns2go.com/

http://free-printable-accounting-forms.filer29i129.dns2go.com/

http://printable-1099-form.filer29i138.dns2go.com/

http://rita-s-printable-coupons-columbus.filer29i150.dns2go.com/

http://free-forms-printables.fiter29i141.dns2go.com/

http://printable-philippine-nso-forms.filer29i156.dns2go.com/

http://free-printable-blank-forms.filer29i147.dns2go.com/

http://printable-lesson-plan-forms.filer29i156.dns2go.com/

http://printable-tax-papers.fiter29i132.dns2go.com/

http://free-printable-financial-forms.filer29i153.dns2go.com/

http://printable-wedding-inviations-striped.fiter29i144.dns2go.com/

http://fps-printable-booklets.fiter29i144.dns2go.com/

http://free-printable-niece-christmas-stationary.fiter29i153.dns2go.com/

http://emergency-medical-release-printable-form.filer29i153.dns2go.com/

http://rita-s-printable-coupons-columbus.fiter29i144.dns2go.com/

http://free-printable-substitution-worksheets.fiter29i138.dns2go.com/

http://free-printable-general-application.fiter29i132.dns2go.com/

http://printable-cake-forms.fiter29i141.dns2go.com/

http://printable-tax-forms-2008.filer29i135.dns2go.com/

http://feww-printable-worksheets.fiter29i141.dns2go.com/

http://free-2008-printable-tax-forms.filer29i156.dns2go.com/

http://printable-guardianship-forms.filer29i162.dns2go.com/

http://10-40-ez-form-printable.fiter29i162.dns2go.com/

http://free-printable-1099-forms-2006.filer29i141.dns2go.com/

http://printable-2007-employee-tax-forms.fiter29i156.dns2go.com/

http://printable-irs-w-9-forms-2007.fiter29i132.dns2go.com/

http://free-printable-disclosure-statement.filer29i150.dns2go.com/

http://free-printable-1040ez-2007-tax-form.filer29i153.dns2go.com/

http://printable-weegie-board.filer29i150.dns2go.com/

http://lizzie-bright-free-online-printable-quizzes.fiter29i153.dns2go.com/

http://printable-saduko-pages.fiter29i132.dns2go.com/

http://free-printable-instruction-booklets.fiter29i144.dns2go.com/

http://printable-picture-of-alaska-s-state-bird.fiter29i132.dns2go.com/

http://christian-trumpet-printable-music-sheets.fiter29i138.dns2go.com/

http://free-printable-elementary-work-sheets.filer29i159.dns2go.com/

http://printable-timeline-of-life-on-earth.filer29i159.dns2go.com/

http://printable-thomas-invitations.filer29i135.dns2go.com/

http://printable-coloring-pages-of-pirate-ship.filer29i159.dns2go.com/

http://printable-label-sheets.filer29i153.dns2go.com/

http://free-printable-calendars-for-2010.fiter29i138.dns2go.com/

http://printable-noah-cake-stencil.filer29i150.dns2go.com/

http://printable-coupon-for-fantastic-sam-s.filer29i156.dns2go.com/

http://printable-rebate-form-for-shell-oil.filer29i159.dns2go.com/

http://earth-day-coloring-page-printable.filer29i156.dns2go.com/

http://printable-4th-grade-language-worksheets.fiter29i138.dns2go.com/

http://printable-listing-website-neighborhoods-top-traffic.fiter29i138.dns2go.com/

http://yellowstone-printable-map.fiter29i132.dns2go.com/

http://fee-printable-suduko.filer29i135.dns2go.com/

http://free-printable-tarot-decks.filer29i153.dns2go.com/

http://printable-new-jersey-maps.filer29i156.dns2go.com/

http://letter-w-printables.filer29i135.dns2go.com/


http://printable-tax-forms-ohio.filer29i151.dynodns.net/

http://free-printable-tax-forms-1099.fiter29i142.dynodns.net/

http://free-printable-online-1040-tax-forms.filer29i139.dynodns.net/

http://printable-irs-tax-forms-w-9.filer29i133.dynodns.net/

http://ohio-printable-state-tax-forms.filer29i136.dynodns.net/

http://printable-federal-tax-forms-and-instructions.filer29i136.dynodns.net/

http://ohio-printable-state-tax-forms.fiter29i148.dynodns.net/

http://printable-w-4-tax-forms.fiter29i127.dynodns.net/

http://printable-tax-forms-401c3.fiter29i130.dynodns.net/

http://iowa-tax-forms-printable.filer29i154.dynodns.net/

http://free-irs-printable-forms.fiter29i127.dynodns.net/

http://printable-tax-form-1040ez.filer29i151.dynodns.net/

http://1040ez-printable-income-tax-form.filer29i148.dynodns.net/

http://printable-tax-tables.fiter29i130.dynodns.net/

http://printable-1040-ez-forms.fiter29i139.dynodns.net/

http://1040-printable-tax-form.fiter29i145.dynodns.net/

http://printable-1040-federal-tax-form.fiter29i139.dynodns.net/

http://1040ez-printable-income-tax-form.filer29i154.dynodns.net/

http://blank-printable-1040a-tax-form.fiter29i139.dynodns.net/

http://i-r-s-printable-forms.fiter29i133.dynodns.net/

http://free-printable-aia-forms-g702.fiter29i133.dynodns.net/

http://printable-tax-form-1040.fiter29i133.dynodns.net/

http://1040-easy-tax-form-printable.fiter29i160.dynodns.net/

http://online-printable-medical-forms.filer29i139.dynodns.net/

http://free-printable-contractor-forms.fiter29i127.dynodns.net/

http://1040-ez-printable-form.fiter29i127.dynodns.net/

http://free-printable-cryptoquote.fiter29i130.dynodns.net/

http://free-printable-cover-letter-forms.filer29i142.dynodns.net/

http://2008-printable-1040ez.filer29i139.dynodns.net/

http://free-printable-1040a-form.fiter29i151.dynodns.net/

http://free-printable-office-forms.fiter29i145.dynodns.net/

http://free-printable-cryptoquote.filer29i142.dynodns.net/

http://free-printable-income-verification-forms.fiter29i160.dynodns.net/

http://free-printable-forms-and-checklists.fiter29i142.dynodns.net/

http://free-printable-irs-form-1040a.fiter29i157.dynodns.net/

http://free-printable-accounting-forms.filer29i157.dynodns.net/

http://irs-printable-form.fiter29i130.dynodns.net/

http://free-printable-disney-love-scene-pictures.fiter29i145.dynodns.net/

http://printable-bookkeeping-forms.fiter29i160.dynodns.net/

http://printable-general-ledger-forms.fiter29i133.dynodns.net/

http://divorce-form-free-printable.fiter29i160.dynodns.net/

http://printable-cake-forms.fiter29i130.dynodns.net/

http://printable-ct-1040.fiter29i133.dynodns.net/

http://free-printable-loss-of-wages-form.fiter29i142.dynodns.net/

http://christian-trumpet-printable-music-sheets.fiter29i133.dynodns.net/

http://free-printable-2009-corvette-calendar.filer29i157.dynodns.net/

http://job-ledger-forms-printable.filer29i148.dynodns.net/

http://medco-printable-perscription-forms.filer29i142.dynodns.net/

http://blank-printable-info-form.fiter29i130.dynodns.net/

http://valetine-tractor-printable.filer29i142.dynodns.net/

http://printable-saduko-pages.filer29i136.dynodns.net/

http://2008-whole-year-free-printable-calender.fiter29i139.dynodns.net/

http://ri-1040ez-2007-printable-tax-forms.fiter29i139.dynodns.net/

http://free-printable-disclosure-statement.fiter29i145.dynodns.net/

http://1040-x-tax-form-2006-printable.fiter29i133.dynodns.net/

http://free-printable-medical-brochures.fiter29i160.dynodns.net/

http://free-printable-sudoku-worksheets.fiter29i139.dynodns.net/

http://free-printable-religion-quiz-worksheets.fiter29i127.dynodns.net/

http://printable-commitment-certificate.fiter29i148.dynodns.net/

http://free-printable-thanksgiving-clip-art.fiter29i142.dynodns.net/

http://printable-check-for-kids.fiter29i130.dynodns.net/

http://printable-flascards-in-multiplication.fiter29i142.dynodns.net/

http://coloring-and-parrot-and-printable.fiter29i142.dynodns.net/

http://printable-catalog-paper.fiter29i139.dynodns.net/

http://free-printable-lapbooks.filer29i151.dynodns.net/

http://oedipus-at-colonus-printable.filer29i151.dynodns.net/

http://birthday-printable-pages.fiter29i151.dynodns.net/

http://free-coloring-opages-printables.filer29i157.dynodns.net/

http://learning-colors-free-printables.fiter29i127.dynodns.net/

Stay tuned!

Continue reading →

Historical OSINT - Massive Blackhat SEO Campaign Spotted in the Wild Serves Scareware

October 22, 2018
It's 2010 and I've recently stumbled upon a currently active and circulating malicious and fraudulent blackhat SEO campaign successfully enticing hundreds of thousands globally into interacting with a multi-tude of rogue and malicious software also known as scareware.

In this post I'll profile the campaign discuss in-depth the tactics techniques and procedures of the cybercriminals behind it and provide actionable intelligence on the infrastructure behind it.

Related malicious domains known to have participated in the campaign:
hxxp://ozeqiod.cn?uid=213 - redirector - 64.86.25.201 - hxxp://bexwuq.cn

Sample URL redirection chain:
hxxp://ymarketcoms.cn/?pid=123

Related malicious domains known to have responded to the same malicious C&C server IPs (64.86.25.201):
hxxp://bombas101.com
hxxp://trhtrtrbtrtbtb.com
hxxp://opensearch-zone.com
hxxp://imaera.cn
hxxp://ariexa.cn
hxxp://ozeqiod.cn
hxxp://ariysle.cn
hxxp://ajegif.cn
hxxp://adiyki.cn
hxxp://acaisek.cn
hxxp://yvamuer.cn
hxxp://protectinstructor.cn
hxxp://blanshinblansh.net
hxxp://kostinporest.net

Related malicious domains known to have participated in the campaign:
hxxp://azikyxa.cn
hxxp://befaqki.cn
hxxp://ataini.cn
hxxp://atoycri.cn
hxxp://bimpuj.cn
hxxp://bekajop.cn
hxxp://bexwuq.cn
hxxp://azywoax.cn
hxxp://azaijy.cn

We'll continue monitoring the campaign and post updates as soon as new developments take place. Continue reading →

Historical OSINT - A Diversified Portfolio of Fake Security Software Spotted in the Wild

October 22, 2018
It's 2010 and I've recently stumbled upon yet another malicious and fraudulent domain portfolio serving a variety of fake security software also known as scareware potentially exposing hundreds of thousands of users to a variety of fake security software with the cybercriminals behind the campaign potentially earning fraudulent revenue largely relying on the utilization of an affiliate-network based type of revenue-sharing scheme.

Related malicious domains known to have participated in the campaign:
hxxp://50virus-scanner.com
hxxp://700virus-scanner.com
hxxp://antivirus-test66.com
hxxp://antivirus200scanner.com
hxxp://antivirus600scanner.com
hxxp://antivirus800scanner.com
hxxp://antivirus900scanner.com
hxxp://av-scanner200.com
hxxp://av-scanner300.com
hxxp://av-scanner400.com
hxxp://av-scanner500.com
hxxp://inetproscan031.com
hxxp://internet-scan020.com
hxxp://novirus-scan00.com
hxxp://stopvirus-scan11.com
hxxp://stopvirus-scan13.com
hxxp://stopvirus-scan16.com
hxxp://stopvirus-scan33.com
hxxp://virus66scanner.com
hxxp://virus77scanner.com
hxxp://virus88scanner.com
hxxp://antivirus-scan200.com
hxxp://antispy-scan200.com
hxxp://av-scanner200.com
hxxp://av-scanner300.com
hxxp://antivirus-scan400.com
hxxp://antispy-scan400.com
hxxp://av-scanner400.com
hxxp://av-scanner500.com
hxxp://antivirus-scan600.com
hxxp://antispy-scan600.com
hxxp://antivirus-scan700.com
hxxp://antispy-scan700.com
hxxp://av-scanner700.com
hxxp://antispy-scan800.com
hxxp://antivirus-scan900.com
hxxp://novirus-scan00.com
hxxp://stop-virus-010.com
hxxp://spywarescan010.com

Related malicious domains known to have participated in the campaign:
hxxp://antispywarehelp010.com
hxxp://internet-scan020.com
hxxp://internet-scanner020.com
hxxp://insight-scan20.com
hxxp://internet-scanner030.com
hxxp://stop-virus-040.com
hxxp://internet-scan040.com
hxxp://insight-scan40.com
hxxp://internet-scan050.com
hxxp://internet-scanner050.com
hxxp://insight-scan60.com
hxxp://stop-virus-070.com
hxxp://internet-scan070.com
hxxp://internet-scanner070.com
hxxp://insight-scan80.com
hxxp://stop-virus-090.com
hxxp://internet-scan090.com
hxxp://internet-scanner090.com
hxxp://insight-scan90.com
hxxp://antispywarehelpk0.com
hxxp://inetproscan001.com
hxxp://novirus-scan01.com
hxxp://spyware-stop01.com
hxxp://antivirus-inet01.com
hxxp://stopvirus-scan11.com
hxxp://inetproscan031.com
hxxp://novirus-scan31.com
hxxp://antivirus-inet31.com
hxxp://novirus-scan41.com
hxxp://antivirus-inet41.com
hxxp://antivirus-inet51.com
hxxp://inetproscan061.com
hxxp://novirus-scan61.com

Related malicious domains known to have participated in the campaign:
hxxp://inetproscan081.com
hxxp://novirus-scan81.com
hxxp://inetproscan091.com
hxxp://spyware-stopb1.com
hxxp://spyware-stopm1.com
hxxp://spyware-stopn1.com
hxxp://spyware-stopz1.com
hxxp://antispywarehelp002.com
hxxp://antispywarehelp022.com
hxxp://novirus-scan22.com
hxxp://antispywarehelpk2.com
hxxp://insight-scanner2.com
hxxp://spywarescan013.com
hxxp://stopvirus-scan13.com
hxxp://novirus-scan33.com
hxxp://stopvirus-scan33.com
hxxp://antispywarehelp004.com
hxxp://antispywarehelpk4.com
hxxp://spywarescan015.com
hxxp://novirus-scan55.com
hxxp://insight-scanner5.com
hxxp://stopvirus-scan16.com
hxxp://stopvirus-scan66.com
hxxp://antispywarehelpk6.com
hxxp://spywarescan017.com
hxxp://insight-scanner7.com
hxxp://antispywarehelp008.com
hxxp://spywarescan018.com
hxxp://stopvirus-scan18.com
hxxp://novirus-scan88.com
hxxp://stopvirus-scan88.com
hxxp://antivirus-test88.com
hxxp://antispywarehelpk8.com
hxxp://insight-scanner8.com
hxxp://insight-scanner9.com

Related malicious domains known to have participated in the campaign:
hxxp://10scanantispyware.com
hxxp://20scanantispyware.com
hxxp://30scanantispyware.com
hxxp://60scanantispyware.com
hxxp://80scanantispyware.com
hxxp://2scanantispyware.com
hxxp://3scanantispyware.com
hxxp://5scanantispyware.com
hxxp://7scanantispyware.com
hxxp://8scanantispyware.com
hxxp://spyware200scan.com
hxxp://spyware500scan.com
hxxp://spyware800scan.com
hxxp://spyware880scan.com
hxxp://50virus-scanner.com
hxxp://90virus-scanner.com
hxxp://antivirus900scanner.com
hxxp://antivirus10scanner.com
hxxp://virus77scanner.com
hxxp://virus88scanner.com
hxxp://net001antivirus.com
hxxp://net011antivirus.com
hxxp://net111antivirus.com
hxxp://net021antivirus.com
hxxp://net-02antivirus.com
hxxp://net222antivirus.com
hxxp://net-04antivirus.com
hxxp://net-05antivirus.com
hxxp://net-07antivirus.com

We'll continue monitoring the campaign and post updates as soon as new developments take place. Continue reading →

Historical OSINT - A Diversified Portfolio of Fake Security Software

October 22, 2018
It's 2010 and I've recently stumbled upon a currently active and circulating malicious and fraudulent porfolio of fake security software also known as scareware potentially enticing hundreds of thousands of users to a multi-tude of malicious software with the cybercriminals behind the campaign potentially earning fraudulent revenue in the process of monetizing access to malware-infected hosts largely relying on the utilization of an affiliate network-based type of revenue sharing scheme.

Related malicious domains known to have participated in the campaign:
hxxp://thebest-antivirus00.com - 91.212.226.203; 94.228.209.195
hxxp://virusscannerpro0.com
hxxp://lightandfastscanner01.com
hxxp://thebest-antivirus01.com
hxxp://thebestantivirus01.com
hxxp://remove-spyware-11.com
hxxp://remove-virus-11.com
hxxp://thebest-antivirus11.com
hxxp://antispyware-module1.com
hxxp://antispywaremodule1.com
hxxp://antivirus-toolsr1.com
hxxp://thebest-antivirus1.com
hxxp://thebest-antivirusx1.com
hxxp://thebestantivirus02.com
hxxp://remove-spyware-12.com
hxxp://remove-virus-12.com
hxxp://delete-all-virus-22.com
hxxp://lightandfastscanner22.com
hxxp://prosecureprotection2.com
hxxp://virusscannerpro2.com
hxxp://antivirus-toolsr2.com
hxxp://thebest-antivirusx2.com
hxxp://thebestantivirus03.com
hxxp://remove-spyware-13.com
hxxp://remove-virus-13.com
hxxp://antispyware-module3.com
hxxp://antispywaremodule3.com
hxxp://virusscannerpro3.com
hxxp://windowsantivirusserver3.com
hxxp://thebest-antivirusx3.com
hxxp://thebestantivirus04.com
hxxp://remove-spyware-14.com
hxxp://remove-virus-14.com
hxxp://antispyware-scann4.com
hxxp://antivirus-toolsr4.com
hxxp://thebest-antivirusx4.com
hxxp://thebestantivirus05.com
hxxp://remove-all-spyware-55.com
hxxp://delete-all-virus-55.com
hxxp://thebest-antivirusx5.com
hxxp://remove-spyware-16.com
hxxp://lightandfastscanner66.com
hxxp://antispywaremodule6.com
hxxp://antispyware-module7.com
hxxp://antispywaremodule7.com
hxxp://antivirus-toolsr7.com
hxxp://antispyware-scann8.com
hxxp://pro-secure-protection8.com
hxxp://windowsantivirusserver8.com
hxxp://antispyware-module9.com
hxxp://antispywaremodule9.com
hxxp://antispyware-scann9.com
hxxp://virusscannerpro9.com
hxxp://antivirus-toolsr9.com
hxxp://thebest-antivirus9.com
hxxp://antiviruspro1scan.com
hxxp://antiviruspro2scan.com
hxxp://antiviruspro7scan.com
hxxp://antiviruspro8scan.com
hxxp://antiviruspro9scan.com
hxxp://antispyware6sacnner.com
hxxp://antivirusv1tools.com
hxxp://antispyware10windows.com
hxxp://antispyware20windows.com
hxxp://antivirus-toolsvv.com
hxxp://remove-spyware-11.com
hxxp://remove-virus-11.com
hxxp://remove-spyware-12.com
hxxp://remove-virus-12.com
hxxp://delete-all-virus-22.com
hxxp://prosecureprotection2.com
hxxp://remove-spyware-13.com
hxxp://remove-virus-13.com
hxxp://windowsantivirusserver3.com
hxxp://remove-spyware-14.com
hxxp://remove-virus-14.com
hxxp://remove-all-spyware-55.com
hxxp://delete-all-virus-55.com
hxxp://remove-spyware-16.com
hxxp://pro-secure-protection8.com
hxxp://windowsantivirusserver8.com
hxxp://antivirus-toolsr9.com
hxxp://antivirusv1tools.com
hxxp://antispyware10windows.com
hxxp://antispyware20windows.com
hxxp://antivirus-toolsvv.com

Related malicious domains known to have participated in the campaign:
hxxp://run-antivirusscan0.com
hxxp://runantivirusscan0.com
hxxp://remove-spyware-11.com
hxxp://remove-virus-11.com
hxxp://run-virus-scanner1.com
hxxp://remove-spyware-12.com
hxxp://remove-virus-12.com
hxxp://delete-all-virus-22.com
hxxp://remove-spyware-13.com
hxxp://remove-virus-13.com
hxxp://runantivirusscan3.com
hxxp://run-virusscanner3.com
hxxp://remove-spyware-14.com
hxxp://remove-virus-14.com
hxxp://run-virusscanner4.com
hxxp://remove-virus-15.com
hxxp://remove-all-spyware-55.com
hxxp://delete-all-virus-55.com
hxxp://remove-spyware-16.com
hxxp://run-virus-scanner6.com
hxxp://run-virusscanner6.com
hxxp://runantivirusscan8.com
hxxp://run-virus-scanner8.com
hxxp://windowsantivirusserver8.com
hxxp://run-virus-scanner9.com
hxxp://run-virusscanner9.com

Related malicious domains known to have participated in the campaign:
hxxp://run-antivirusscan0.com
hxxp://run-antivirusscan1.com
hxxp://run-antivirusscan3.com
hxxp://run-antivirusscan6.com
hxxp://run-antivirusscan8.com
hxxp://runantivirusscan0.com
hxxp://runantivirusscan3.com
hxxp://runantivirusscan4.com
hxxp://runantivirusscan9.com
hxxp://securepro-antivirus1.com

Related malicious domains known to have participated in the campaign:
hxxp://anti-virus-system0.com
hxxp://run-antivirusscan0.com
hxxp://runantivirusscan0.com
hxxp://perform-antivirus-scan-1.com
hxxp://remove-spyware-11.com
hxxp://remove-virus-11.com
hxxp://antivirus-system1.com
hxxp://performspywarescan1.com
hxxp://run-virus-scanner1.com
hxxp://remove-spyware-12.com
hxxp://remove-virus-12.com
hxxp://delete-all-virus-22.com
hxxp://antivirus-scanner-3.com
hxxp://remove-spyware-13.com
hxxp://remove-virus-13.com
hxxp://runantivirusscan3.com
hxxp://run-virusscanner3.com
hxxp://remove-spyware-14.com
hxxp://remove-virus-14.com
hxxp://gloriousantivirus2014.com
hxxp://run-virusscanner4.com
hxxp://smart-pcscanner05.com
hxxp://remove-virus-15.com
hxxp://remove-all-spyware-55.com
hxxp://delete-all-virus-55.com
hxxp://perform-virus-scan5.com
hxxp://perform-antivirus-scan-6.com
hxxp://antivirus-scanner-6.com
hxxp://remove-spyware-16.com
hxxp://run-virus-scanner6.com
hxxp://run-virusscanner6.com
hxxp://antivirus-scan-server6.com
hxxp://perform-antivirus-scan-7.com
hxxp://perform-antivirus-test-7.com
hxxp://antivirus-win-system7.com
hxxp://antivirus-for-pc-8.com

Related malicious domains known to have participated in the campaign:
hxxp://perform-antivirus-scan-8.com
hxxp://perform-antivirus-test-8.com
hxxp://run-antivirusscan8.com
hxxp://runantivirusscan8.com
hxxp://run-virus-scanner8.com
hxxp://windowsantivirusserver8.com
hxxp://perform-antivirus-test-9.com
hxxp://perform-virus-scan9.com
hxxp://antispywareinfo9.com
hxxp://run-virus-scanner9.com
hxxp://run-virusscanner9.com
hxxp://antispyware06scan.com
hxxp://antispywareinfo9.com
hxxp://antivirus-for-pc-2.com
hxxp://antivirus-for-pc-4.com
hxxp://antivirus-for-pc-6.com
hxxp://antivirus-for-pc-8.com
hxxp://antiviruspro8scan.com
hxxp://extra-antivirus-scan1.com
hxxp://extra-security-scanb1.com
hxxp://run-antivirusscan0.com
hxxp://run-antivirusscan1.com
hxxp://run-antivirusscan3.com
hxxp://run-antivirusscan6.com
hxxp://run-antivirusscan8.com
hxxp://runantivirusscan0.com
hxxp://runantivirusscan3.com
hxxp://runantivirusscan4.com
hxxp://runantivirusscan9.com
hxxp://securepro-antivirus1.com
hxxp://super-scanner-2004.com
hxxp://top-rateanrivirus0.com
hxxp://topantimalware-scanner7.com

We'll continue monitoring the campaign and post updates as soon as new developments take place. Continue reading →

Historical OSINT - Yet Another Massive Blackhat SEO Campaign Spotted in the Wild Drops Scareware

October 21, 2018
It's 2010 and I've recently came across to a currently active malicious and fraudulent blackhat SEO campaign successfully enticing users into interacting with rogue and fraudulent scareware-serving malicious and fraudulent campaigns.

In this post I'll provide actionable intelligence on the infrastructure behind the campaign.

Related malicious domains known to have participated in the campaign:
hxxp://globals-advers.com
hxxp://alldiskscheck300.com
hxxp://multisearch1.com
hxxp://myfreespace3.com
hxxp://hottystars.com
hxxp://multilang1.com
hxxp://3gigabytes.com
hxxp://drivemedirect.com
hxxp://globala2.com
hxxp://teledisons.com
hxxp://theworldnews5.com
hxxp://virtualblog5.com
hxxp://grander5.com
hxxp://5starsblog.com
hxxp://globalreds.com
hxxp://global-advers.com
hxxp://ratemyblog1.com
hxxp://greatvideo3.com
hxxp://beginner2009.com
hxxp://fastwebway.com
hxxp://blazervips.com
hxxp://begin2009.com
hxxp://megatradetds0.com
hxxp://securedonlinewebspace.com
hxxp://proweb-info.com
hxxp://security-www-clicks.com
hxxp://updatedownloadlists.com
hxxp://styleonlyclicks.cn
hxxp://informationgohere.com
hxxp://world-click-service.com
hxxp://secutitypowerclicks.cn
hxxp://securedclickuser.cn/
hxxp://slickoverview.com
hxxp://viewyourclicks.com
hxxp://clickwww2.com
hxxp://clickadsystem.com
hxxp://becomepoweruser.cn
hxxp://clickoverridesystem.cn

Related malicious domains known to have participated in the campaign:
hxxp://protecteduser.cn
hxxp://internetprotectedweb.com/
hxxp://clicksadssystems.com
hxxp://whereismyclick.cn
hxxp://trustourclicks.cn
hxxp://goldenstarclick.cn
hxxp://defendedsystemuser.cn

Related malicious domains known to have participated in the campaign:
hxxp://drivemedirect.com
hxxp://virtualblog5.com
hxxp://fastwebway.com

We'll continue monitoring the campaign and post updates as soon as new developments take place. Continue reading →

Historical OSINT - Massive Blackhat SEO Campaign Spotted in the Wild Drops Scareware

October 21, 2018
It's 2010 and I've recently intercepted a currently active malicious and fraudulent blakchat SEO campaign successfully enticing users into interacting with rogue and fraudulent scareware-serving malicious and fraudulent campaigns.

In this post I'll profile the infrastructure behind the campaign and provide actionable intelligence on the infrastructure behind it.

Sample URL redirection chain:
hxxp://noticexsummary.com/re.php?lnk=1203597664 - 87.255.55.231
- hxxp://new-pdf-reader.com/1/promo/index.asp?aff=11677 - 66.207.172.196
= hxxps://secure-signupway.com/promo/join.aspx?siteid=3388

Related malicious domains known to have participated in the campaign:
hxxp://noticexsummary.com/

Related malicious domains known to have participated in the campaign:
hxxp://online-tv-on-your-pc.com/p2/index.asp?aff=11680&camp=unsub

We'll continue monitoring the campaign and post updates as soon as new developments take place. Continue reading →

Historical OSINT - Yet Another Massive Blackhat SEO Campaign Spotted in the Wild

October 21, 2018
It's 2010 and I've recently stumbled upon yet another diverse portfolio of blackhat SEO domains this time serving rogue security software also known as scareware to unsuspecting users with the cybercriminals behind the campaign successfully earning fraudulent revenue in the process of monetizing access to malware-infected hosts largely relying on the utilization of an affiliate-network based type of revenue sharing scheme.

In this post I'll profile the infrastructure behind the campaign and provide actionable intelligence on the infrastructure behind it.

Related malicious domains known to have participated in the campaign:
hxxp://arnalduatis.com
hxxp://batistaluciano.com
hxxp://bethemedia.net
hxxp://bride-beautiful.com
hxxp://burgessandsons.com
hxxp://carolinacane.com
hxxp://caulfieldband.com
hxxp://improvenewark.com
hxxp://marsmellow.info
hxxp://noodlesonline.com
hxxp://queenslumber.com
hxxp://thesolidwoodflooringcompany.com
hxxp://wirelessexpertise.com
hxxp://bigbangexpress.com
hxxp://bioresonantie.net
hxxp://clubipg.com
hxxp://djdior.com
hxxp://djektoyz.com
hxxp://getraenkepool.com
hxxp://hartmanpescar.com
hxxp://hetkaashuis.com
hxxp://menno.info
hxxp://pianoaccompanistcompetition.com
hxxp://soundwitness.org
hxxp:/strijkvrij.com Continue reading →

Historical OSINT - Massive Blackhat SEO Campaign Spotted in the Wild

October 21, 2018
It's 2008 and I recently came across to a pretty decent portfolio of rogue and fraudulent malicious scareware-serving domains successfully acquiring traffic through a variety of black hat SEO techniques in this particular case the airplane crash of the Polish president.

Related malicious domains known to have participated in the campaign:
hxxp://sarahscandies.com
hxxp://armadasur.com
hxxp://gayribisi.com
hxxp://composerjohnbeal.com
hxxp://preferredtempsinc.com
hxxp://ojaivalleyboys.com
hxxp://homelinkmag.com
hxxp://worldwidestones.com
hxxp://silsilaqasmia.com
hxxp://vidoemo.com
hxxp://channhu.com
hxxp://ideasenfoco.com

Related malicious domains known to have participated in the campaign:
hxxp://homeownersmoneysaver.com
hxxp://preferredtempsinc.com
hxxp://sarahscandies.com
hxxp://channhu.com
hxxp://intheclub.com
hxxp://internetcabinetsdirect.com
hxxp://silentservers.com
hxxp://ojaivalleyboys.com

Related malicious domains known to have participated in the campaign:
hxxp://indigo-post.com
hxxp://jacksonareadiscgolf.com

Related malicious domains known to have participated in the campaign:
hxxp://werodink.com
hxxp://jingyi-plastic.com
hxxp://impressionsphotographs.com

Sample URL redirection chain:
hxxp://cooldesigns4u.co.uk/sifr.php
- hxxp://visittds.com/su/in.cgi?2 - 213.163.89.55 - Email: johnvernet@gmail.com
- hxxp://scaner24.org/?affid=184 - 91.212.127.19 - Email: bobarter@xhotmail.net

Redirectors parked on 213.163.89.55 (AS49544, INTERACTIVE3D-AS Interactive3D) include:
hxxp://google-analyze.org
hxxp://alioanka.com
hxxp://robokasa.com
hxxp://thekapita.com
hxxp://rbomce.com
hxxp://kolkoman.com
hxxp://nikiten.com
hxxp://rokobon.com
hxxp://odile-marco.com
hxxp://ramualdo.com
hxxp://omiardo.com
hxxp://nsfer.com
hxxp://racotas.com
hxxp://foxtris.com
hxxp://mongoit.com
hxxp://mangasit.com
hxxp://convart.com
hxxp://baidustatz.com
hxxp://google-analyze.cn
hxxp://statanalyze.cn
hxxp://reycross.cn
hxxp://m-analytics.net
hxxp://yahoo-analytics.net

We've already seen hxxp://google-analyze.org and hxxp://yahoo-analytics.net in several related mass compromise of related Embassy Web Sites.

We'll continue monitoring the campaign and post updates as new developments take place. Continue reading →

Historical OSINT - Massive Scareware Dropping Campaign Spotted in the Wild

October 20, 2018
It's 2008 and I've recently spotted a currently circulating malicious and fraudulent scareware-serving malicious domain portfolio which I'll expose in this post with the idea to share actionable threat intelligence with the security community further exposing and undermining the cybercrime ecosystem the way we know it potentially empowering security researchers and third-party vendors with the necessary data to stay ahead of current and emerging threats.

Related malicious domains known to have participated in the campaign:
hxxp://50virus-scanner.com
hxxp://700virus-scanner.com
hxxp://antivirus-test66.com
hxxp://antivirus200scanner.com
hxxp://antivirus600scanner.com
hxxp://antivirus800scanner.com
hxxp://antivirus900scanner.com
hxxp://av-scanner200.com
hxxp://av-scanner300.com
hxxp://av-scanner400.com
hxxp://av-scanner500.com
hxxp://inetproscan031.com
hxxp://internet-scan020.com
hxxp://novirus-scan00.com
hxxp://stopvirus-scan11.com
hxxp://stopvirus-scan13.com
hxxp://stopvirus-scan16.com
hxxp://stopvirus-scan33.com
hxxp://virus66scanner.com
hxxp://virus77scanner.com
hxxp://virus88scanner.com
hxxp://antivirus-scan200.com
hxxp://antispy-scan200.com
hxxp://av-scanner200.com
hxxp://av-scanner300.com
hxxp://antivirus-scan400.com
hxxp://antispy-scan400.com
hxxp://av-scanner400.com
hxxp://av-scanner500.com
hxxp://antivirus-scan600.com
hxxp://antispy-scan600.com
hxxp://antivirus-scan700.com
hxxp://antispy-scan700.com
hxxp://av-scanner700.com
hxxp://antispy-scan800.com
hxxp://antivirus-scan900.com
hxxp://novirus-scan00.com
hxxp://stop-virus-010.com
hxxp://spywarescan010.com
hxxp://antispywarehelp010.com
hxxp://internet-scan020.com
hxxp://internet-scanner020.com
hxxp://insight-scan20.com
hxxp://internet-scanner030.com
hxxp://stop-virus-040.com
hxxp://internet-scan040.com
hxxp://insight-scan40.com
hxxp://internet-scan050.com
hxxp://internet-scanner050.com
hxxp://insight-scan60.com
hxxp://stop-virus-070.com
hxxp://internet-scan070.com
hxxp://internet-scanner070.com
hxxp://insight-scan80.com
hxxp://stop-virus-090.com
hxxp://internet-scan090.com
hxxp://internet-scanner090.com
hxxp://insight-scan90.com
hxxp://antispywarehelpk0.com
hxxp://inetproscan001.com
hxxp://novirus-scan01.com
hxxp://spyware-stop01.com
hxxp://antivirus-inet01.com
hxxp://stopvirus-scan11.com
hxxp://inetproscan031.com
hxxp://novirus-scan31.com
hxxp://antivirus-inet31.com
hxxp://novirus-scan41.com
hxxp://antivirus-inet41.com
hxxp://antivirus-inet51.com
hxxp://inetproscan061.com
hxxp://novirus-scan61.com
hxxp://inetproscan081.com
hxxp://novirus-scan81.com
hxxp://inetproscan091.com
hxxp://spyware-stopb1.com
hxxp://spyware-stopm1.com
hxxp://spyware-stopn1.com
hxxp://spyware-stopz1.com
hxxp://antispywarehelp002.com
hxxp://antispywarehelp022.com
hxxp://novirus-scan22.com
hxxp://antispywarehelpk2.com
hxxp://insight-scanner2.com
hxxp://spywarescan013.com
hxxp://stopvirus-scan13.com
hxxp://novirus-scan33.com
hxxp://stopvirus-scan33.com
hxxp://antispywarehelp004.com
hxxp://antispywarehelpk4.com
hxxp://spywarescan015.com
hxxp://novirus-scan55.com
hxxp://insight-scanner5.com
hxxp://stopvirus-scan16.com
hxxp://stopvirus-scan66.com
hxxp://antispywarehelpk6.com
hxxp://spywarescan017.com
hxxp://insight-scanner7.com
hxxp://antispywarehelp008.com
hxxp://spywarescan018.com
hxxp://stopvirus-scan18.com
hxxp://novirus-scan88.com
hxxp://stopvirus-scan88.com
hxxp://antivirus-test88.com
hxxp://antispywarehelpk8.com
hxxp://insight-scanner8.com
hxxp://insight-scanner9.com
hxxp://10scanantispyware.com
hxxp://20scanantispyware.com
hxxp://30scanantispyware.com
hxxp://60scanantispyware.com
hxxp://80scanantispyware.com
hxxp://2scanantispyware.com
hxxp://3scanantispyware.com
hxxp://5scanantispyware.com
hxxp://7scanantispyware.com
hxxp://8scanantispyware.com
hxxp://spyware200scan.com
hxxp://spyware500scan.com
hxxp://spyware800scan.com
hxxp://spyware880scan.com
hxxp://50virus-scanner.com
hxxp://90virus-scanner.com
hxxp://antivirus900scanner.com
hxxp://antivirus10scanner.com
hxxp://virus77scanner.com
hxxp://virus88scanner.com
hxxp://net001antivirus.com
hxxp://net011antivirus.com
hxxp://net111antivirus.com
hxxp://net021antivirus.com
hxxp://net-02antivirus.com
hxxp://net222antivirus.com
hxxp://net-04antivirus.com
hxxp://net-05antivirus.com
hxxp://net-07antivirus.com

We'll continue monitoring the campaign and post updates as soon as new developments take place. Continue reading →