RBN IP List Update 4-30-2011


RBN IP List Removals:
178.18.243.12 replaced by 178.18.240.0/22
178.208.73.21 replaced by 178.208.73.0/24
178.208.75.149 replaced by 178.208.75.0/24
178.208.83.6 replaced by 178.208.83.0/24
204.188.236.6 replaced by 204.188.236.0/24
213.189.197.23 replaced by 213.189.197.0/24
213.189.197.241 replaced by 213.189.197.0/24
213.189.197.245 replaced by 213.189.197.0/24
213.189.197.30 replaced by 213.189.197.0/24
213.189.197.5 replaced by 213.189.197.0/24
213.189.197.72 replaced by 213.189.197.0/24
221.204.203.60 replaced by 221.204.203.0/24
60.199.114.11 replaced by 60.199.114.0/24
60.199.114.71 replaced by 60.199.114.0/24
60.199.114.78 replaced by 60.199.114.0/24
60.199.114.82 replaced by 60.199.114.0/24
60.199.114.84 replaced by 60.199.114.0/24
60.199.114.85 replaced by 60.199.114.0/24
64.64.3.100 replaced by 64.64.3.0/24
64.64.3.101 replaced by 64.64.3.0/24
64.64.3.124 replaced by 64.64.3.0/24
64.64.3.125 replaced by 64.64.3.0/24
64.64.3.126 replaced by 64.64.3.0/24
64.64.3.127 replaced by 64.64.3.0/24
64.64.3.14 replaced by 64.64.3.0/24
64.64.3.26 replaced by 64.64.3.0/24
64.64.3.62 replaced by 64.64.3.0/24
64.64.3.63 replaced by 64.64.3.0/24
64.64.3.98 replaced by 64.64.3.0/24
64.64.3.99 replaced by 64.64.3.0/24
77.79.10.0/24 replaced by 77.79.0.0/20
77.79.11.0/24 replaced by 77.79.0.0/20
77.79.12.0/24 replaced by 77.79.0.0/20
77.79.13.0/24 replaced by 77.79.0.0/20
77.79.4.159 replaced by 77.79.0.0/20
77.79.4.82 replaced by 77.79.0.0/20
77.79.9.0/24 replaced by 77.79.0.0/20






RBN IP List Additions:

1.1.1.1	IP address previously listed
ppppnipponp.r8m.us	Backdoor.Win32.IRCBot, Worm.Win32.Kolab

109.236.83.21	IP address previously listed
softwareupdateservice.ru	visiting this web site may harm your computer. Yes, this site has hosted malicious software over the past 90 days.
updateconnection.com
cloudnanoconnnection.info

112.78.112.208
nippon.to	Worm.Win32.Kolab
www.nippon.to

117.41.248.140	Trojan-GameThief.Win32.OnLineGames

120.28.76.223
ircnet.co.il

123.183.217.32	IP address previously listed
hahahaha.ishtiben.com	Win32.Virut

173.0.51.213
megauploadpremiumaccount.com	piracy
pic-a-delic.com

173.0.51.99	animal abuse
bestzoophilia.com
k9thumbs.org
mail.k9thumbs.org
ns1.goceprofundo.com
server.goceprofundo.com
www.bestzoophilia.com
www.k9thumbs.org

173.236.190.21
ozodbek.uz
sb.uz
shou-biznes.uz
shoubiznes.uz	visiting this web site may harm your computer. Malicious software includes 3082 exploit(s), 5 trojan(s). Successful infection resulted in an average of 3 new process(es) on the target machine.
video.shou-biznes.uz
www.sb.uz

174.142.18.166
abv-imot.com
animesexporn.net
batterysale.net
bbw-porno.net
billyashbaugh.com
blastuk.net
chatroulette-com.com
evromonter.ru	visiting this web site may harm your computer. Malicious software includes 342 exploit(s).
free-xxx-porn-picture.com
fuckingcollege.net
hftmusic.com
inudeteen.com
ip-174-142-18-166.static.privatedns.com
mail.abv-imot.com
mail.animesexporn.net
mail.bbw-porno.net
mail.billyashbaugh.com
mail.chatroulette-com.com
mail.free-xxx-porn-picture.com
mail.fuckingcollege.net
mail.sexifotki.com
mail.toonsex1.com
mail.xloveclub.com
mail.xxx-adult-movies.net
mail.xyxyxy.ru
sexifotki.com
toonsex1.com
totally-dvd.com
tut-kino.net
www.blastuk.net
www.hftmusic.com
xloveclub.com
xyxyxy.ru	visiting this web site may harm your computer. Malicious software includes 11 trojan(s).

178.162.149.175
adarchitect.net	visiting this web site may harm your computer.
xplusonecdn.net

178.18.240.0/22	AS31147 INLINE-AS Inline Internet 

178.18.242.52
*.new-campaign.net
mx.new-campaign.net
new-campaign.net
ns1.new-campaign.net
ns2.videopokerscasino.com

178.18.243.12
0tdsgov.co.cc
13tdsgov.co.cc
1tdsgov.co.cc
22tdsgov.co.cc
23tdsgov.co.cc
govtds01.co.cc
govtds02.co.cc	visiting this web site may harm your computer.
govtds04.co.cc
govtds05.co.cc	visiting this web site may harm your computer.
govtds06.co.cc
govtds07.co.cc	visiting this web site may harm your computer.
govtds08.co.cc
govtds09.co.cc	visiting this web site may harm your computer.
govtds10.co.cc
govtds14.co.cc	visiting this web site may harm your computer.
govtds15.co.cc
govtds18.co.cc
govtds30.co.cc	Malicious software includes 20 exploit(s). Over the past 90 days, govtds30.co.cc appeared to function as an intermediary for the infection of 3 site(s)

178.18.243.202
erwe.cz.cc	
qpnv.cz.cc
reev.cz.cc

178.18.243.217	Zeus
bndeu0.com	ZeusV2
bndeu1.com	ZeusV2
bndeu2.com	ZeusV2
bndeu3.com	ZeusV2
bndeu4.com	ZeusV2
bndeu5.com	ZeusV2
bndeu6.com	ZeusV2
bndeu7.com	ZeusV2
bndeu8.com	ZeusV2
bndeu9.com
e82x.cz.cc	ZeusV2
rvonrvw.com
skc8.cz.cc
uykn.cz.cc
vwrwj6.com
y1jl.cz.cc	ZeusV2
y4xt.cz.cc	ZeusV2
06et.cz.cc

178.18.243.222
spraybrown.com

178.18.243.223
secureimageservice.com

178.18.243.227
investmentspimco.com	Zeus investment fraud

178.18.243.232
minakala.com

178.18.243.4
2j1rpzr.co.cc
mail.2j1rpzr.co.cc
mail.rrrpzrp.co.cc
rrrpzrp.co.cc	visiting this web site may harm your computer.

178.18.243.6
mail.rpzrptr.co.cc
rpzrptr.co.cc	visiting this web site may harm your computer.

178.18.243.7
bkzbkzz.co.cc
bkzblbk.co.cc
dltbkbb.co.cc
onicemano.in
smookusus.com	visiting this web site may harm your computer.

178.18.243.9
byzidac.co.cc
mebofib.co.cc	visiting this web site may harm your computer.
ruxymob.co.cc
selyvoq.co.cc
tafenep.co.cc

178.18.245.182
*.newcampaign-technics.org
mx.newcampaign-technics.org
ns1.newcampaign-technics.org
ns2.no-depositcasinobonus.net

178.208.73.0/24	MCHOST-NET: dedicated cybercrime hosting

178.208.73.40
*.get-hit.net	piracy
mail.get-hit.net

178.208.74.0/24	MCHOST-NET: dedicated cybercrime hosting

178.208.75.0/24	MCHOST-NET: dedicated cybercrime hosting

178.208.75.141
unlimitedcash.ru	scam

178.208.76.0/24	MCHOST-NET dedicated cybercrime hosting

178.208.76.172
scanonline-desktop.net	fake anti-virus

178.208.76.173
mail.soft-city.ru
soft-city.ru	piracy
www.soft-city.ru

178.208.76.174
warezebra.com	piracy
mail.video-online.com.ua
ns1.warezebra.com
video-online.com.ua	piracy

178.208.77.67
googglle.org	Malicious software includes 389 exploit(s), 204 scripting exploit(s), 8 trojan(s).
goooglle.org
kombek.org	Malicious software includes 917 exploit(s), 509 scripting exploit(s), 25 trojan(s).
mail.googglle.org
mail.goooglle.org
mail.kombek.org
mail.pixxel.msk.ru
mail.traffon.org
ns1.pixxel.msk.ru
pixxel.msk.ru
traffon.org	Malicious software includes 581 exploit(s), 28 scripting exploit(s), 10 trojan(s).
v37588.vps.mchost.ru

178.208.77.98	IP address previously listed
scan-systemerror.com	fake anti-virus
scanonline-computer.net

178.208.79.0/24	MCHOST-NET dedicated cybercrime hosting

178.208.79.125
robowarez.net	piracy
www.robowarez.net	piracy

178.208.79.149
windows-checkservice.com	rogue
windows-checkupdate.com	rogue

178.208.79.21
mp3aha.com	piracy

178.208.79.26
mp3cha.com	piracy

178.208.79.39
mshand.ru	Gumblar
theirpicture.ru	Gumblar
*.hiddenyak.ru	Gumblar
*.jackgas.ru	visiting this web site may harm your computer.
*.mshand.ru
*.nicechevy.ru	Gumblar
*.snakebeast.ru	visiting this web site may harm your computer.
*.soundreptile.ru
*.theirpicture.ru
jackgas.ru
nicechevy.ru
snakebeast.ru
soundreptile.ru

178.208.80.0/24	MCHOST-NET dedicated cybercrime hosting

178.208.80.4
mp3rute.com	piracy

178.208.80.5
mp3ette.com	piracy

178.208.80.6
mp3om.com	piracy

178.208.80.7
mp3ence.com	piracy
mp3zzle.com

178.208.80.8
mp3geno.com	piracy

178.208.80.9
mp3rous.com	piracy

178.208.80.10
mp3eulo.com	piracy

178.208.80.11
mp3na.com	piracy

178.208.80.12
mp3pane.com	piracy

178.208.80.13
mp3poty.com	piracy

178.208.80.14
mp3toma.com	piracy

178.208.80.15
mp3brod.com	piracy

178.208.80.16
mp3lano.com	piracy

178.208.80.17
mp3tolo.com	piracy

178.208.80.18
mp3ma.com	piracy

178.208.80.19
mp3ou.com	piracy

178.208.80.20
mp3rons.com	piracy

178.208.80.23
*.d-pils.lv	pharma
*.dpils.lv

178.208.81.0/24	MCHOST-NET dedicated cybercrime hosting

178.208.81.213
the-film.ru	piracy

178.208.81.241
www.file-online.ru	piracy

178.208.81.77
forscreen.com	Malicious software includes 320 scripting exploit(s), 15 exploit(s), 8 trojan(s). Successful infection resulted in an average of 3 new process(es) on the target machine.

178.208.81.85
mp3stas.com	piracy

178.208.81.86
mp3essi.com	piracy

178.208.81.87
mp3lise.com	piracy

178.208.81.88
mp3span.com	piracy
mp3ta.com	piracy

178.208.81.89
mp3lica.com	piracy

178.208.83.0/24	MCHOST-NET dedicated cybercrime hosting

178.208.83.5
1music.org	piracy
bestube.ru	piracy
getcultflick.com	piracy

178.208.83.6
nod32-key.ru	piracy
office-2003.ru	piracy
warez-mix.ru	piracy

178.208.84.0/24	MCHOST-NET dedicated cybercrime hosting

178.208.84.112
www.goldenkino.ru

178.208.84.125
2torrents.net	piracy

178.208.84.196
kinorule.ru

178.208.85.0/24	MCHOST-NET dedicated cybercrime hosting

178.208.85.205
pc-warez.ru	piracy

178.208.85.76
mp3jes.com	piracy

178.208.85.77
mp3jah.com	piracy

178.63.96.144	IP address previously listed
easytraff.ru
easyurl.ru
ilikemusik.ru
mail.trafbuy.ru
mail.uni5.ru
mail.url4all.com
small.ipq.co
trafbuy.ru
u4anz.co.cc
uni5.ru
uni7.ru	Malicious software includes 482 scripting exploit(s), 195 exploit(s), 4 trojan(s). Successful infection resulted in an average of 1 new process(es) on the target machine.
url4all.com
wlasenko.ipq.co
wm-elite.com	Malicious software includes 4 scripting exploit(s).
www.easyurl.ru

183.90.185.25
www.yftk.cc	trojan

188.130.180.20
avtodv.info
clck.ru	Malicious software includes 27 trojan(s), 6 scripting exploit(s), 1 exploit(s).
doska.ws
fable.ru
hantaro.ru
ivtt.ru
mtek.ru
nakleek.net
www.clck.ru

188.165.144.131
blah.swapixtreme.com	Backdoor: Win32/Rbot
triangolo.pl

193.104.94.10	IP address previously listed
ns2.brans.pl
ns2.lometr.pl
nss2.ircgalaxy.pl	name server for malware domain

194.28.172.110
traffikk.biz	Malicious software includes 600 scripting exploit(s), 26 trojan(s), 5 exploit(s). Yes, this site has hosted malicious software over the past 90 days. It infected 75 domain(s)
under-click.net	Malicious software includes 1093 scripting exploit(s), 18 trojan(s), 15 exploit(s).
clickclickclick.asia
ns1.s18host-ua.com.ua
ns2.s18host-ua.com.ua
under-click1.ru
under-click2.ru
under-click.ru
internet-browsers.ru
letit-soft.ru
ed-v.ru

194.28.172.99	IP address previously listed
warez75.ru	piracy. Malicious software includes 423 scripting exploit(s).
warez72.ru	visiting this web site may harm your computer. Malicious software includes 23 scripting exploit(s).
nokia-c5.org
traffshop.com
traffid130.ru
warez70.ru
traffik111.ru
warez71.ru
traffik112.ru
traffik113.ru

194.28.44.165	IP address previously listed
updateservers.kz	rogue

194.28.44.241	IP address previously listed
softwareupdateservice.ru	visiting this web site may harm your computer. Yes, this site has hosted malicious software over the past 90 days.
updateconnection.com
9efb902ec4a9da340169ce3fd15f2b2b.info
8d6f8c23c8034721ffca2f6cbec2b15f.info
cloudnanoconnnection.info

195.216.243.32	IP address previously listed
portale.at.ua	Malicious software includes 76 scripting exploit(s), 52 exploit(s), 24 trojan(s).

195.216.243.44	IP address previously listed
insane-cs.clan.su	Malicious software includes 3 scripting exploit(s).

195.49.213.11
ns1.alma-media.net	name server for malware domains

202.131.225.27	piracy
*.blog.gogo.mn
alluneedislove.blog.gogo.mn
anime.blog.gogo.mn
az.blog.gogo.mn
beliveme.blog.gogo.mn
blog.gogo.mn
clickclickboom.blog.gogo.mn
daki1234.blog.gogo.mn
darkhadbuu.blog.gogo.mn
dbsk.blog.gogo.mn
game.gogo.mn
ganaaod22.blog.gogo.mn
gogo.mn	Malicious software includes 7 scripting exploit(s), 3 trojan(s). Successful infection resulted in an average of 1 new process(es) on the target machine.
hehehe.blog.gogo.mn
hiko.blog.gogo.mn
himitsu.blog.gogo.mn
jkjk.blog.gogo.mn
map.gogo.mn
marketing.blog.gogo.mn
miniiheer.blog.gogo.mn
mongolemo.blog.gogo.mn
mongolkhun.blog.gogo.mn
music.gogo.mn
myclasstg.blog.gogo.mn
news.gogo.mn
noorogchin.blog.gogo.mn
oyutolgoi51.blog.gogo.mn
poesy.blog.gogo.mn
senzys.blog.gogo.mn
solace.blog.gogo.mn
stmuses.blog.gogo.mn
twilightmoon.blog.gogo.mn
urgakhnaran.blog.gogo.mn
uvbsg.blog.gogo.mn
www.gogo.mn

204.145.83.230
ifx.pro-market.net
pbid.iforex.com
pbid.pro-market.net	Trojan-Dropper.Win32.Agent.kd data receptor, TR/Ertfor.B.41 data receptor

204.188.236.0/24	HUTONG-CHANGSHA-COMPANY-LIMITED, LIU-JIACHANG

204.188.236.13	Win32/ShellCode.gen!B

204.188.236.130
c0ntagious.info
mail.c0ntagious.info
ns1.c0ntagious.info

204.188.236.142
killbox.info

204.188.236.170
f0rg0tten.info

204.188.236.195	product piracy
*.jewelry8.net
jewelry8.net
jewelrysshopping.com
www.jewelry8.net

204.188.236.196	product piracy
a-replica-watches.com
designer-bag.net

204.188.236.201	product piracy, brand infringement
chaneljewelry.net

204.188.236.202	product piracy
tag-watch.com

204.188.236.205	product piracy
watchesdesigner.net
wholesalereplicahandbags.net

204.188.236.207	product piracy, brand infringement
gucci-handbag.net

204.188.236.208	product piracy
watchfake.com

204.188.236.209	product piracy
tag-watch.com

204.188.236.211	product piracy, brand infringement
chanelpurse.net

204.188.236.217	product piracy, brand infringement
*.yhandbags.com
www.yhandbags.com

204.188.236.220	product piracy
designer-replica.net

204.188.236.221	product piracy, brand infringement
bags-designer.net

204.188.236.227	product piracy, brand infringement
chanelearrings.net
jewelryreplica.net

204.188.236.228
christian-louboutinshoes.org
hermes-bag.net

204.188.236.229	product piracy, brand infringement
jimmy-chooshoes.org

204.188.236.230	product piracy
watches-fake.net

204.188.236.231	product piracy, brand infringement
swiss-replica-watches.net

204.188.236.232
chanelpurses.net

204.188.236.235	product piracy
watches-replicas.net

204.188.236.236	product piracy
watches-designer.net

204.188.236.239	product piracy, brand infringement
moncler-jacket.org

204.188.236.240	product piracy, brand infringement
dior-sunglasses.org
replica-cheap.com

204.188.236.242	product piracy
watchesladies.net

204.188.236.243	product piracy
clothing-womens.net

204.188.236.245	product piracy, brand infringement
miu-miu-shoes.org

204.188.236.246	product piracy
designer-wholesale.net
shoesdesigner.net

204.188.236.248
replicadesigner.net
watchesomega.net

204.188.236.249	product piracy
designer-replica.org

204.188.236.250	product piracy, brand infringement
*.chanelearrings.org
bestreplicawatch.org
chanelearrings.org
www.51guest.com
www.chanelearrings.org

204.188.236.251	product piracy
watchesdesigner.org

204.188.236.252	product piracy
*.zonghengseo.com
www.zonghengseo.com
zonghengseo.com

204.188.236.66
923zg.com
cf1866.com
cqwl118.com
huxiao76.com
jdwangluo.com
johsonck.com
manaocheng.com
pxmir2.com

204.188.236.88
36ss.net
75gg.net
920cl.com
gm55f.com
mir222.net
mir5288.com
sf16667.com
yelanghj.com
yes5588.net

207.58.177.96	IP address previously listed
solomon-xl.cz.cc	visiting this web site may harm your computer. Malicious software includes 10161 scripting exploit(s), 3178 trojan(s).

209.159.151.3
tbtrack.zugo.com	Trojan.Win32.Sefnit checkin

209.190.61.8
2fnn.com
bairout-nights.com
dennissmithjr.com
e-tigari.com
gitbux.com
jet-host.ru
kdance.sk
ktusozluk.com
marketoneroyston.com
netkinai.com
outbikers.com
ryazan-dostavka.ru
satelitepro.net
teenpunci.info
vareza.info
www.jet-host.ru
www.ktusozluk.com
www.teenpunci.info
www.zonvip.com

209.59.205.143	Zeus
mlqzioesdoionlnr.info

210.193.54.119
ircnet.co.il	IRCBot

213.155.0.224	IP address previously listed
*.citi-bank.ru
citi-bank.ru	Win32/Korgo.T
www.citi-bank.ru
www.tat-neftbank.ru

213.186.122.14
fs97.www.ex.ua	Worm.Win32.Kolab

213.189.197.0/24	AS6903 ZENON-AS ZENON

213.246.38.218
cxz1.net
cxz10.net
cxz2.net
cxz21.net
cxz22.net
cxz23.net
cxz24.net
cxz25.net
cxz26.net
cxz27.net
cxz28.net
cxz29.net
cxz3.net
cxz4.net
cxz5.net
cxz6.net
cxz7.net
cxz8.net
cxz9.net
fpstesting.us
ia2839.net
zxc1.us
zxc2.us
zxc3.us
zxc4.us

213.246.38.219
fr10.info
fr10.org
fr11.biz
fr11.mobi
fr11.us
mr5.biz
mr5s.com
mr5s.info
mr5s.net
mrfive.us

213.246.38.90
5znhff2s.ru
aeitxmukgl.ru
afepqbrylo.ru	visiting this web site may harm your computer.
afoevtchrm.ru
ajisqegufy.ru
amwtncoyjr.ru
apniscmvoe.ru	visiting this web site may harm your computer.
aukmbfpwqi.ru
ayjfblduzs.ru
beouyrafgs.ru
buoitvmadr.ru
buygoilkef.ru	visiting this web site may harm your computer.
cgfoyekuzj.ru	visiting this web site may harm your computer.
d6vjbbv6.ru
dtouayhbgp.ru
edkoyuznpt.ru
feorzadxmi.ru
fylbaoiejr.ru
gaokpxunme.ru
giyfpaurem.ru
gjczuyaiev.ru
husrylkxfp.ru
ilmafuynzg.ru
infoxkmdrg.ru	visiting this web site may harm your computer.
io060fcn.ru
iukznaypjo.ru
iykhgszuae.ru
leuopiabgy.ru
n7wg0g5w.ru
ns1.easyready.cc
ns1.freemobiledns.mobi
ns1.payversuscj.com
ns2.easyready.cc
ns2.freemobiledns.mobi
ns2.payversuscj.com
ntukjgozxy.ru	visiting this web site may harm your computer.
ojsfcpabwm.ru	visiting this web site may harm your computer.
okfvuqmlh.ru
onlineperetips.ru
opbafrgjks.ru
oxsgwmuyaz.ru
qyrzfhilst.ru
thpkmlnuzc.ru
tlevuxybmw.ru
tnrlmzeypf.ru
uarbtxhmny.ru
ueiwmyckos.ru
uqmyhiotda.ru
uyjlecvsio.ru
vauzdftjok.ru
vecgndv8.ru
vrotpyluem.ru
vyixlpmguo.ru
wnoayieqpz.ru	visiting this web site may harm your computer.
wtinlaozqe.ru
wtvmqdongb.ru
www.footsmart.com
x8zv6433.ru
xftiymdave.ru
xjuozasegi.ru
ygheucakjz.ru
yiazofwrle.ru
yiewhucnop.ru
ykuclgfajn.ru
yomamajokes.ru	3 page(s) resulted in malicious software being downloaded and installed without user consent.
youngpakistanigirls.ru	13 page(s) resulted in malicious software being downloaded and installed without user consent
ytoiaxrkvc.ru
yviaeuswdr.ru
zaduheljtw.ru
zdunolivrs.ru
zixerchjds.ru
zoxtgfuvbk.ru

216.147.35.69
livingfountain.biz	Trojan SpyEye

216.205.111.30
rechargeable-phone-batteries.com	visiting this web site may harm your computer. Malicious software includes 16 exploit(s). Successful infection resulted in an average of 1 new process(es) on the target machine.

216.245.203.202
asx.packdeal.com
mindring.info
musicring.info
yahooauto.info	Blackhole exploit kit

217.199.217.102
*.clan.su	Malicious software includes 1056 scripting exploit(s), 190 exploit(s), 65 trojan(s). Successful infection resulted in an average of 1 new process(es) on the target machine.

217.199.217.3	IP address previously listed
clan.su	Malicious software includes 1056 scripting exploit(s), 190 exploit(s), 65 trojan(s). Successful infection resulted in an average of 1 new process(es) on the target machine.
criminalnaya.ru
cs.ucoz.ru
cyberfac.ru
darkarts.clan.su
hollywood-youngstars.de
lineage2info.ru
winsmart24.com
www.criminalnaya.ru

217.65.3.68
doctor121.ucoz.ru	visiting this web site may harm your computer. Malicious software includes 75 scripting exploit(s), 24 exploit(s), 3 trojan(s).
economy.do.am
film4you.info	piracy
filmi-zone.ru	piracy
filmisson.ucoz.ru	piracy
hackerz.ws
microsoft2011.do.am	brand jacker
www.filmi-zone.ru
www.kino-stop.ru

218.16.118.189
ishtiben.com	Win32.Virut

218.85.133.201
www.jiriba.com
bbs.123cha.com
www.cooleasy.com	Worm.Win32.Kolab

221.204.203.0/24	AS4837 China-Network-Communications-Group

221.204.203.58
f1g1ns2.dnspod.net

38.106.114.0/23	AS13618 T3TECH T3 Technologies (Creating Route For Carolina Internet): 92% of sites tested infected other sites

38.106.114.134
www.bottleantiques.com
www.cannabisalerts.com
www.easymarketingtips.com
www.hitsguru.com
www.hotillusion.com	obfusicated call of i-frame to pbid.pro-market.net (Trojan-Dropper.Win32.Agent.kd data receptor, TR/Ertfor.B.41 data receptor)
www.mammothsearch.com
www.moreaboutmagic.com
www.quality-templates.com
www.rebelpodcast.com
www.sloantech.com
www.socialmobilitydisorder.com

4.78.190.247
ad.scanmedios.com	malvertising campaign
ns2.searchhound.com
offerexchange.net
scanmedios.com	
www.scanmedios.com

46.4.244.182
ns2.dnska.in	known bad actor

59.160.236.147
www.ircnet.co.il

59.63.157.62	IP address previously listed
hahahaha.ishtiben.com	Win32.Virut

60.190.218.104	IP address previously listed
hahahaha.ishtiben.com	Win32.Virut

60.190.222.139	IP address previously listed
nss4.ircgalaxy.pl	name server for malware domain

60.199.114.0/24	Taiwan Fixed Network AS9924 TFN-NET

60.199.114.43
*.110022ka.com
*.133dl.com
*.133zx.com
*.ns1.110022ka.com
*.ns1.133dl.com
*.ns1.133zx.com
110022ka.com
133dl.com
133zx.com
60-199-114-43.static.tfn.net.tw
ns1.110022ka.com
ns1.133dl.com
ns1.133zx.com
palacecrystalgame.ru
root.ns1.110022ka.com
root.ns1.133dl.com
root.ns1.133zx.com
slcq185.com

60.199.114.47
233389.com
373628.com
54992.com
56843.com
568557.com
60-199-114-47.static.tfn.net.tw
6888y.com
98tk.net
cataclysm-start.com
cctvcv11.com
cctvcv12.com
cctvcv31.com
cctvcv33.com
cctvcv36.com
cctvcv38.com
cctvczy.com
cctvtv31.com
cctvzzv.com
jtq699.com
longshengxd.com
ra9555.com
sutjvb.com
wnetrr.com
www.ra9555.com
xrtzdb.com
ym8818.com

61.16.165.227
comdns.aswend.com	Worm.Win32.Kolab

61.160.235.196	IP address previously listed
6600.org	Malicious software includes 3628 exploit(s), 83 trojan(s), 17 scripting exploit(s).

61.164.186.170
0101202.com
08529998.com
222078.com
666789.net
ag008.com
cp28.net
fc668.net
fcw010.net
haoniugu.com
www.923999.com

61.235.117.79	IP address previously listed
mail.ircgalaxy.pl	mail server for malware domain

62.122.73.79	IP address previously listed
*.html.in.intrust.cc
*.in.intrust.cc
*.intrust.cc
*.nonepersonal.com
*.results.trust.view.html.in.intrust.cc
*.search.results.trust.view.html.in.intrust.cc
*.trust.view.html.in.intrust.cc
*.view.html.in.intrust.cc
banner-count.com	visiting this web site may harm your computer.
cc.search.results.trust.view.html.in.intrust.cc
hostmaster.nonepersonal.com
html.in.intrust.cc
in.intrust.cc
intrust.cc	visiting this web site may harm your computer.
mypersonalhttp.com
nonepersonal.com
results.trust.view.html.in.intrust.cc
search.results.trust.view.html.in.intrust.cc
tangoing.info
tinnily.info
trust.view.html.in.intrust.cc
unmarine.info
view.html.in.intrust.cc

62.213.97.198
aht-textile.ru	Malicious software includes 104 exploit(s). Yes, this site has hosted malicious software over the past 90 days. It infected 482 domain(s)

63.236.35.30	Trojan.Win32.Sefnit checkin
buy.whitesmoke.com
get.whitesmoke.com
whitesmoke.co.il
whitesmoke.com
whitesmoke.us
www.whitesmoke.com

64.20.48.219	Trojan.Win32.Sefnit checkin
*.asksearch.com
*.bingstart.com
*.flvsearch.net
*.forexstart.net
*.mirostart.com
*.openofficestart.com
*.searchz.org
*.skip-search.com
*.startsearcher.com
*.vlcsearch.com
*.whitesmokestart.com
*.wyzostart.com
*.zillastart.com
*.zugo.com
*.zugosearch.com
7-start.org
7start.org
apostrophesearch.com
apostrophestart.com
apostrophewifi.com
aresstart.com
asksearch.com
bing.zugo.com
bingstart.com
bitstart.org
bragstart.com
brotherstart.com
buzqo.com
cleanerstart.com
components.zugo.com
devtbtrack.zugo.com
dnsadmin.iamwired.com
easyvideostart.com
fenopysearch.com
flvsearch.net
forexstart.net
freakstart.com
free-search.net
freeridegamesstart.com
fupasearch.net
hamsterstart.com
hansostart.com
intercluestart.com
kazaastart.com
kubisearch.com
limesearch.net
limesearch.org
magentic-start.com
mail.iamwired.com
mirosearch.com
mirostart.com
mpstart.org
ns1.iamwired.com
oovoostart.com
openofficestart.com
phazesearch.com
pkrsearch.net
puttysearch.com
reactorsearch.com
safarisearch.net
search-styles.com
searchhelper.org
searchhelper.zugo.com
searchmx.org
searchtoolbar.zugo.com
searchz.org
sharesearch.net
skip-search.com
smokestart.com
softonic-start.com
softonicstart.com
somethingsearch.com
spinsearch.org
startsearcher.com
startya.com
thesearchbay.org
vdownloaderstart.com
vlcsearch.com
vlcstart.com
whitesmokestart.com
www.bingstart.com
www.fastp2psearch.com
www.flvsearch.net
www.forexstart.net
www.mirostart.com
www.openofficestart.com
www.searchz.org
www.skip-search.com
www.vlcsearch.com
www.whitesmokestart.com
www.wyzostart.com
www.zillastart.com
www.zugosearch.com
www1.iamwired.net
www3.iamwired.net
www3.yoog.com
www6.yoog.com
wyzostart.com
zbsrv.com
zbstart.com
zgastart.com
zillasearch.net
zillastart.com
zms.asksearch.com
zugosearch.com
zugoterms.com
zumix.com

64.64.3.0/24	AS25847 SERVINT-1

64.64.3.125
oldschool.vv.cc	visiting this web site may harm your computer. Malicious software includes 17 exploit(s).

65.108.64.39
mail.themclub.org
themclub.org	Gumblar

66.45.229.61	IP address previously listed
iframe24.com

66.45.232.178
zugo.com	Trojan.Win32.Sefnit checkin

67.15.68.32
mail.searchhound.com

67.209.78.54
vastcoins.ru	Zeus
yahoostat.com

69.50.138.116
search.vmn.net	Trojan.Win32.Sefnit checkin
storage.vmn.net
vmngames.com
vmnstorage.com
vmntoolbox.com

69.50.198.114	IP address previously listed, fake anti-virus
antivirus-riga-2011.cz.cc
antivirus-google-2011.cz.cc
antivirus-viruses-2011.cz.cc
antivir-antivirus-2011.cz.cc
antivirus-internet-2011.cz.cc
antivirus-pda.cz.cc
antivirus-riga.cz.cc
antivirus-softpedia.cz.cc
antivirus-gdata.cz.cc
antivirus-explained.cz.cc
antivirus-compared.cz.cc
antivirus-cloud.cz.cc
antivirus-conference.cz.cc
antivirus-fake.cz.cc
antivirus-google.cz.cc
antivirus-gratuiti.cz.cc
antivirus-uk.cz.cc
antivirus-local.cz.cc
antivirus-renewal.cz.cc
antivirus-sql.cz.cc
antivirus-updater.cz.cc
antivirus-avas.cz.cc
antivirus-downloads.cz.cc
antivirus-awards.cz.cc
antivirus-viruses.cz.cc
antivirus-bytes.cz.cc
antivirus-techniques.cz.cc
antivirus-means.cz.cc
antivirus-trojans.cz.cc
picasa-antivirus.cz.cc
postcard-antivirus.cz.cc
portable-antivirus.cz.cc
potente-antivirus.cz.cc
piyush-antivirus.cz.cc
postini-antivirus.cz.cc
plesk-antivirus.cz.cc
pill-antivirus.cz.cc
powerful-antivirus.cz.cc
sam-antivirus.cz.cc
princeton-antivirus.cz.cc
popular-antivirus.cz.cc
pocs-antivirus.cz.cc
prevx-antivirus.cz.cc
antivirus-news.cz.cc
antivirus-internet.cz.cc
antivirus-microsoft.cz.cc
antivirus-list.cz.cc
antivirus-whitelist.cz.cc
antivirus-checklist.cz.cc
antivirus-germany.cz.cc
antivirus-memory.cz.cc
antivirus-history.cz.cc
antivirus-node-2011.ce.ms
antivirus-rate-2011.ce.ms
antivirus-bitdefender-2011.ce.ms
antivirus-recommendations-2011.ce.ms
ae-antivirus-2011.ce.ms
abg-antivirus-2011.ce.ms
aeg-antivirus-2011.ce.ms
batch-antivirus-2011.ce.ms
antivir-antivirus-2011.ce.ms
altools-antivirus-2011.ce.ms
at-antivirus-2011.ce.ms
xtra-antivirus.ce.ms
uottawa-antivirus.ce.ms
ydb-antivirus.ce.ms
umd-antivirus.ce.ms
ultimate-antivirus.ce.ms
ucsf-antivirus.ce.ms
yogi-antivirus.ce.ms
xandros-antivirus.ce.ms

70.107.249.167
dns.aswend.com	Worm.Win32.Kolab
m.drd3h.com

72.189.150.236
ns1.antonkamolov.ru	Win32.KME, Trojan.Win32.Oficla

74.207.232.190
makeupcn.cn	Over the past 90 days, makeupcn.cn appeared to function as an intermediary for the infection of 126 site(s). Malicious software includes 601 exploit(s), 80 scripting exploit(s).
pinkmagic.hk.cn
sogtv.com
www.pinkmagic.hk.cn

77.120.115.184
*.ex.ua
ex.ua
luxport.ru
wap.ex.ua
www.ex.ua
www.luxport.ru

77.245.58.4
*.seek4answers.com
*.think-adz2.com	malvertising campaign
cleopatra-net.com
cnfg.net-secured-app.com
files.deewoo.net
files.think-adz.com
gooochi.biz
net-secured-app.com
seek4answers.amsnl.webair.com
seek4answers.com
think-adz2.com
winupdates.net	rogue
www.gooochi.biz
www.net-secured-app.com
www.seek4answers.com
www.think-adz2.com

77.79.13.239	IP address previously listed
arialdivisionone.com	Worm.Yimfoca

77.79.0.0/20	SPLIUS-NET AS25406 SPLIUS-AS SPLIUS, UAB

77.79.4.73
majorwarez.com	piracy

77.79.4.82
adoranrad.cz.cc
balladolis.cz.cc
fordredred.cz.cc
freepornarchivex.com
jegbpbwn.co.cc
kulamand.cz.cc
lksystms.cz.cc
maloswyn.cz.cc
maridora.cz.cc
moralune.cz.cc
n1templates.cz.cc
pornhub1.ipq.co
pzzmddnv.co.cc
qagvoyov.co.cc
thetalhala.cz.cc
tygraril.cz.cc

77.79.4.87	Incognito exploit kit, trojan
restbest100.co.cc
suppolisters.co.cc
legehits.co.cc
hitchwindows.co.cc
iureuit.co.cc
blabkow3.vv.cc
kingston4384.vv.cc
nayunica.vv.cc
vebaboma.vv.cc
koninasausa.vv.cc
xilacita.vv.cc
namezndkdd.vv.cc
kingidsd.vv.cc
vefahohe.vv.cc
yenoyeje.vv.cc
tahorele.vv.cc
fuhuqene.vv.cc
nobomose.vv.cc
hikofixe.vv.cc
mazowuze.vv.cc
sadsf.vv.cc
vekomibi.vv.cc
femofafi.vv.cc
nicamufi.vv.cc
cevekomi.vv.cc
toboyoni.vv.cc
wehoropi.vv.cc
dozeyuqi.vv.cc
lerocexi.vv.cc
tjkgjkffkjfjk.vv.cc
yuqitoco.vv.cc
tibitofo.vv.cc
boyoniho.vv.cc
yoxomulo.vv.cc
lejaquno.vv.cc
kontibrooo.vv.cc
fecefeyo.vv.cc
pedafezo.vv.cc
hujiyufu.vv.cc
xeciyoqu.vv.cc
bideloxu.vv.cc
bohujiyu.vv.cc
cefeyoyu.vv.cc
ceremand.cx.cc
ballalanim.cx.cc
araswyn.cx.cc
landabor.cx.cc
nitropolit.cx.cc
nec11.cz.cc
lopasana32.cz.cc
rfpeitn52.cz.cc
jopasalia44.cz.cc
zjdxzeem94.cz.cc
lewiston93036.cz.cc
lkimuhaba6.cz.cc
kilzanui8.cz.cc
zaerano9.cz.cc
6error9.cz.cc
xmjawvgoy9.cz.cc
ulitka.cz.cc
perirdana.cz.cc
thetanrad.cz.cc
relinksed.cz.cc
ishnmand.cz.cc
winsecupd.cz.cc
verblud.cz.cc
69pornotube.cz.cc
van-damme.cz.cc
91941northlasve.cz.cc
sebringberri.cz.cc
8610wstjohnavej.cz.cc
regadterek.cz.cc
resawertiol.cz.cc
gholbilanim.cz.cc
munihelm.cz.cc
15201mitran.cz.cc
thorgardin.cz.cc
1692andrewplarn.cz.cc
04009elpaso.cz.cc
granadar.cz.cc
relinkseds.cz.cc
listedits.cz.cc
5mayfairdrstant.cz.cc
sakxzjaxz.cz.cc
saxzcaxzz.cz.cc
greanfellz.com
armse.in
alarmse.in
scular.in
supfly.net

77.79.7.35	poisoned search results
*.free-opinion.com
allsearch.biz
armenia-vs-or-azerbaijan.free-opinion.com
free-opinion.com
israel-vs-palestine.com
server10.allsearch.biz
server104.allsearch.biz
server7.allsearch.biz

77.79.7.37
fusinnie.info
hostmaster.fusinnie.info
mx1.fusinnie.info
ns1.fusinnie.info
ns2.fusinnie.info

77.79.7.88	piracy
*.nsanedown.com
mail.nsanedown.com
nsanedown.com
server.nsanedown.com
www.nsanedown.com

77.79.7.187	piracy
dvdhdvd.com
www.bootsu.com
www.cheapbootsroom.com
www.discountbootsroom.com
www.dvdhdvd.com
www.ggboots.com
www.mybootsroom.com
www.myuggroom.com
www.pickyouruggs.com
www.shopforugg.com
www.top6dvd.com
www.top7dvd.com

78.46.100.45
dokzona.ru	Malicious software includes 136 scripting exploit(s), 1 trojan(s), 1 exploit(s). Successful infection resulted in an average of 1 new process(es) on the target machine. over the past 90 days, 121 page(s) resulted in malicious software being downloaded and installed without user consent.
ns1.for-ns.com	name server for malware domains

78.46.100.58
ns2.avtosvit.com
ns2.for-ns.com	nameserver for malware domains

78.46.45.50
mail.m0nk3y.com
mail.protrafv2.com
protrafv2.com	Malicious software includes 170 scripting exploit(s), 127 exploit(s), 53 trojan(s).
www.protraf.us
www.protrafv2.com

78.47.181.193	trojan

79.136.240.26
audit.dev.hosting.rubius.com	Zeus
csm.dev.hosting.rubius.com
dev.hosting.rubius.com
devsystem.org
dolina.tomsk.ru
grc.tomsk.ru
hosted.by.rubius.com
hosting.rubius.com
mail.grc.tomsk.ru
mail.hosting.rubius.com
ns.devsystem.org
ns.hosting.rubius.com
rubius.com
tg2000.ru
z.dolina.tomsk.ru

80.91.191.239	IP address previously listed
grablya.net
pirat-soft.info	piracy
tvha.ru
webmaster.grablya.net

80.93.54.41	PeterHost.Ru St.Petersburg
pluriflora.ru	14 page(s) resulted in malicious software being downloaded and installed without user consent.
1w.ru
7mos.ru
7ok.ru
aboprf.ru
bring.com.ru
coda.net.ru
directnumber.ru
domaizlesa.ru
dorinform.ru
dune2.ru
elokna.ru
funny-anek.ru
graco-rus.com
i-m-o.ru
kaluga-site.ru
komtelekom.ru
lawdepartment.ru
litacademy.ru
many-anekdots.ru
mirbl.ru
mka1.ru
mobilogo.net.ru
msk-glass.ru
niken.ru
ohrannik.net
okoshko.com.ru
paehali.ru
poli.com.ru
quinta2.z8.ru
rostov-site.ru
service-catalog.ru
shelf93.ru
sitemaster.net.ru
steklo-style.ru
stekloproekt.ru
stifmk.ru
stroimaster.com.ru
strongdoor.ru
superdoor.com.ru
t-house.ru
tben.ru
topworldescort.com
towerlinks.ru
towerpages.ru
towerportal.ru
verycool.ru
whitewarez.info	piracy
www.dorinform.ru
www.komtelekom.ru
www.verycool.ru

81.177.139.103	prostitution
*.6cms.ru
*.erovip.ru
*.gurmanu.com
*.ns.unitedlinux.com
*.psp-filmz.ru
*.sex-archive.ru
*.smotret-porno.ru
*.unitedlinux.com
*.xxx4boys.ru
6cms.ru
erovip.ru
gurmanu.com
knob.ru
mail.4elsea.com
mail.6cms.ru
mail.baza-mms.ru
mail.blue-boys.ru
mail.blue-gay.ru
mail.bluemans.ru
mail.danilko.com
mail.defky-vip.ru
mail.defky.ru
mail.desnadev.ru
mail.devky-intim.ru
mail.dozug.ru
mail.extasy-girls.ru
mail.girls-extasy.ru
mail.girls-intim.ru
mail.gotovim-vkusno.com
mail.gurmanu.com
mail.intim-devky.ru
mail.intim-piter.ru
mail.kerber-vl.ru
mail.ktmz.org
mail.la2kings.ru
mail.lawec.org
mail.mockva-dosug.ru
mail.mockva-sex.ru
mail.moscva-sex.ru
mail.moskva-sex.ru
mail.mris.net.ru
mail.netuz.net
mail.nicemans.ru
mail.novoe-mms.ru
mail.oligard.ru
mail.pediky.ru
mail.pgday.org
mail.pracivniy.ru
mail.practitutka.ru
mail.practitutko.ru
mail.prastitutko.ru
mail.prostetutes.ru
mail.psp-filmz.ru
mail.putana-sex.ru
mail.putano-sex.ru
mail.r1.jino.ru
mail.reere.ru
mail.registropro.info
mail.rorika.ru
mail.ru-practitutka.ru
mail.ru-prostitutka.ru
mail.ruprostitute.ru
mail.ruprostitutka.ru
mail.rus-prostitutka.ru
mail.sconto.su
mail.semya74.ru
mail.seo-blog.su
mail.sex-archive.ru
mail.sex-blue.ru
mail.sex-devky.ru
mail.sex-img.ru
mail.sex-mockva.ru
mail.sex-moscva.ru
mail.sex-moskva.ru
mail.sex-putana.ru
mail.sex-putano.ru
mail.sex-vip-dosug.ru
mail.sexisex.info
mail.sinnersclan.org
mail.slavyanskiy-rayon.ru
mail.slimdim666.jino.ru
mail.smotret-porno.ru
mail.srv55-h-st.jino.ru
mail.sysmon.org
mail.tainy2025.ru
mail.tlk-ek.ru
mail.vip-defky.ru
mail.vip-dozsug.ru
mail.vip-dozug.ru
mail.vip-practetutka.ru
mail.vip-practetutko.ru
mail.vip-practitutka.ru
mail.vip-practitutko.ru
mail.vip-prastetutko.ru
mail.vip-prastitutko.ru
mail.vse-mobily.ru
mail.xxx4boys.ru
psp-filmz.ru
smotret-porno.ru
sos-dan.ru
srv55-h-st.jino.ru
vsemnalogam.net
wapsexi.info
www.6cms.ru
www.freepornphoto.ru
www.smotret-porno.ru
xxx.erovip.ru
xxx4boys.ru

81.177.139.104	prostitution
*.erotick-escort.cz
*.escort-devky.cz
*.holcicki-escort.cz
*.holcicky-escort.cz
*.holky-escort.cz
*.suboch.info
adam.erotick-escort.cz
adam.escort-devky.cz
adam.holcicki-escort.cz
adam.holcicky-escort.cz
adam.holky-escort.cz
adela.erotick-escort.cz
adela.escort-devky.cz
adela.holcicki-escort.cz
adela.holcicky-escort.cz
adela.holky-escort.cz
alena.erotick-escort.cz
alena.escort-devky.cz
alena.holcicki-escort.cz
alena.holcicky-escort.cz
annak.erotick-escort.cz
annak.escort-devky.cz
annak.holcicki-escort.cz
annak.holcicky-escort.cz
annak.holky-escort.cz
daniel.erotick-escort.cz
daniel.escort-devky.cz
daniel.holcicki-escort.cz
daniel.holcicky-escort.cz
daniel.holky-escort.cz
danilko.com
david.erotick-escort.cz
david.escort-devky.cz
david.holcicki-escort.cz
david.holcicky-escort.cz
david.holky-escort.cz
desnadev.ru
eliska.erotick-escort.cz
eliska.escort-devky.cz
eliska.holcicki-escort.cz
eliska.holky-escort.cz
erotick-escort.cz
escort-devky.cz
eva.erotick-escort.cz
eva.escort-devky.cz
eva.holcicki-escort.cz
eva.holky-escort.cz
filip.erotick-escort.cz
filip.escort-devky.cz
filip.holcicki-escort.cz
filip.holky-escort.cz
hana.erotick-escort.cz
hana.escort-devky.cz
hana.holcicki-escort.cz
hana.holky-escort.cz
helena.erotick-escort.cz
helena.escort-devky.cz
helena.holcicki-escort.cz
helena.holky-escort.cz
holcicki-escort.cz
holcicky-escort.cz
holky-escort.cz
jakub.erotick-escort.cz
jakub.escort-devky.cz
jakub.holcicki-escort.cz
jakub.holky-escort.cz
jana.erotick-escort.cz
jana.escort-devky.cz
jana.holcicki-escort.cz
jana.holky-escort.cz
jarmila.erotick-escort.cz
jarmila.escort-devky.cz
jarmila.holcicki-escort.cz
jarmila.holky-escort.cz
jaroslav.erotick-escort.cz
jaroslav.escort-devky.cz
jaroslav.holcicki-escort.cz
jaroslav.holky-escort.cz
jaroslava.erotick-escort.cz
jaroslava.escort-devky.cz
jaroslava.holcicki-escort.cz
jaroslava.holky-escort.cz
jiri.erotick-escort.cz
jiri.escort-devky.cz
jiri.holcicki-escort.cz
jiri.holky-escort.cz
jitka.erotick-escort.cz
jitka.escort-devky.cz
jitka.holcicki-escort.cz
jitka.holky-escort.cz
josef.erotick-escort.cz
josef.escort-devky.cz
josef.holcicki-escort.cz
josef.holky-escort.cz
karel.erotick-escort.cz
karel.escort-devky.cz
karel.holcicki-escort.cz
karel.holky-escort.cz
karolina.erotick-escort.cz
karolina.escort-devky.cz
karolina.holcicki-escort.cz
karolina.holky-escort.cz
katerina.erotick-escort.cz
katerina.escort-devky.cz
katerina.holcicki-escort.cz
katerina.holky-escort.cz
kristyna.erotick-escort.cz
kristyna.escort-devky.cz
kristyna.holcicki-escort.cz
kristyna.holky-escort.cz
ladislav.erotick-escort.cz
ladislav.escort-devky.cz
ladislav.holcicki-escort.cz
ladislav.holky-escort.cz
lenka.erotick-escort.cz
lenka.escort-devky.cz
lenka.holcicki-escort.cz
lenka.holky-escort.cz
lucie.erotick-escort.cz
lucie.escort-devky.cz
lucie.holcicki-escort.cz
lucie.holky-escort.cz
ludmila.erotick-escort.cz
ludmila.escort-devky.cz
ludmila.holcicki-escort.cz
ludmila.holky-escort.cz
lukas.erotick-escort.cz
lukas.escort-devky.cz
lukas.holcicki-escort.cz
lukas.holky-escort.cz
marie.erotick-escort.cz
marie.escort-devky.cz
marie.holcicki-escort.cz
marie.holky-escort.cz
martin.erotick-escort.cz
martin.escort-devky.cz
martin.holcicki-escort.cz
martin.holky-escort.cz
martina.erotick-escort.cz
martina.escort-devky.cz
martina.holcicki-escort.cz
martina.holky-escort.cz
matej.erotick-escort.cz
matej.escort-devky.cz
matej.holcicki-escort.cz
matej.holky-escort.cz
michaela.erotick-escort.cz
michaela.escort-devky.cz
michaela.holcicki-escort.cz
michal.erotick-escort.cz
michal.escort-devky.cz
michal.holcicki-escort.cz
michal.holky-escort.cz
milan.escort-devky.cz
milan.holcicki-escort.cz
milan.holky-escort.cz
miroslav.erotick-escort.cz
miroslav.escort-devky.cz
miroslav.holcicki-escort.cz
mkluch.ru
natalie.erotick-escort.cz
natalie.escort-devky.cz
natalie.holcicki-escort.cz
natalie.holky-escort.cz
netuz.net
ondrej.escort-devky.cz
ondrej.holcicki-escort.cz
ondrej.holky-escort.cz
pavel.erotick-escort.cz
pavel.escort-devky.cz
pavel.holcicki-escort.cz
pavel.holky-escort.cz
petr.erotick-escort.cz
petr.escort-devky.cz
petr.holcicki-escort.cz
petr.holky-escort.cz
petra.erotick-escort.cz
petra.escort-devky.cz
petra.holcicki-escort.cz
petra.holky-escort.cz
sex-modeli.cz
suboch.info
tereza.erotick-escort.cz
tereza.escort-devky.cz
tereza.holcicki-escort.cz
tereza.holky-escort.cz
tomas.erotick-escort.cz
tomas.escort-devky.cz
tomas.holcicki-escort.cz
tomas.holky-escort.cz
vaclav.erotick-escort.cz
vaclav.escort-devky.cz
vaclav.holcicki-escort.cz
vaclav.holky-escort.cz
vera.erotick-escort.cz
vera.escort-devky.cz
vera.holcicki-escort.cz
vera.holky-escort.cz
veronika.erotick-escort.cz
veronika.escort-devky.cz
veronika.holcicki-escort.cz
veronika.holky-escort.cz
vip-modeli.cz
vladimir.erotick-escort.cz
vladimir.escort-devky.cz
vladimir.holcicki-escort.cz
vladimir.holky-escort.cz
vojtech.erotick-escort.cz
vojtech.escort-devky.cz
vojtech.holcicki-escort.cz
vojtech.holky-escort.cz
www.suboch.info
zdenek.erotick-escort.cz
zdenek.escort-devky.cz
zdenek.holcicki-escort.cz
zdenek.holky-escort.cz
zdenka.erotick-escort.cz
zdenka.escort-devky.cz
zdenka.holcicki-escort.cz
zdenka.holky-escort.cz

81.177.139.32	IP address previously listed
*.1001journey.ru
*.ask-gold.net
*.copoka.info
*.evl.ru
*.imws.ru
*.krgavto.com
*.myblogmusic.ru
*.omskhouse.ru
*.plusw.ru
*.progressiya.biz
*.putserdca.ru
*.revoice.ru
*.satikk.ru
*.snpld.ru
*.tssi-tula.ru
1001journey.ru
alive.ru
ask-gold.net
bfh-fan.ru
copoka.info
devki.cz
imws.ru
krgavto.com
medic-daily.ru
merty.ru	Malicious software includes 135 scripting exploit(s), 20 exploit(s), 7 trojan(s). Successful infection resulted in an average of 5 new process(es) on the target machine.
myblogmusic.ru
omskhouse.ru
plusw.ru
progressiya.biz
putserdca.ru
revoice.ru
satikk.ru
snpld.ru
tssi-tula.ru
www.alive.ru
www.evl.ru
www.imws.ru

81.88.48.94
advertiser.simply.com
promotion.simply.com
promotions.simply.com
publisher.simply.com
simply.com	Malicious software includes 4 exploit(s).
simplymob.net
www.simply.com
www.simplymob.net

82.98.86.164	IP address previously listed
moscow-advokat.ru	Worm.Win32.Kolab

83.133.119.196	IP address previously listed
nss3.ircgalaxy.pl	name server for malware domain

83.133.119.197	IP address previously listed
ilo.brenz.pl	Backdoor.Win32.IRCBot.gen, Worm.Win32.Padobot.m
irc.zief.pl
proxim.ircgalaxy.pl	Worm.Win32.Padobot.m, Win32.Virut
ru.brans.pl
sys.zief.pl

83.170.69.14
ns.uk2.net	Worm.Win32.Kolab, Win32.KME

83.208.24.26
ns1.dnsnew111.ru
ns1.dom434.ru
ns1.refg436ct.ru
ns1.vdj32vdj3.ru
ns2.gcas.ru
ns2.looons.ru
ns2.moocas.ru	known bad actor
ns2.oinserr.ru	known bad actor
ns2.tourrr.ru

83.68.16.30	IP address previously listed
*.ntkrnlpa.info
dns1.ntkrnlpa.info
dns2.ntkrnlpa.info
ns1.ntkrnlpa.info
ntkrnlpa.info
proxim.ntkrnlpa.info	Worm.Win32/Korgo.T

85.17.226.176
imgfiles.ru	Malicious software includes 406 scripting exploit(s), 89 trojan(s), 28 exploit(s). Successful infection resulted in an average of 1 new process(es) on the target machine.
ne3.imgfiles.ru

85.25.120.108
*.44allforum.com
*.magix-network.com
44allforum.com
atom999.com	visiting this web site may harm your computer.
ebat-vas-v-uxo.ru
jscriptix.ru	visiting this web site may harm your computer.
magix-network.com
mail.44allforum.com

87.236.232.25
ircnet.co.il

89.208.149.206
lamigda810.ru	Virus.Win32.KME
ml63amgstart.ru

91.200.240.71	IP address previously listed
softwareupdateservice.ru	visiting this web site may harm your computer. Yes, this site has hosted malicious software over the past 90 days.
updateconnection.com
winupdateservices.com
cloudnanoconnnection.info
updateservers.kz

91.213.157.69	IP address previously listed
finderdrs.org
findergif.org
ns1.finderdea.org
ns1.finderdow.org
ns1.finderdrs.org
ns1.findergif.org
ns1.findermem.org
ns1.finderwid.org
portland-traffic.com
seattle-traffic.com

91.213.157.70	IP address previously listed
*.traffic-photos.com
ns1.portland-traffic.com
ns1.seattle-traffic.com
ns1.traffic-fans.com
ns1.traffic-increases.com
ns1.traffic-monitoring.com
ns1.traffic-photos.com
ns2.finderdow.org
ns2.finderdrs.org
ns2.findergif.org
ns2.findermem.org
ns2.findernos.org
ns2.finderwid.org
ns2.traffic-photos.com
traffic-photos.com

91.213.157.71	IP address previously listed
ns2.portland-traffic.com
ns2.seattle-traffic.com
ns2.traffic-fans.com
ns2.traffic-increases.com
ns2.traffic-monitoring.com

91.213.217.190	IP address previously listed
updateservers.kz	rogue

91.213.29.66	IP address previously listed
avs-scan-technologies-win.com	fake anti-virus
avs-scan-images-win.com

91.219.193.111
forum.viplinck.com
viplinck.com	Malicious software includes 55 scripting exploit(s), 6 exploit(s), 3 trojan(s). Successful infection resulted in an average of 4 new process(es) on the target machine.

91.219.194.57
ks-grace.ru	Malicious software includes 56 trojan(s), 38 exploit(s).
mp3mp4mp5-player.info
photoshopcs4.info	brand infringement
wmcenter.biz

92.38.209.180
sechedee.com	Zeus

95.141.36.160	IP address previously listed
*.freemobiledns.mobi
*.trustincompanies.ru
07tqqwem.ru
0qhe7y6o.ru
0scoubpk.ru
0st44x7z.ru
23qjmdic.ru
28iue5ri.ru
2tmo2ba2.ru
32iafdnp.ru
3a0stbqe.ru
3jruf6nc.ru
40ktc2tn.ru
5c4aiwcs.ru
6ojj8sks.ru
6pgsqndh.ru
777wxpc7.ru
83qndvnj.ru
8n7pnyyr.ru
8reclame.ru
ainuzpcedh.ru
atyyyopg.ru
ayjfblduzs.ru
azaamdwo.ru
c28xd2ck.ru
c6iv0x3j.ru
cf8sagkn.ru
csokolom.ru
cw5k47ye.ru
eybgopaiqu.ru
f50rbdb8.ru
fimpvs8t.ru
freemobiledns.mobi
gaokpxunme.ru
gdwre766.ru
geauvqjloy.ru
h6poe6or.ru
hc6zxms4.ru
hem3oxjh.ru
hszwwvjq.ru
husrylkxfp.ru
i4nhjopf.ru
ihbkbzcm.ru
io0yfyc8.ru
j6kb3pfa.ru
jbsc.ru
jongfcmp.ru
kefpvbsi.ru
ketjxynfpm.ru
maruuhp2.ru
mokojikol.ru
mplraqogid.ru
mrt0zqcb.ru
ns1.easyready.cc
ns1.freemobiledns.mobi
nxo48a7g.ru
o3wg4sya.ru
ocggnaif.ru
ocuilafyd.ru
ofz5qzgu.ru
oh7iumr7.ru
okiolk.ru
onlinefreeze.ru
onlinegop.ru
onlinelongjorn.ru
opbafrgjks.ru
patronah.ru
prc6t7z3.ru
psxdv0nr.ru
pzatuloeiv.ru
q2auv3at.ru
q3ysg05s.ru
qbecqe0s.ru
qpsxdv0n.ru
qzhvlpso.ru
rs3gpd0m.ru
s4gvhd35.ru
s748eop4.ru
sgivnn0t.ru
srowig.ru
stpf6qpv.ru
suxpfiyewa.ru
sv4wmtxj.ru
swhaznjuoi.ru
thpkmlnuzc.ru
tlevuxybmw.ru
trustincompanies.ru
u5fyfzjt.ru
uyjlecvsio.ru
vauzdftjok.ru
vdmi2fz8.ru
vrotpyluem.ru
w8iroomb.ru
wiiqiieiqa.ru
wsewf0rw.ru
wtvmqdongb.ru
xni27ftd.ru
xu44i03y.ru
yi0ewtmd.ru
yiazofwrle.ru
yiewhucnop.ru
youngnaturalatk.ru
yp7o07nq.ru
z26hggcb.ru
z656cvje.ru
z7u4wtfe.ru
zaduheljtw.ru
zsrd4xj5.ru

95.169.190.41	IP address previously listed
7ch.com.ua
acb.com.ua
aen.com.ua
af.kiev.ua
afon.com.ua
aft.com.ua
ait.com.ua
allright.com.ua
anima.com.ua
assorty.com.ua
astro.com.ua
atr.com.ua
autogid.com.ua
avr.com.ua
banstock.com.ua
bbm.com.ua
boltun.com.ua
bpp.com.ua
brizol.com.ua
bros.com.ua
bucks.com.ua
bulka.com.ua
calibra.com.ua
camilla.com.ua
cbu.com.ua
ces.com.ua
cez.com.ua
charts.com.ua
chemist.com.ua
chugun.com.ua
citrin.com.ua
cmp.com.ua
cofee.com.ua
convent.com.ua
corporativ.com.ua
cosmetix.com.ua
crist.com.ua
csa.com.ua
ctl.com.ua
debit.com.ua
dentiko.com.ua
dixie.com.ua
doart.com.ua
dover.com.ua
dpcity.com.ua
dreamer.com.ua
dsgn.com.ua
dsn.com.ua
dtu.com.ua
dxl.com.ua
ear.com.ua
ebee.com.ua
emm.com.ua
energetic.com.ua
esd.com.ua
esm.com.ua
ezine.com.ua
fbc.com.ua
fbn.com.ua
fdc.com.ua
fial.com.ua
fiancee.com.ua
fuzion.com.ua
fxsignals.com.ua
galateja.com.ua
gost.com.ua
gothica.com.ua
gst.com.ua
gtd.com.ua
guk.com.ua
gvl.com.ua
halat.com.ua
haos.com.ua
hbc.com.ua
hdi.com.ua
hei.com.ua
hmz.com.ua
hnt.com.ua
hue.com.ua
hungry.com.ua
iad.com.ua
iap.com.ua
ibz.com.ua
ies.com.ua
iip.com.ua
inweb.com.ua
ipjob.net
irt.com.ua
jackson.com.ua
janine.com.ua
jeweler.com.ua
jtc.com.ua
kalipso.com.ua
kaplya.com.ua
kbb.com.ua
kosmetics.com.ua
kosmetix.com.ua
krohi.com.ua
ktl.com.ua
kult.com.ua
kww.com.ua
lapa.com.ua
larix.com.ua
lbg.com.ua
leader.in.ua
leg.com.ua
lekalo.com.ua
lid.com.ua
liliya.com.ua
linkator.com.ua
lki.com.ua
lkk.com.ua
lob.com.ua
lpl.com.ua
lsa.com.ua
lsz.com.ua
lydmila.com.ua
lysenko.com.ua
mai.com.ua
major.com.ua
manifest.com.ua
mcc.com.ua
mila.com.ua
mimo.com.ua
mkk.com.ua
mostik.com.ua
muv.com.ua
mxu.com.ua
nadia.com.ua
nla.com.ua
nmz.com.ua
nnd.com.ua
nodes.com.ua	Win32.Virut
noj.com.ua
ns1.xost.in.ua
nvs.com.ua
okurok.com.ua
olesya.com.ua
olly.com.ua
options.com.ua
orm.com.ua
ostap.com.ua
otwet.com.ua
over.com.ua
pcc.com.ua
pei.com.ua
pico.com.ua
pki.com.ua
pnm.com.ua
popka.com.ua
postroim.com.ua
pot.com.ua
ppc.com.ua
ppn.com.ua
privat.kiev.ua
privetik.net
providing.com.ua
pst.com.ua
pta.com.ua
pyx.com.ua
rapid.kiev.ua
rateme.com.ua
refill.com.ua
reform.com.ua
representation.com.ua
resource.com.ua
ret.com.ua
riz.com.ua
romantik.com.ua
rpo.com.ua
rsa.com.ua
salt.com.ua
sax.com.ua
sbn.com.ua
sda.com.ua
sealer.com.ua
senior.com.ua
seon.com.ua
shant.com.ua
sharnir.com.ua
shs.com.ua
si.kiev.ua
sif.com.ua
smr.com.ua
snip.com.ua
softexpert.com.ua
sorgo.com.ua
sox.com.ua
srx.com.ua
stenka.com.ua
stepler.com.ua
stroim.com.ua
sync.com.ua
tags.com.ua
tanec.com.ua
tec.kiev.ua
tif.com.ua
tin.com.ua
tobi.com.ua
topinvest.com.ua
tpg.com.ua
trofei.com.ua
trusiki.com.ua
tryada.com.ua
ttd.com.ua
tzn.com.ua
uvolen.com.ua
vfx.com.ua
vipsite.com.ua
voshod.com.ua
vsd.com.ua
wbd.com.ua
wpb.com.ua
xost.in.ua
xtc.com.ua
yea.com.ua
yuras.com.ua
yut.com.ua
zdd.com.ua
zis.com.ua
zubki.com.ua

95.211.0.76
apple.downstorm.co.za
appletest.co.cc	brand infringement
esnet.co.za
mail.apple.downstorm.co.za
mail.appletest.co.cc
mail.esnet.co.za
www.esnet.co.za

95.211.108.148	IP address previousy listed
linkp2.com
pic2profit.com	Malicious software includes 63 scripting exploit(s), 53 exploit(s), 9 trojan(s). Successful infection resulted in an average of 1 new process(es) on the target machine.
picp2.com
www.picp2.com

95.211.11.32
casino.ru

95.59.26.2
blogos.kz
chance.kz
dianaplus.kz
erahost.kz
kaiv.kz	visiting this web site may harm your computer. Malicious software includes 223 exploit(s). Successful infection resulted in an average of 5 new process(es) on the target machine.
megasite.kz
metall.kz
my-aktau.kz
mykaz.net
nastya.megahost.kz
ns1.megahost.kz
okp.kz
otzyvy.kz
talap.com
tka-aksai.kz
www.apnok.kz
www.chance.kz
www.dvdzko.kz
www.my-aktau.kz
www.otzyvy.kz

95.59.26.30
aliya.megahost.kz
autogid.kz
kostanaycity.kz
megafilms.kz
nismo.kz
rpg.kz
sba.kz
www.kaz-tor.org
www.megafilms.kz	piracy

96.9.168.34
bliskoseks.info	visiting this web site may harm your computer. Malicious software includes 2 exploit(s). Successful infection resulted in an average of 1 new process(es) on the target machine.
shop5cent.ipua.ru
avto-moto-club.ru
s11.iphoster.ru
ns27.iphoster.ru
service.pokupaut.ru
intimsru.ru

99.189.79.227
ns2.antonkamolov.ru	Win32.KME, Trojan.Win32.Oficla