RBN IP List Update 1-29-2011


RBN IP List Removals:

Replaced by 76.76.96.0/19:
76.76.100.0
76.76.100.1
76.76.100.2
76.76.100.3
76.76.100.4
76.76.100.5
76.76.100.6
76.76.100.7
76.76.101.74
76.76.101.75
76.76.101.78
76.76.101.84
76.76.101.85
76.76.101.86
76.76.102.0/24
76.76.103.0/24
76.76.104.11
76.76.105.0/24
76.76.107.66
76.76.107.68
76.76.111.0/24
76.76.115.24
76.76.115.25
76.76.115.26
76.76.115.27
76.76.115.28
76.76.115.29
76.76.115.30
76.76.115.31
76.76.116.0/24
76.76.124.0/24
76.76.96.130
76.76.97.82
76.76.98.160
76.76.98.161
76.76.98.162
76.76.98.163
76.76.98.164
76.76.98.165
76.76.98.166
76.76.98.167
76.76.98.192
76.76.98.193
76.76.98.194
76.76.98.195
76.76.98.196
76.76.98.197
76.76.98.198
76.76.98.199
76.76.98.48
76.76.98.49
76.76.98.50
76.76.98.51
76.76.98.52
76.76.98.53
76.76.98.54
76.76.98.55
76.76.99.152
76.76.99.153
76.76.99.154
76.76.99.155
76.76.99.156
76.76.99.157
76.76.99.158
76.76.99.159
76.76.99.51
76.76.99.52
76.76.99.53




RBN Activity:

121.12.169.200
g3e6f2g5rd.3322.org	trojan
tyhgfb55.8866.org	trojan

121.14.154.205
dnf820.com	trojan

122.201.80.100
barinya.com		redirects to fake anti-virus

173.192.175.49
fucklittleasians.com

173.212.220.32	Trojan.Win32.Agent.dt, search engine poisoning
rtstb.info

173.212.220.33
ndzpq.info	6000 links to Trojan.Win32.Agent.dt subdomains, search engine poisoning
tvfsw.info	Trojan.Win32.Agent.dt
vnxcs.info	Trojan.Win32.Agent.dt
tftmt.info	Trojan.Win32.Agent.dt
rxlwt.info	Trojan.Win32.Agent.dt

173.212.220.88	Trojan.Win32.Agent.dt, search engine poisoning
aqwkd.info
coudy.info
dbofx.info
hugpt.info
jhrbz.info
jmclf.info
lbnsk.info
nrwez.info
qehus.info
rjfqc.info
sceni.info
tasxr.info
xxlmy.info
yuqwe.info
zgbeb.info

173.212.220.89	Trojan.Win32.Agent.dt, search engine poisoning
ambma.info
hloiy.info
ixptt.info
jlnsk.info
lpcfr.info
mtxck.info
ngkfz.info
otniv.info
phhdc.info
qgntd.info
semlz.info
svwns.info
tfkbr.info
vetad.info
vjysp.info

173.212.220.162	Trojan.Win32.Agent.dt, search engine poisoning
cszpj.info
fkquw.info
fovwy.info
lhtig.info
pguan.info
qbytk.info
rrbmd.info
seqfw.info
snecx.info
tsdrg.info
wldih.info
xmmmf.info
ykeve.info
ymihh.info
ypwnh.info

173.212.220.163	Trojan.Win32.Agent.dt, search engine poisoning
bafzp.info
bgzog.info
caozq.info
dbxqb.info
kimlh.info
kzcqx.info
pphuc.info
qoeox.info
toztv.info
wqpaa.info
xgbai.info
ygwbl.info
yknky.info
zipna.info
ztlvj.info

173.212.238.34	Trojan.Win32.Agent.dt, search engine poisoning
efbsq.info
gnjju.info
ivnzt.info
kdrpx.info
mlzjw.info
otdzw.info
qbkpa.info
qxnji.info
sfrzl.info
sjofz.info
unzql.info
wvdgo.info
ydlwo.info

173.212.238.35	Trojan.Win32.Agent.dt, search engine poisoning
apmsf.info
cxqif.info
efyyi.info
gncpi.info
ivkfl.info
kdovl.info
mlslk.info
qbern.info
sjmir.info
urqyq.info
urwwd.info
wzamc.info
wzyoq.info
yhecc.info

173.212.238.76	Trojan.Win32.Agent.dt, search engine poisoning
*.vdjiv.info
*.xlnyz.info
1.vdjiv.info
20.vdjiv.info
3.xlnyz.info
5.vdjiv.info
bbzfc.info
pgmog.info
twyuj.info
vdjiv.info
xlnyz.info

173.212.238.77	Trojan.Win32.Agent.dt, search engine poisoning
bctjd.info
bcwhp.info
dkaxp.info
pgkqy.info

174.132.134.45	Koobface Gang
ns2.lightdns.com

174.143.19.152	pharma
acaiberryactivescut.com
acaiberryactivesoffer.com
acaiberryexclusivo.com
acaiberryripped.com
acaiberryselectmax.com
acaiberryweightlossoffer.com
acnezine.com
acnezineoffer.com
bellateethwhitening.com
bestonlineincomegenerator.com
bowtrolprobiotic.com
breastactives.com
breastgainplus.com
breastmeds.com
cushylips.net
dermology.com
dermologybrightener.com
dermologycellulite.com
dermologycellulitetrial.com
dermologystretchmark.com
digestitcolontrial.com
digestitmax.com
digestittrial.com
dorisdiet.com
enlast.com
flotrol.com
future-health-products.com
gojiberryadvance.com
health-aid-products.com
herbalbiz.com
idolhealth.com
idollipsoffer.com
idolwhite.fr
idolwhiteoffer.com
idolwhiteriskfreetrial.com
liveractive.com
mail.idolwhite.fr
momsdietreport.com
multivitaminforher.com
muscleadvancecreatine.com
muscleadvanceprotein.com
myonlineincomegeneratorcoupon.com
naturalcoloncleanseoffer.com
naturaldetoxcanada.com
naturalgainplus.com
naturalgainplusoffer.com
onlineincomegeneratorcoupon.com
petbounce.org
petbouncevitamin.com
profitsmultiple.com
profitsmultiplied.com
provillusforher.com
provillusforhim.com
revitoloffer.com
thebestonlineincomegenerator.com
thyroidstore.com
tryroaringtiger.com
uniquewhiteteeth.com
venapro.com
virilityexfreetrial.com
virilityexoffer.com
virilityexriskfreetrial.com
virilityfreetrial.com
wartroloffer.com
www.acaiberryactives.com
www.acaiberryselectcut.com
www.acaiberryselecttrial.com
www.altawhite.com
www.altawhitefreetrial.com
www.boilx.com
www.bowtrolcoloncontrol.com
www.deerantlerplus.com
www.dermasis.com
www.dermologyacnesolution.com
www.dermologykit.com
www.digestit.com
www.freealtawhitetrial.com
www.freeidolwhitetrial.com
www.gojiactive.com
www.gojiadvance.com
www.herbalbizfreetrial.com
www.herpeset.com
www.idolbeauty.com
www.idolhealth.com
www.idolwhite.fr
www.jointkote.com
www.kardashiansmile.com
www.melatrol.com
www.menozac.com
www.miracet.com
www.oxysleep.com
www.petbounce.com
www.proresvera.com
www.resveratrolselect.com
www.resveratrolselectplus.com
www.slaphappycream.com
www.snorezip.com
www.thecelebrityreporter.com
www.thypro.com
xtremenolifetime.com
zetanailfungustreatment.com
zetanails.com

174.36.35.34	Koobface Gang
ns1.lightdns.com

178.162.164.188
binhot.ru	phishing, spam
com-netword.com
ns1.binhot.ru

178.63.96.53
videosdezoofilia.es

184.82.100.18	Trojan.Win32.Agent.dt, search engine poisoning
*.zfvqr.info
cdtxe.info
ddggd.info
eqiml.info
kijzz.info
lqrjj.info
nxqbk.info
rxekb.info
ugdpq.info
uopbm.info
www.zfvqr.info
xhomy.info
yjcuo.info
zfvqr.info

184.82.100.19	Trojan.Win32.Agent.dt, search engine poisoning
aopxo.info
aotpz.info
mfwyx.info
oatyb.info
obgcg.info
ogtik.info
pnbob.info
pptjr.info
qeazu.info
tejuz.info
tsdiv.info
zxxtu.info

184.82.100.78	Trojan.Win32.Agent.dt, search engine poisoning
xkrko.info

184.82.100.79	Trojan.Win32.Agent.dt, search engine poisoning
pudgd.info
tkpng.info

184.82.100.120	rogues
microsoft.office-helppane.com
update.ymail-vip.com
win.foxit-pro.com

184.82.12.100	Trojan.Win32.Agent.dt, search engine poisoning
ffusi.info
tjibq.info
ptwvn.info

188.72.230.234
my2010foto.com
txcp.co.cc	trojan Ransom, Blackhole exploit kit
verzo.co.cc

188.72.240.219	fake anti-virus
expa84.co.cc
phenomen01.co.cc
phenomen12.co.cc
phenomen25.co.cc	Phoenix exploit kit
phenomen30.co.cc

194.247.58.234
*.darkcc.com
darkcc.com	carder forum
exof.net
mrdump.biz
www.darkcc.com

194.247.58.95	SpyEye Command and Control Server

194.247.58.96	trojan SpyEye

195.80.151.114	piracy, IP address previously listed
authorizedoemreseller.com
bcddns.net
buycheapsoftnow.com
deluxe-files.com
discounter-zone.com
downloadoem.us
exclusive-oem.com
freshoem.com
instantsoft.net
licensedoemsoftware.com
lpt-software.com
oem-boutique.net
oem-discounter.com
oem-eshop.com
oem-reseller.com
oemdownload.net
oemfiles.com
oemonline.org
oemsoftstore.net
oemsoftwareforsale.com
oemtopshop.com
software-savings.com
software-wave.com
www.gold-downloads.com
your-oem.com

195.80.151.115	piracy, IP address previously listed
bestbuysoft.net
buyoemsoftware.us
oemka.com
payment8ltd.net
royal-customers.com
royal-download.com
royal-store.net
software-search.net
topoemsoftware.net
update-downloads.net
www.crystal-downloads.com

195.80.151.52	IP address previously listed
biko.cz.cc	Blackhole exploit kit
bval.cz.cc	Blackhole exploit kit
esdo.cz.cc	Blackhole exploit kit
fajm.cz.cc	Blackhole exploit kit
gaks.cz.cc	Blackhole exploit kit
galv.cz.cc	Blackhole exploit kit
gamq.cz.cc	Blackhole exploit kit
gamw.cz.cc	trojan
gamw.cz.cc	Blackhole exploit kit
jolk.cz.cc	Blackhole exploit kit
kolf.cz.cc	Blackhole exploit kit
nokl.cz.cc	Blackhole exploit kit
ruki.cz.cc	Blackhole exploit kit
tnda.cz.cc	Blackhole exploit kit
wetk.cz.cc	Blackhole exploit kit
ydss.cz.cc	Blackhole exploit kit

195.80.151.91	IP address previously listed
3ddr.co.cc
bhit.cz.cc
cbt1.cz.cc
cxz1.cz.cc
dfg2.co.cc
ebai.cz.cc
gdag.cz.cc
grf4.cz.cc
gtz2.co.cc
hgds.cz.cc
pic9.cz.cc
pust.co.cc
qsax.cz.cc
raxy.co.cc
skzopm.com
tripsl.com
xcv2.co.cc

195.80.151.98	IP address previously listed
swx0.co.cc	trojan Carberp
swx0.co.cc	Blackhole exploit kit
sxw9.co.cc	trojan Carberp
sxw9.co.cc	Blackhole exploit kit
wsx0.co.cc	trojan Carberp
wsx0.co.cc	Blackhole exploit kit

205.177.124.38
search4drug.net	pharma

207.58.177.94
adclick.cz.cc
dotfree.com
mail.adclick.cz.cc
mail.cz.cc
mail.mail.cz.cc
mail.start.cz.cc
mail.tinyurl.cz.cc
ranking.cz.cc
start.cz.cc
tinyurl.cz.cc
www.adclick.cz.cc
www.dotfree.com
www.mail.cz.cc
www.ranking.cz.cc
www.start.cz.cc

208.76.54.0/24	AS47869 NETROUTING-AS Netrouting Data Facilities

208.76.54.5	pharma
hypharmacy.com
medicng.com
ns1.pharmacydg.com
pharmacy-online7326.supra-host.com
root.pharmacydg.com
www.pharmacydg.com
www.pharmacyry.com

208.76.54.38
bochu.goclicks.org
ns1.goclicks.org

208.76.54.40
goclicks.org

208.76.54.42
ns2.goclicks.org

208.76.54.64
click-ice.com

208.76.54.66
*.search-sexsites.com
*.sex-searchsite.com
hostmaster.search-sexsites.com
search-sexsites.com
sex-searchsite.com

208.76.54.75	pharma
dns-servers.ru
don.sh
donservers.ru
mail.dns-servers.ru
mail.don.sh
mail.donservers.ru
mail.plethorapills.com
ns1.donservers.ru
ns2.donservers.ru
plethorapills.com
www.plethorapills.com

208.76.54.77
freewebcure.com

208.76.54.80
scenelinks.org	spam
www.scenelinks.org

208.76.54.123
*.fundine.info
fundine.info	spam
hostmaster.fundine.info
ns1.fundine.info
ns2.fundine.info

208.76.54.127
*.yecoupon.com
hostmaster.yecoupon.com
mx1.yecoupon.com
ns1.yecoupon.com
ns2.yecoupon.com
yecoupon.com	spam

208.76.54.128
*.lineally.info
lineally.info	McAfee TrustedSource web reputation analysis found potential security risks with this site.
mx1.lineally.info
ns1.lineally.info

208.76.54.136
*.hypnote.info
hostmaster.hypnote.info
hypnote.info
mx1.hypnote.info
ns1.hypnote.info
ns2.hypnote.info

208.76.54.138
mx2.mp3sparks.com	piracy

208.76.54.140
mx.alltunes.com	piracy

208.76.54.157
dns1.snipers-team.net
dns2.snipers-team.net
ns1.snipers.cc
snipers.cc

208.76.54.159
arhack.net
ns3.snipers.cc

208.76.54.214
zylix.info

208.76.54.224
nijade.info

212.95.54.19
buyordie.osa.pl	known bad actor

213.133.103.199
allbestporn.org	Malicious software includes 107 scripting exploit(s), 33 trojan(s), 25 exploit(s).

213.174.137.103	IP address previously listed
blogbugs.org

213.174.149.121	Koobface Gang, IP address previously listed
*.arclane.com
*.artkitty.com
*.ecomint.com
*.hotlean.com
*.hotsearchpro.com
*.searchadv.com
*.searchmeup.com
*.topcasino10.com
*.toptravel10.com
*.worldsfinance.com
arclane.com
artkitty.com
beststeriod.com
bigtimeoff.com
corezen.com
ecomint.com
hostmaster.arclane.com
hostmaster.hotsearchpro.com
hostmaster.searchmeup.com
hostmaster.topauto10.com
hostmaster.topcasino10.com
hostmaster.toptravel10.com
hostmaster.worldsfinance.com
hostmaster.yesbear.com
hotlean.com
hotsearchpro.com
myshovel.com
ns2.topauto10.com
ns2.worldsfinance.com
searchadv.com
searchmeup.com
toptravel10.com
worldsfinance.com
www.hotlean.com
www.hotsearchpro.com
www.searchmeup.com
www.toptravel10.com
yesbear.com

213.174.149.33	piracy, IP address previously listed
depositfiles.net
img2.depositfiles.com
img2.geo.depositfiles.com
img3.depositfiles.com
img3.depositfiles.net
img3.geo.depositfiles.com
ns7.depositfiles.com
us.iso.depositfiles.com
www.depositfiles.net

213.174.149.70	Koobface Gang, IP address previously listed
*.a1websearch.com
*.aabsearch.com
*.abarsearch.com
*.alocalsearch.com
*.bargainlocalsearch.com
*.beablog.com
*.blogisland.net
*.clicksearchtime.com
*.discoverfindsearch.net
*.discoverlocate.net
*.discoverwebsearch.com
*.findhitweb.net
*.findlocatesearch.com
*.findlocatesearch.net
*.findlocateweb.com
*.findsearchlocate.com
*.findsearchweb.net
*.findweblocate.com
*.findwebsearch.com
*.freesearchtime.com
*.goosearchtime.com
*.hitfindweb.net
*.hitsearchfind.com
*.infosearchtimeline.com
*.itssearchtime.com
*.locatefind.net
*.locatefindweb.com
*.locatesearchfind.com
*.locatesearchweb.net
*.locateweb.net
*.locatewebfind.com
*.locatewebfind.net
*.locatewebsearch.com
*.locatewebsearch.net
*.lookisland.com
*.lookservices.net
*.lookworks.net
*.netsearchtime.com
*.querydirect.net
*.queryonline.net
*.searchconsider.com
*.searchconsider.net
*.searchdetect.net
*.searchdiscoverfind.com
*.searchdiscoverweb.com
*.searchfinddiscover.com
*.searchlocatefind.com
*.searchlocateweb.com
*.weblocatefind.com
accountantsinatlanta.com
bargainlocalsearch.com
clicksearchtime.com
discoverfindsearch.net
discoverlocate.net
discoverwebsearch.com
findhitweb.net
findlocatesearch.com
findlocateweb.com
findsearchlocate.com
findsearchweb.net
findweblocate.com
findwebsearch.com
hitsearchfind.com
hostmaster.aacoolsearch.com
hostmaster.discoverwebsearch.com
hostmaster.findlocateweb.com
hostmaster.hitsearchfind.net
hostmaster.locatesearchfind.com
hostmaster.weblocatefind.com
infosearchtimeline.com
itssearchtime.com
locatesearchweb.net
locateweb.net
locatewebfind.com
locatewebfind.net
locatewebsearch.net
lookservices.net
lookworks.net
netsearchtime.com
ns1.affgold.com
ns1.clickpayz.com
querydirect.net
queryonline.net
searchconsider.net
searchdetect.net
searchdiscoverfind.com
searchdiscoverweb.com
searchfinddiscover.com
searchlocateweb.com
weblocatefind.com
www.a1websearch.com
www.a7search.net
www.aabcsearch.com
www.aabsearch.com
www.aacoolsearch.com
www.abarsearch.com
www.abcasearch.com
www.abcsearchengene.com
www.accountantsinatlanta.com
www.alocalsearch.com
www.bargainlocalsearch.com
www.beablog.com
www.blogisland.net
www.clicksearchtime.com
www.discoverfindsearch.net
www.discoverlocate.com
www.discoverlocate.net
www.findhitweb.net
www.findlocatesearch.com
www.findlocatesearch.net
www.findsearchlocate.com
www.findsearchlocate.net
www.findsearchweb.net
www.findweblocate.com
www.findweblocate.net
www.findwebsearch.com
www.freesearchtime.com
www.goosearchtime.com
www.hitfindweb.com
www.hitfindweb.net
www.hitsearchfind.com
www.infosearchtimeline.com
www.itssearchtime.com
www.locatefind.net
www.locatefindsearch.com
www.locatefindsearch.net
www.locatefindweb.com
www.locatesearchfind.com
www.locatesearchweb.net
www.locateweb.net
www.locatewebfind.com
www.locatewebfind.net
www.locatewebsearch.com
www.locatewebsearch.net
www.lookcentral.net
www.lookisland.com
www.lookservices.net
www.lookworks.net
www.netsearchtime.com
www.querydirect.net
www.queryonline.net
www.searchconsider.com
www.searchconsider.net
www.searchdetect.net
www.searchdiscoverfind.com
www.searchdiscoverweb.com
www.searchfinddiscover.com
www.searchfindlocate.net
www.searchlocatefind.com
www.searchlocateweb.com

213.239.213.15	pharma
3mir.org
bonnepharmacie.com
canadian-health-care.org
cleverpharmacy.com
edgenerics.com
edpharmacy.eu
eeepharmacy.com
generiques24.com
intpharmacy.com
mail.3mir.org
mail.bonnepharmacie.com
mail.cleverpharmacy.com
mail.edpharmacy.eu
mail.eeepharmacy.com
mail.intpharmacy.com
mail.suslikhost.com
ns1.suslikhost.com
ns2.suslikhost.com
suslikhost.com
www.cleverpharmacy.com
www.edpharmacy.eu
www.intpharmacy.com

213.239.213.234
dle-only.org.ua
fergregerg.info	Malicious software includes 87 scripting exploit(s), 31 trojan(s), 23 exploit(s).
grandsmart.ru	Malicious software includes 1 scripting exploit(s), 1 trojan(s), 1 exploit(s). Over the past 90 days, grandsmart.ru appeared to function as an intermediary for the infection of 24 site(s)
mail.dle-only.org.ua
mail.grandsmart.ru
mail.mebli.info
mail.nelegall.ru
mail.photoshop-master.org.ua
mail.stykach.biz
mail.true-host.biz.ua
mail.vip-base.biz
mail.za-bey.ru
nelegall.ru
ns1.true-host.biz.ua
photoshop-master.org.ua	piracy
srv01.zumbusch.info
stykach.biz
true-host.biz.ua
vip-base.biz
za-bey.ru

221.204.215.58	known bad actor
f1g1ns2.dnspod.net

222.173.227.78	known bad actor
ns1.mydnspod.com

222.186.26.115	known bad actor
f1g1ns2.dnspod.net

61.136.228.166	known bad actor
f1g1ns1.dnspod.net

61.136.228.168	known bad actor
ns1.mydnspod.com

61.136.228.169	known bad actor
ns1.mydnspod.com

61.136.59.6	known bad actor, IP address previously listed
dnspod.org
f1g1ns1.dnspod.net
f1y1-dns1.dnspod.net
f1y1dns1.dnspod.net
ns1.dnsv1.com
ns1.e419.com
ns1.moulingtao.com
ns1.sunyew.net
ns2.caifu168.com
ns2.dnspod.net
ns2.dnspood.net
ns2.uptt.net
ns4.6332.net
ns5.caifu168.com
ns5.dnspod.net
ns5.loveyan.com
xs1.yi.org
xs2.yi.org
xs3.yi.org

61.4.82.131
mail.traffka.eu
traffka.eu	TR/Dropper.Gen, TR/Spy.SpyEyes.elr.1

64.191.99.102
admin.herbyscrub.com
czguu.info	Trojan.Win32.Agent.dt, search engine poisoning
hellofreeshare.com
kpvyj.info	Trojan.Win32.Agent.dt, search engine poisoning

64.191.99.8	Trojan.Win32.Agent.dt, search engine poisoning
*.beleivegreat.com
beleivegreat.com
caluw.info
dbmcb.info
fcqnu.info
fmwdn.info
jcwju.info
khxwi.info
lomvv.info
lwgvb.info
mail.beleivegreat.com
msklx.info
orbwd.info
pcjxi.info
qckkj.info
toisr.info
xfhgi.info
zkiyq.info

64.191.99.9
abwyh.info
akrti.info
avcle.info
busqg.info
ecblt.info
favbf.info
igwcl.info
lxvcb.info
oqxln.info
oydny.info
sdhur.info
tiksu.info
tkpcm.info
tncvd.info
vypwu.info

64.202.124.222	Trojan.Win32.Agent.dt, search engine poisoning
slytg.info

66.96.223.188
ns3.epctronica.com
slytg.info	Trojan.Win32.Agent.dt, search engine poisoning
www.ulisessoft.info

66.96.223.189
ns4.epctronica.com
oppbi.info	Trojan.Win32.Agent.dt, search engine poisoning

67.15.135.75	Koobface Gang
ns1.lightdns.com

67.15.135.82	Koobface Gang
*.adultsdir.com
mail.aahooh.com
mail.france-grandsud.com
mail.yoursexweb.com
mail.yourxxxweb.com
rock.qbem.com
yourxxxweb.com

72.55.129.156	known RBN
*.go2.345.pl
*.site11.345.pl
*.vaus4.bee.pl
2a.macher.345.pl
6.site11.345.pl
7link.bee.pl
aao.bee.pl
aaq.osa.pl
aec.bij.pl
aex.bij.pl
afa.bij.pl
aft.bij.pl
agv.bij.pl
autocar.orge.pl
bancopostaonline.osa.pl
barbitura.bee.pl
flop.ert.pl
go2.345.pl
hqexgirl.osa.pl
ip-72-55-129-156.reverse.privatedns.com
ip-72-55-129-156.static.privatedns.com
iufgjoo.bee.pl
mail.osa.pl
reddrivers.osa.pl
www.osa.pl

74.117.159.196
maliilikuks24.ipq.co
maliilikuks47.ipq.co	Malicious software includes 5 exploit(s).

76.76.96.0/19	AS21793 InterWeb Media Gogax.com (32.8% of sites sampled distributed malware)

76.76.102.210
av2012best.co.cc	redirects to Neosploit

76.76.104.203
microsupdates.com	zeus v2 config file

76.76.105.205
bsdtaaa.cz.cc	exploit, exploit kit, fake anti-virus
kitbsdtaaa.cz.cc	Trojan:Win32/Karagany
delarana.cz.cc	fake anti-virus
felhaginn.cz.cc	trojan downloader, exploit kit
thetarin.cz.cc	exploit kit, fake anti-virus

76.76.107.64	Loyalty Servers (known bad actor)
76.76.107.65	Loyalty Servers (known bad actor)
76.76.107.66	Loyalty Servers (known bad actor)
76.76.107.67	Loyalty Servers (known bad actor)
76.76.107.68	Loyalty Servers (known bad actor)
76.76.107.69	Loyalty Servers (known bad actor)
wwwceenurice.co.cc	exploit kit
wwwtuneilies.co.cc	exploit kit

76.76.107.70	Loyalty Servers (known bad actor)
76.76.107.71	Loyalty Servers (known bad actor)
76.76.107.72	Loyalty Servers (known bad actor)
76.76.107.73	Loyalty Servers (known bad actor)
76.76.107.74	Loyalty Servers (known bad actor)
76.76.107.75	Loyalty Servers (known bad actor)
76.76.107.76	Loyalty Servers (known bad actor)
76.76.107.77	Loyalty Servers (known bad actor)
76.76.107.78	Loyalty Servers (known bad actor)
76.76.107.79	Loyalty Servers (known bad actor)

76.76.107.96	Emil Vdovin (known bad actor: child abuse, malware)
76.76.107.97	Emil Vdovin (known bad actor: child abuse, malware)
76.76.107.98	Emil Vdovin (known bad actor: child abuse, malware)
76.76.107.99	Emil Vdovin (known bad actor: child abuse, malware)
76.76.107.100	Emil Vdovin (known bad actor: child abuse, malware)

76.76.107.101	Emil Vdovin (known bad actor: child abuse, malware)
8vnp.co.cc	Blackhole exploit kit
ahe5ha5eh.co.cc	Blackhole exploit kit
b6ut.co.cc	Blackhole exploit kit
dfkell.co.cc	Blackhole exploit kit
ea4geh5.co.cc	Blackhole exploit kit
eahre5h.co.cc	Blackhole exploit kit
erhaerheheh.co.ccindex.php?tp=036b31a39c195641	Blackhole exploit kit
eyaeyeheh5.co.cc	Blackhole exploit kit
g4ehe5h.co.cc	trojan, Blackhole exploit kit
hae5h5hh.co.cc	Blackhole exploit kit
r32fgsh.co.cc	Blackhole exploit kit
rg1n.co.cc	Blackhole exploit kit
sgger.co.cc	Blackhole exploit kit

76.76.107.102	Emil Vdovin (known bad actor: child abuse, malware)
76.76.107.103	Emil Vdovin (known bad actor: child abuse, malware)

76.76.107.104	Loyalty Servers (known bad actor)
76.76.107.105	Loyalty Servers (known bad actor)
76.76.107.106	Loyalty Servers (known bad actor)
76.76.107.107	Loyalty Servers (known bad actor)
76.76.107.108	Loyalty Servers (known bad actor)
76.76.107.109	Loyalty Servers (known bad actor)
76.76.107.110	Loyalty Servers (known bad actor)
76.76.107.111	Loyalty Servers (known bad actor)

76.76.116.162
dvdstreamclipsswvd.co.cc	trojan

76.76.117.96	Emil Vdovin (known bad actor: child abuse, malware)
76.76.117.97	Emil Vdovin (known bad actor: child abuse, malware)

76.76.117.98	Emil Vdovin (known bad actor: child abuse, malware)
dianagar.cz.cc	exploit kit
dianagar.cz.cc	fake av

76.76.117.99	Emil Vdovin (known bad actor: child abuse, malware)
76.76.117.100	Emil Vdovin (known bad actor: child abuse, malware)
76.76.117.101	Emil Vdovin (known bad actor: child abuse, malware)
76.76.117.102	Emil Vdovin (known bad actor: child abuse, malware)
76.76.117.103	Emil Vdovin (known bad actor: child abuse, malware)
76.76.117.104	Emil Vdovin (known bad actor: child abuse, malware)
76.76.117.105	Emil Vdovin (known bad actor: child abuse, malware)
76.76.117.106	Emil Vdovin (known bad actor: child abuse, malware)
76.76.117.107	Emil Vdovin (known bad actor: child abuse, malware)
76.76.117.108	Emil Vdovin (known bad actor: child abuse, malware)
76.76.117.109	Emil Vdovin (known bad actor: child abuse, malware)
76.76.117.110	Emil Vdovin (known bad actor: child abuse, malware)
76.76.117.111	Emil Vdovin (known bad actor: child abuse, malware)

76.76.96.128	Emil Vdovin (known bad actor: child abuse, malware)
76.76.96.129	Emil Vdovin (known bad actor: child abuse, malware)
76.76.96.130	Emil Vdovin (known bad actor: child abuse, malware)
76.76.96.131	Emil Vdovin (known bad actor: child abuse, malware)
76.76.96.132	Emil Vdovin (known bad actor: child abuse, malware)
76.76.96.133	Emil Vdovin (known bad actor: child abuse, malware)
76.76.96.134	Emil Vdovin (known bad actor: child abuse, malware)
76.76.96.135	Emil Vdovin (known bad actor: child abuse, malware)

76.76.97.184	Michael Chekin, Kubisheva, RU
76.76.97.185	Michael Chekin, Kubisheva, RU

76.76.97.186	Michael Chekin, Kubisheva, RU
drugspill.com	pharma

76.76.97.187	Michael Chekin, Kubisheva, RU

76.76.97.188	Michael Chekin
anytab.com	pharma
cncec.org
digres.com
flexyx.com
ns1.anytab.com
ns2.anytab.com
pittsgroup.com
www.cncec.org
www.datexinc.com
www.flexyx.com

76.76.97.189	Michael Chekin, Kubisheva, RU
76.76.97.190	Michael Chekin, Kubisheva, RU
76.76.97.191	Michael Chekin, Kubisheva, RU
76.76.97.224	Emil Vdovin (known bad actor: child abuse, malware)
76.76.97.225	Emil Vdovin (known bad actor: child abuse, malware)

76.76.97.226	Emil Vdovin (known bad actor: child abuse, malware)
mistesr.com	Phoenix exploit kit, zeus v2 trojan

76.76.97.227	Emil Vdovin (known bad actor: child abuse, malware)
76.76.97.228	Emil Vdovin (known bad actor: child abuse, malware)
76.76.97.229	Emil Vdovin (known bad actor: child abuse, malware)
76.76.97.230	Emil Vdovin (known bad actor: child abuse, malware)
76.76.97.231	Emil Vdovin (known bad actor: child abuse, malware)

81.161.246.245
fastgoal.ru	zeus v2 drop zone
megasticks.ru	zeus v2 config file
sundaymold.ru	zeus v2 config file
*.sdlls.ru
bluedisk.ru
cno.tu-sofia.bg
eamba.com
poehali002.info
purplepron.ru
realemotions.ru
sdlls.ru
uk9otweuef39gmqt787if2uz.net

85.13.128.201
robertmueller.com	FBI Spear Phishing
robertmueller.net

88.208.21.1	IP address previously listed
*.admin4rx.com	pharma
*.analporns.info
*.animehentaisite.info
*.asianporns.info
*.asianxxxs.info
*.asslatina.info
*.bestemogirlporn.info
*.bestschoolgirl.info
*.bigdicksite.info
*.blackgirlporns.info
*.blacklesbianssite.info
*.emogirlporn.info
*.emogirlxxx.info
*.girlsexsite.info
*.latinasanal.info
*.latinasexy.info
*.latinaslesbians.info
*.lesbianxxxs.info
*.myasianlesbians.info
*.myblackanal.info
*.myindiangirl.info
*.myteenxxx.info
*.newindiangirl.info
*.newteenxxx.info
*.pornblonde.info
*.pornsexs.info
*.pornsexsite.info
*.starsporn.info
*.teenanals.info
*.teenanalxxx.info
*.xxxblonde.info
admin.admin4rx.com
admin4rx.com
animehentaisite.info
asianxxxs.info
asslatina.info
bestemogirlporn.info
bestschoolgirl.info
bigdicksite.info
emogirlxxx.info
mail.animehentais.info
mail.bestschoolgirl.info
mail.hunteros.com
mail.pornsexs.info
myindiangirl.info
ns1.admin4rx.com
ns1.animehentaisite.info
ns1.pornsexs.info
ns2.pornsexs.info
pornsexsite.info
root.analporns.info
root.animehentaionline.info
root.animehentais.info
root.animehentaisite.info
root.asianporns.info
root.asianxxxs.info
root.asslatina.info
root.bdsmlesbian.info
root.bestemogirlporn.info
root.bestschoolgirl.info
root.bigdicksite.info
root.blackanals.info
root.blackgirlporns.info
root.blacklesbianssite.info
root.emogirlporn.info
root.emogirlxxx.info
root.girlsexs.info
root.girlsexsite.info
root.indianporns.info
root.latinasanal.info
root.latinasexy.info
root.latinaslesbians.info
root.lesbiangruop.info
root.lesbianxxxs.info
root.myasianlesbians.info
root.myblackanal.info
root.myindiangirl.info
root.myschoolgirl.info
root.myteenxxx.info
root.newindiangirl.info
root.newteenporn.info
root.newteenxxx.info
root.pornblonde.info
root.pornsexs.info
root.pornsexsite.info
root.starsporn.info
root.teenanals.info
root.teenanalxxx.info
root.xxxblonde.info
starsporn.info

88.80.4.20
ns1.megahosting10.com
replicasdecalidad.com
www.replicasdecalidad.com

92.53.104.64
gakasa.com	Carberp C&C
doomfury.com
unitours.su
uniturs.ru

95.167.100.221
*.awesomerusteens.ru
*.girlscrazy.ru
*.girlswithbigtits.ru
*.kingofdating.ru
*.ladies-girls.ru
*.russian-babes.ru
*.russian-chix.ru
*.steensrusdating.ru
1.awesomerusteens.ru	spam
awesomerusteens.ru
girlscrazy.ru
girlswithbigtits.ru
kingofdating.ru
rus.girlscrazy.ru
russian-babes.ru
russian-chix.ru
steensrusdating.ru

95.211.109.104
brother-sister-sex.net
classic-cartoons.net
family-guy-sex.net
fantasyforcedsex.org
free-toon-porn.net
futurama-xxx.com
mail.brother-sister-sex.net
mail.family-guy-sex.net
mail.free-toon-porn.net
mail.mom-and-son.org
mail.mom-mature-son-gallery.com
mail.nudist-family.net
mail.sexy-cartoons.net
mail.simpsons-porn.net
mail.sister-seduction.net
mom-and-son.org
mom-mature-son-gallery.com
ns1.futuramasex.net
ns1.nudist-family.net
nudist-family.net
sexy-cartoons.net
simpsons-porn.net
sister-seduction.net
www.brother-sister-sex.net
www.mom-and-son.org
www.mom-mature-son-gallery.com
www.simpsons-porn.net
www.sister-seduction.net

95.211.109.107
family-guy-xxx.com
familytaboo.org
free-incest-stories.org
free-incest-videos.net
freeincestmovies.net
futuramasex.net
incest-stories.org
incestcinema.org
lesbianincest.org
mail.familytaboo.org
mail.free-incest-videos.net
mail.incest-stories.org
mail.lesbianincest.org
ns2.futuramasex.net
ns2.nudist-family.net
www.familytaboo.org
www.free-incest-videos.net
www.freeincestmovies.net
www.incest-stories.org
www.incestcinema.org

95.211.109.168
amour-xxx-angels.com
lovely-my-girls.com
mail.amour-xxx-angels.com
mail.onlyamateursteens.com
mail.teenartclub.net
ns1.amour-xxx-angels.com
ns1.lovely-my-girls.com
ns2.amour-xxx-angels.com
onlyamateursteens.com
teenartclub.net
www.amour-xxx-angels.com
www.lovely-my-girls.com
www.teenartclub.net

95.211.109.207
mail.nude-beach.biz
mail.teennudism.org
ns1.teennudism.org
ns1.toon-xxx.org
ns2.teennudism.org
nude-beach.biz
nudist-teens.com
teennudism.org

95.211.120.163
0did.co.cc	Blackhole exploit kit
fdfa.co.cc	trojan Gozi, Blackhole exploit kit
gdsg.co.cc	Blackhole exploit kit
govorunlimiteds.info	Blackhole exploit kit
govorunprojekt.com	Blackhole exploit kit
hujn.co.cc	Blackhole exploit kit
jhdf.co.cc	trojan Gozi, Blackhole exploit kit
ujdn.co.cc	Blackhole exploit kit

95.211.92.27
tlaziuksoftware.cba.pl	trojan	domeny@ConsultingService.pl