Dancho Danchev

Dancho Danchev's Blog - Mind Streams of Information Security Knowledge

Dear blog readers,I've decided to continue my elaboration and provide further actionable intelligence on a well known member of the Darkode cybercrime-friendly forum community Nassef.Nassef is using [email protected] as his personal email address account and is known to have registered the following domains using it - hxxp://tonymontana.cards - hxxp://tonymontana.cash - ... Read More

In the following post I'll profile the Gaza Hackers Team.Sample photos:Primary group's domains:hxxp://gaza-hacker.comhxxp://hacker.pshxxp://gaza-hacker.nethxxp://gaza-hack.orghxxp://gaza-hack.infohxxp://xhackerx.comhxxp://gaza-hack.comhxxp://gaza-hackers.comPrimary group's email address accounts:[email protected]@[email protected] domain names registered using the same email address accounts:hxxp://frontat.comhxxp://nswaa.comhxxp://elsahefa.comhxxp://naji-albatta.comhxxp://dr-sohila-edu.comhxxp://samozico.comhxxp://shahidn.comhxxp://spider-rss.comhxxp://sv4media.comhxxp://m3n4.comhxxp://shamaly.comhxxp://g2mz.comhxxp://4as7ab.comhxxp://cfpalestine.comhxxp://q8yh.comhxxp://wac-yamama.orghxxp://rawshna.orghxxp://saawa.comhxxp://4rbshare.comhxxp://lajlek.comhxxp://l7ens.comhxxp://koraw.comhxxp://kwgram.comhxxp://gwafe.comhxxp://q8ey.comhxxp://x23x.comhxxp://kuwaitpwr.comhxxp://kuwaitfn.comhxxp://abovlan.comhxxp://q8pinq.comhxxp://eli4s.comhxxp://7koma.comhxxp://juod.nethxxp://topteamdns.comhxxp://nhla7-uae.comhxxp://3agil.comhxxp://wtnfjr.comhxxp://norislam.nethxxp://universalimporting.comhxxp://gaza-shell.comhxxp://remas3.comhxxp://3dshared.comhxxp://3dm3mare.comhxxp://al-ra3ed.comhxxp://bissan-m.comhxxp://bnimashhor.comhxxp://pure4ever.nethxxp://shaatha.comhxxp://ispal.nethxxp://paldream.nethxxp://islhack.nethxxp://adsyour.nethxxp://bnimashhor.nethxxp://mr-matrix.nethxxp://amtaar-a.orghxxp://darhuda.orghxxp://downiphone.comhxxp://6ayf.orghxxp://jadoptical.comhxxp://yomo-az.comhxxp://bfbcps.comhxxp://glaroo7y.comhxxp://amal-ci.comhxxp://q8gz.comhxxp://dubai-g.comhxxp://3mrrycam.comhxxp://psdmate.comhxxp://njomksa.comhxxp://g-ghram.comhxxp://coctael.comhxxp://alhajere.infohxxp://glaoman.comhxxp://ascdascascasc.comhxxp://m7b4.comhxxp://shrooq.orghxxp://3uz.comhxxp://alhajere.nethxxp://wt2n.comhxxp://sfena.comhxxp://artsformedia.comhxxp://r-alfrsan.comhxxp://arabgmaes.comhxxp://studiomustapha.comhxxp://adamttc.comhxxp://helolhost.comhxxp://soblslam.comhxxp://forexufx.comhxxp://dsfbdfbsdfgbdsf.comhxxp://frsan-aslm.comhxxp://g2z4.comhxxp://ewfdssdcsdxc.comhxxp://sam-sport.nethxxp://fr4wa.comhxxp://sama-a.nethxxp://hayatk.nethxxp://gallerycenter.nethxxp://frfish.nethxxp://q8ey.nethxxp://cfpalestine.nethxxp://m3n4.nethxxp://wt2n.nethxxp://gaza-sporting-club.nethxxp://mo7et.nethxxp://alnkhala.comhxxp://alibel.infohxxp://q8gz.nethxxp://dlo3.nethxxp://butt3rfly.nethxxp://butt3rfly.orghxxp://pnsport.nethxxp://sawasport.nethxxp://echotic.nethxxp://healthclubxl.comhxxp://dancingqueensdk.comhxxp://dancingqueensuk.comhxxp://nadinerandle.comhxxp://hackers.toolshxxp://pinkybarbie.comhxxp://florencemodel.comhxxp://hevreman.co.ilhxxp://radiousnice.comhxxp://gaza-hacker.nethxxp://hacker.pshxxp://gaza-hack.infohxxp://gaza-hack.comhxxp://gaza-hack.orghxxp://gaza-hackers.comhxxp://xhackerx.comhxxp://gaza-hacker.comhxxp://metasploit-unleashed.comhxxp://divuae.comhxxp://xensds.comhxxp://e107arabic.comhxxp://h-asiaa.comhxxp://nsamat.comhxxp://for-pal.comhxxp://althbat.comhxxp://islamdahalan.comhxxp://37ob.comhxxp://hamedwayel.comhxxp://iraq-mawal.comhxxp://waleedalshami.comhxxp://fr27.comhxxp://faloja.ushxxp://stylatna.ushxxp://llo9.comhxxp://g-del3.comhxxp://ye7g.comhxxp://ks4-des.comhxxp://5tmat.comhxxp://3rab-moon.comhxxp://nadauae.comhxxp://ya7yati.comhxxp://hayatl.comhxxp://allsaed.comhxxp://asrarmedia.comhxxp://waw-c.comhxxp://f5f5en.comhxxp://w2tube.comhxxp://decor4me.comhxxp://hemo7.comhxxp://gaz2.comhxxp://for-rama.comhxxp://vic-and-ikes.comhxxp://ochotorena.comhxxp://litodelacruz.comhxxp://ignitemonthly.nethxxp://stylepensacola.comhxxp://litocruzxxx.comhxxp://goldencamelph.comhxxp://pensacolabookkeeping.comhxxp://lito2012.comhxxp://appleanddelucamgmnt.comhxxp://jewellery-lito.comhxxp://cocoaccountingservices.comhxxp://pensacolabookkeepers.comhxxp://elsaedps.comhxxp://cocofastlane.comhxxp://globalenergyalliance.comhxxp://g2z4.nethxxp://pauliteweb.comhxxp://a-1specialized.comhxxp://seeyamortgage.comhxxp://debtpollution.comhxxp://losmoles.comhxxp://jerseycityhomesbroker.comhxxp://woofwashers.comhxxp://ignitemonthly.comhxxp://homs-poets.comhxxp://p23x.comhxxp://perfarab.comhxxp://aya-khaled.comhxxp://3alm-a7lam.comhxxp://walazhar.comhxxp://aleys-training.comhxxp://sh-alnoor.comhxxp://enterdig.comhxxp://nshir.comhxxp://shublaq.comhxxp://nahafat.comhxxp://thwane.comhxxp://bb-all.comhxxp://bagdady.comhxxp://a-lawsc.comhxxp://nsgvoic.comhxxp://adsyour.comhxxp://yarmokg.comhxxp://qlpal.comhxxp://krameesh.nethxxp://nialb.nethxxp://3dmaxonline.nethxxp://hmsaat.nethxxp://psstad.comhxxp://elbukhary.nethxxp://gammashare.comhxxp://sawayouth.comhxxp://sadaalnaseem.comhxxp://pro-fhed.comhxxp://sh-elqloob.orghxxp://gazaf.comhxxp://pro-gsm.comhxxp://ofoqm.comhxxp://ah-ra-hi.comhxxp://almehaan.comhxxp://newgaza.comhxxp://ip-center.nethxxp://starsgifts.comhxxp://althikagroup.comhxxp://ids-ps.comhxxp://alhabeel.comhxxp://expodes.nethxxp://3dm3mare.nethxxp://3arabawinews.nethxxp://perfarab.nethxxp://banat2.nethxxp://facearab.nethxxp://azharpharm.comhxxp://artecasa-ps.comhxxp://snam-s.nethxxp://byaadr.comhxxp://t4video.comhxxp://el-eman.comhxxp://usp4.nethxxp://wtn3wtr.comhxxp://wegaza.comhxxp://itcck.comhxxp://tols.ushxxp://w6na1.comhxxp://crypal.comhxxp://mohamed-assaf.comhxxp://black-awadh.comhxxp://b7ar-n.comhxxp://h-m9mm.comhxxp://almnsour.comhxxp://alfjr-aljdid.comhxxp://gazaday.comhxxp://lbee7.comhxxp://n4days.comhxxp://qudssnaks.comhxxp://alhost24.comhxxp://flscool.comhxxp://goldenws.comhxxp://7zoorah.comhxxp://freedom-ship.comhxxp://djz-iq.comhxxp://fine4host.comhxxp://newsawa.comhxxp://forshark.comhxxp://l-voice.comhxxp://ll9x.comhxxp://m-suae.comhxxp://e3lanz.comhxxp://des4x.comhxxp://rap-elemarat.comhxxp://aljazeera-school.comhxxp://aganyna.comhxxp://2lwya.comhxxp://7bobuae.comhxxp://symbian-masters.comhxxp://xn--ggblabcjfq0cxa9oea1b.comhxxp://sh-qlq.comhxxp://t7wani.comhxxp://mujahedhisham.comhxxp://tr-shyo5y.comhxxp://vbu-host.comhxxp://hwawe.comhxxp://saawaa.comhxxp://rapidleecharab.comhxxp://abdullah-alhamami.comhxxp://tiger-a.comhxxp://rap4uae.comhxxp://l3ynk.comhxxp://roo7ii.comhxxp://mwaal.comhxxp://sona3m1.comhxxp://thegreenplains.comhxxp://pro-fahed.comhxxp://fsoft1.comhxxp://mobd3na.comhxxp://t6wery.comhxxp://xn--mgba9ayde0b.comhxxp://9adam.comhxxp://v4-sec.comhxxp://basheerfam.comhxxp://m-alkawari.comhxxp://lhfh1.comhxxp://alrafh.orghxxp://alfaloja1.orghxxp://sm-eyes.comhxxp://n7l7.comhxxp://janetalanwar.comhxxp://world-pulse.comhxxp://academy-expo.comhxxp://krtas.comhxxp://gaza-lenses.comhxxp://arlams.comSample IPs known to have been involved in the campaign include:192.52.167.118204.152.203.99192.161.48.59192.52.167.118185.82.202.207173.254.236.130168.235.86.156167.160.36.101107.191.47.4284.200.68.16372.11.148.14723.229.3.7084.200.68.16323.229.3.70204.152.203.99192.52.167.118168.235.86.156167.160.36.101192.52.166.115131.72.136.28109.200.23.207131.72.136.12466.155.23.36172.227.95.162162.220.246.117162.220.246.117192.253.246.169192.99.111.228192.52.167.125185.33.168.150198.105.117.37185.45.193.4198.105.122.96131.72.136.11131.72.136.17184.200.17.147Sample domains known to have been involved in the campaign include:hxxp://education-support.spacehxxp://falcondefender.comhxxp://support-update.mlhxxp://such.markethxxp://uae.kimhxxp://natco1.no-ip.nethxxp://gov.uae.kimhxxp://natco3.no-ip.nethxxp://up.uae.kimhxxp://natco5.no-ip.nethxxp://uptime.uae.kimhxxp://nazer.zapto.orghxxp://google.com.r3irv2ykn0qnd7vr7sqv7kg2qho3ab5tngl5avxi5iimz1jxw9pa9.uae.kimhxxp://noredirecto.redirectme.nethxxp://ajaxo.zapto.orghxxp://nrehcnthrtfmyi.strangled.nethxxp://backjadwer.bounceme.nethxxp://ns2.negociosdesucesso.infohxxp://backop.mooo.comhxxp://offeline.webhop.nethxxp://bandao.publicvm.comhxxp://orango.redirectme.nethxxp://bypasstesting.servehalflife.comhxxp://redirectlnk.redirectme.nethxxp://cbbnews.tkhxxp://removalmalware.servecounterstrike.comhxxp://cccam.serveblog.nethxxp://mailchat.zapto.orghxxp://chromeupdt.tkhxxp://mp4.servemp3.comhxxp://cnaci8gyolttkgmguzog.ignorelist.comhxxp://rgoyfuadvkebxhjm.ddns.nethxxp://cyber18.no-ip.nethxxp://rotter2.publicvm.comhxxp://deapka.sytes.net    rotter2.sytes.nethxxp://depka.sytes.nethxxp://safar.selfip.comhxxp://dnsfor.dnsfor.mehxxp://safara.sytes.nethxxp://download.likescandy.comhxxp://safari.linkpc.nethxxp://downloadlog.linkpc.nethxxp://spreng.vizvaz.comhxxp://downloadmyhost.zapto.orghxxp://store-legal.bizhxxp://downloadskype.cfhxxp://su.noip.ushxxp://duntat.zapto.orghxxp://tango.zapto.orghxxp://fastbingcom.sytes.nethxxp://test.cable-modem.orghxxp://fatihah.zapto.orghxxp://test.ns01.infohxxp://gaonsmom.redirectme.nethxxp://testcom.strangled.nethxxp://goodday.zapto.orghxxp://thenewupdate.chickenkiller.comhxxp://googlecombq6xx.ddns.nethxxp://thenewupdatee.redirectme.nethxxp://gq4bp1baxfiblzqk.mrbasic.comhxxp://tvnew.otzo.comhxxp://haartezenglish.redirectme.nethxxp://update.ciscofreak.comhxxp://haartezenglish.strangled.nethxxp://updatee.hopto.orghxxp://help2014.linkpc.nethxxp://updatee.serveblog.nethxxp://httpo.sytes.nethxxp://updato.ns01.infohxxp://internetdownloadr.publicvm.com    use.mooo.comhxxp://justded.justdied.comhxxp://wallanews.publicvm.comhxxp://kaliob.selfip.org    wallanews.sytes.nethxxp://kaswer12.strangled.nethxxp://Wcf6f0nqvjtUP4uN.mooo.comhxxp://kolabdown.sytes.nethxxp://webfile.myq-see.comhxxp://ksm5sksm5sksm5s.zzux.comhxxp://webfile.myq-see.comhxxp://lastmoon.mooo.comhxxp://ynet.ignorelist.comhxxp://lilian.redirectme.nethxxp://ynet.sytes.nethxxp://live.isasecret.comhxxp://may2008.dyndns.infohxxp://menu.dyndns.bizhxxp://flashsoft.no-ip.bizhxxp://monagameel.chickenkiller.comhxxp://hatamaya.chickenkiller.comhxxp://powerhost.zapto.orghxxp://helpme.no-ip.bizhxxp://mjed10.no-ip.infohxxp://good.zapto.orghxxp://hint.zapto.orghxxp://hint1.zapto.orghxxp://natco1.no-ip.nethxxp://natco2.no-ip.nethxxp://natco3.no-ip.nethxxp://natco4.no-ip.nethxxp://loading.myftp.orghxxp://skype.servemp3.comhxxp://test.cable-modem.orghxxp://idf.blogsite.orghxxp://javaupdate.no-ip.infohxxp://lokia.mine.nuhxxp://www.hint-sms.comhxxp://owner.no-ip.bizhxxp://remoteback.no-ip.bizhxxp://ramadi.no-ip.bizSample URLs ... Read More

In this analysis we’ll take a look at the Internet connected infrastructure of U.S Secret Service’s most wanted cybercriminal with a $10M reward Danil Potekhin using a variety of tools in terms of connecting the dots using current real time and historical passive DNS information to find out where he ... Read More

Dear blog readers,The following is a compilation of dynamic DNS providers in specific ones used by APTs and various other targeted campaign obtained using public sources. Sample dynamic DNS service provider domains known to have been involved in various malicious software spreading campaigns include:07726657423zaion[.]no-ip[.]biz100009755836320[.]no-ip[.]biz123456789123456789[.]myftp[.]biz1337ace[.]ddns[.]net1349874791[.]gnway[.]cc1488[.]sytes[.]net14lcolombo[.]ddns[.]net159asd[.]duckdns[.]org1756mostacc[.]ddns[.]net1987omid[.]ddns[.]net1fon1[.]ddns[.]net1m4962f897[.]iok[.]la22134520[.]ddns[.]net2715729[.]vicp[.]net45df36[.]dyndns[.]info4you[.]ddns[.]net5107b712[.]all123[.]net5551520[.]no-ip[.]biz5701c196[.]123nat[.]com6gh[.]noip[.]me726627[.]duckdns[.]org79649759[.]ddns[.]net7daysky[.]in[.]3322[.]org96750513[.]ddns[.]net9949291099[.]hopto[.]orga1b2c3[.]hopto[.]orga302a85a[.]ngrok[.]ioaaaa[.]comaaaaaaaaaabbbbb[.]hopto[.]orgaagaro[.]ddns[.]netaasxzxdsc12324[.]no-ip[.]bizabarouter[.]ddns[.]netabbaass313[.]hopto[.]orgabbaass3132[.]hopto[.]orgabcccabccab[.]ddns[.]netabderrahmane16[.]hopto[.]orgabdo099[.]ddns[.]netabdobacha05[.]ddns[.]netabdou16[.]hopto[.]orgabdouoahmed[.]ddns[.]netabduls0821[.]myddns[.]meabedjaradat1177[.]no-ip[.]orgabinova[.]ddns[.]netabosaoys881[.]duia[.]usabs3nt[.]ddns[.]netabusako[.]no-ip[.]bizachrafzouina[.]zapto[.]orgad15[.]hopto[.]orgadelxxbx[.]no-ip[.]bizadesja1337[.]no-ip[.]bizadlin[.]duckdns[.]orgadobflash[.]hopto[.]orgaerror[.]no-ip[.]bizahag3ld1[.]ddns[.]netahmdiand-wj3[.]ddns[.]netahmed12345[.]hoptp[.]orgahmed2012[.]dynu[.]comahmed90011912[.]ddns[.]netahmedmidoegypt[.]hopto[.]orgahomdalhomd42[.]hopto[.]orgala6a[.]no-ip[.]bizalaa-1982[.]no-ip[.]bizalaajb[.]zapto[.]orgalaauy[.]ddns[.]netalabama192837[.]no-ip[.]orgalanbkey[.]no-ip[.]orgalarr2012ab[.]myftp[.]bizalbash2222[.]ddns[.]netaldnkoich11111111[.]no-ip[.]orgalfazaai99[.]ddns[.]netali2627[.]ddns[.]netali7070[.]ddns[.]netaliboxboxbox[.]hopto[.]orgalihoseini[.]no-ip[.]bizaliyusef6[.]no-ip[.]bizalkingahmed555[.]ddns[.]netalldebrid[.]duckdns[.]orgallforfree[.]game-host[.]orgalpheron[.]duckdns[.]orgalzintani[.]ddns[.]netamarok58[.]no-ip[.]bizamelwafaw[.]ddns[.]netaminamadani16[.]hopto[.]orgaminbatna31[.]ddns[.]netaminecity[.]ddns[.]netaminrahimzadeh[.]no-ip[.]orgamiraliam[.]ddns[.]netamirhosein0074[.]ddns[.]netammaar938[.]ddns[.]netampala[.]ddns[.]netamran-pc[.]no-ip[.]bizamrozamrozamroz[.]hopto[.]orgamrsamy222[.]ddns[.]netamsdj[.]hopto[.]orgamujeeb1990[.]ddns[.]netan[.]droidsuper[.]suanagliz[.]ddns[.]netanawebs[.]ddns[.]netandqip[.]ddns[.]netandr01d[.]zapto[.]organdrew999[.]ipnodns[.]ruandriod91[.]ddns[.]netandro[.]no-ip[.]bizandro0161[.]no-ip[.]infoandro123[.]duckdns[.]organdroduck[.]duckdns[.]organdroid[.]no-ip[.]organdroid1[.]ddns[.]netandroid1385[.]ddns[.]netandroidalbums[.]ddns[.]netandroidan[.]ddns[.]netandroidbra[.]duckdns[.]organdroidfdl[.]ddns[.]netandroidplay[.]ddns[.]netandroidrat21[.]ddns[.]netandroidsafe[.]ddns[.]netandroidtest0[.]ddns[.]netandroidtool[.]ddns[.]netandroidupdate[.]ddns[.]netandrojak[.]myftp[.]organdrojan[.]ddns[.]netandrokhan3100[.]ddns[.]netandrooid[.]ddns[.]netandrorat[.]servegame[.]comandrorat[.]zapto[.]organdrorat1[.]no-ip[.]bizandrorat1226[.]ddns[.]netandrorat143[.]no-ip[.]bizandrorat22[.]ddns[.]netandroratbtas[.]no-ip[.]infoandroratttt[.]no-ip[.]organdroratvirgin[.]duckdns[.]organdrotorma[.]ddns[.]netandver18[.]no-ip[.]bizanishmishra66[.]ddns[.]netanito[.]ddns[.]netanon008[.]ddns[.]netanondz97[.]ddns[.]netanonfox[.]no-ip[.]organonimousdre180[.]ddns[.]netanonsa[.]ddns[.]netanonvirus[.]ddns[.]netanonymo9s[.]ddns[.]netanonymous666[.]zapto[.]organonymousip[.]ddns[.]netanonymousip[.]no-ip[.]orgapkhamza[.]ddns[.]netapolo30[.]no-ip[.]orgapplecenikosmos[.]hldns[.]ruappmarket[.]servehttp[.]comappsystem[.]ddns[.]netaqwkdo1[.]no-ip[.]bizariaaalikazm[.]ddns[.]netarman[.]no-ip[.]bizarondograu[.]ddns[.]netasadhashmi[.]ddns[.]netasasasas22[.]ddns[.]netasdbh11[.]ddns[.]netasdqqq[.]bounceme[.]netaskinder[.]hopto[.]orgasosha4ed[.]no-ip[.]bizastro3[.]hopto[.]orgatin[.]ddns[.]netatsizinoglu[.]duckdns[.]orgauc[.]dlinkddns[.]comaudreysaradin[.]no-ip[.]orgauthd[.]ddns[.]netawir-fb[.]sytes[.]netaxxz2017[.]ddns[.]netayadd19[.]no-ip[.]orgayadd99[.]ddns[.]netayham11[.]hopto[.]orgaymen1852[.]ddns[.]netaymencossassi[.]ddns[.]netazerboys[.]hopto[.]orgazert123[.]ddns[.]netazerty[.]hopto[.]orgaziza[.]sytes[.]netbaby[.]webhop[.]mebadguy[.]myq-see[.]combahar2017[.]no-ip[.]orgbahoom[.]no-ip[.]bizbambi[.]no-ip[.]bizbanis[.]hopto[.]orgbannding[.]ddns[.]netbapforall[.]ddns[.]netbarbari[.]ddns[.]netbarish121[.]no-ip[.]orgbassamzeyad[.]ddns[.]netbatterysaver[.]3utilities[.]combehnamhack[.]ddns[.]netbeijg[.]3322[.]orgbensphonetracker[.]ddns[.]netberkani0774[.]no-ip[.]orgbitoandroid[.]no-ip[.]infobl4ckh0t[.]ddns[.]netbl4ckhatjoker[.]ddns[.]netblack1990[.]ddns[.]netblackghostdc[.]duckdns[.]orgblackghostorg[.]ddns[.]netblind1234[.]ddns[.]netbmt96[.]noip[.]meboinserver12[.]no-ip[.]infobopress[.]ddns[.]netbostanoo[.]ddns[.]netboubou271[.]ddns[.]netbox100[.]ddns[.]netbrasilteamop[.]ddns[.]netbrave-hacker[.]no-ip[.]orgbrousse16[.]ddns[.]netbwaleez[.]hopto[.]orgc1[.]no-ip[.]bizcamper92[.]ddns[.]netcanaria[.]no-ip[.]infocarapuce-2015[.]no-ip[.]bizcardangi[.]no-ip[.]orgcccamd[.]myftp[.]bizcerdofile[.]ddns[.]netchabar[.]ddns[.]netchacal00[.]hopto[.]orgchangyu231[.]ddns[.]netchanks[.]no-ip[.]bizcharifo1310tok[.]no-ip[.]bizchrisfo[.]no-ip[.]orgcity55[.]hopto[.]orgcjbks0u0[.]no-ip[.]orgclashdroid[.]no-ip[.]bizclayhost[.]hopto[.]orgcnw[.]redirectme[.]netcomet[.]myftp[.]orgcomsurogate[.]noip[.]mecoxiamigo[.]myq-see[.]comcraxyvirux[.]ddns[.]netcreatemeon[.]zapto[.]orgcricbot[.]no-ip[.]infocrime[.]ddns[.]netcrisprueba[.]ddns[.]netcyberandro[.]duckdns[.]orgcyberbit[.]ddns[.]netcyberbwarrior[.]ddns[.]netcybercrysis[.]ddns[.]netdadadadadaprivet[.]ddns[.]netdagohack[.]no-ip[.]medalibob12[.]ddns[.]netdamndamn[.]ddns[.]netdangerlove[.]no-ip[.]bizdanialdelta[.]ddns[.]netdanialmostafaei[.]no-ip[.]bizdaniele3814[.]ddns[.]netdanielrats[.]ddns[.]netdantehack[.]zapto[.]orgdarkshion[.]no-ip[.]orgdaroedkak[.]no-ip[.]bizdarweshfis[.]no-ip[.]orgdatadownloader[.]ddns[.]netdddeee[.]ddns[.]netddns[.]netdeep1234[.]ddns[.]netdellearm[.]ddns[.]netdendroid[.]hopto[.]orgdenishul[.]hldns[.]rudetlef-gmbh[.]tkdexonic[.]duckdns[.]orgdiceedicee[.]ddns[.]netdidi03[.]duckdns[.]orgdiener123[.]ddns[.]netdionis[.]ddns[.]netdj[.]shop[.]tmdj123[.]no-ip[.]orgdjack1[.]zapto[.]orgdkms[.]ddns[.]netdltelegram[.]ddns[.]netdnsdynamic[.]orgdodee97dodee[.]ddns[.]netdodotototata[.]publicvm[.]comdogecoinspeed[.]zapto[.]orgdomeer-android[.]ddns[.]netdomira[.]ddns[.]netdraagon[.]ddns[.]netdragonhkr1[.]myftp[.]bizdrdamar[.]hopto[.]orgdrhack[.]hopto[.]orgdriodrac[.]ddns[.]netdro[.]soxx[.]usdroid[.]deutsche-db-bank[.]rudroid[.]fagdns[.]comdroid[.]freedynamicdns[.]orgdroid[.]servehttp[.]comdroid[.]serverhttp[.]comdroidcraftismelmao[.]ddns[.]netdroidge[.]ddns[.]netdroidhost[.]zapto[.]orgdroidjaack[.]zapto[.]orgdroidjack[.]hopto[.]orgdroidjack1[.]sytes[.]netdroidjack121[.]ddns[.]netdroidjack2137[.]hopto[.]orgdroidjack228[.]ddns[.]netdroidjack2333[.]ddns[.]netdroidjack258[.]bounceme[.]netdroidjack33[.]no-ip[.]bizdroidjackdns[.]duckdns[.]orgdroidjackiam[.]ddnsking[.]comdroidjackisgodly[.]ddns[.]netdroidjackkk[.]sytes[.]netdroidjackv5[.]ddns[.]netdroidjock[.]myftp[.]bizdroidmosa[.]ddns[.]netdroidnigga[.]zapto[.]orgdroidrat[.]hopto[.]orgdroidspy[.]zapto[.]orgdroidss[.]noip[.]medroy[.]zapto[.]orgdrrazikhan[.]no-ip[.]infodsf[.]no-ip[.]orgduckdns[.]orgduckem[.]duckdns[.]orgducmanhhoangtran[.]ddns[.]netduke5010[.]duckdns[.]orgduyguseliberkay[.]no-ip[.]bizdzhacker16[.]ddns[.]nete777kx47[.]ddns[.]netegytiger[.]myftp[.]orgehsanmaali[.]ddns[.]netehsanmaali3[.]ddns[.]neteldiablo[.]no-ip[.]bizelgen1[.]no-ip[.]bizelisou19[.]ddns[.]netelvis2015[.]ddns[.]netemme[.]no-ip[.]bizengnngns[.]duckdns[.]orgengrid[.]no-ip[.]bizequisde[.]ddns[.]neterikatersptra[.]ddns[.]netesharj[.]ddns[.]neteslam87[.]hopto[.]orgessalhi2047[.]hopto[.]orgeuquerotchu[.]ddns[.]netevilcasper[.]ddns[.]netexplosif[.]zapto[.]orgfacbookserver[.]ddns[.]netfacebooh[.]zapto[.]orgfacebook2ww290[.]ddns[.]netfacrbook[.]redirectme[.]netfadisesubaih[.]ddns[.]netfairylow[.]no-ip[.]bizfakaelite[.]no-ip[.]orgfarzan[.]ddns[.]netfateh2017[.]ddns[.]netfati43030[.]no-ip[.]bizfatiha29[.]ddns[.]netfazoro66[.]ddns[.]netfenon158[.]ddns[.]netferzo1881[.]duckdns[.]orgfifi147fifi[.]no-ip[.]bizfirsthost[.]ddns[.]netflashplayerxx[.]no-ip[.]orgflorian-pc[.]ksueyuj0mtxpt6gn[.]myfritz[.]netforcehackinglove[.]ddns[.]netfoxfeline[.]no-ip[.]orgfree1[.]neiwangtong[.]comfreeann[.]sytes[.]netfreeeeeeeeee[.]no-ip[.]infofreepalestine[.]ddns[.]netfruby[.]zapto[.]orgfsocfsoc[.]ddns[.]netfukeyou12[.]myftp[.]bizfuturasky[.]no-ip[.]bizgaabar[.]hopto[.]orggalau[.]ddns[.]netgcafegood[.]noip[.]megcafegood2[.]noip[.]megemini85[.]hopto[.]orggentel901[.]no-ip[.]orggeocheats2[.]eugert44[.]duckdns[.]orgget[.]phggwasgeht[.]ddns[.]netghanim2017[.]ddns[.]netghanou1603[.]no-ip[.]infoghfx1[.]ddns[.]netghghghghetrezw[.]no-ip[.]orgglaive24[.]no-ip[.]bizgmailss11[.]hopto[.]orggogaggg[.]ddns[.]netgoggle[.]sytes[.]netgold5000[.]ddns[.]netgoldeneagle1112[.]ddns[.]netgooboom[.]no-ip[.]bizgood[.]myddns[.]megoog2[.]no-ip[.]bizgooglead[.]publicvm[.]comgoogles[.]servemp3[.]comgoogleweb[.]ddns[.]netgooogleplay[.]ddns[.]netgorr[.]hopto[.]orggoshasb[.]ddns[.]netgrandeamore[.]ddns[.]netgreat-support[.]comgreatkeyboard[.]hopto[.]orggta5hacking12[.]duckdns[.]orgguru123[.]ddns[.]netgusui1[.]ddns[.]nethaa7aah[.]no-ip[.]bizhabbo[.]no-ip[.]orghabib1376[.]ddns[.]nethabib556[.]ddns[.]nethac123k[.]hopto[.]orghachim07reg[.]no-ip[.]infohack-iraq[.]no-ip[.]infohack1111[.]noip[.]mehack155[.]vicp[.]nethackcam[.]zapto[.]orghackdeam[.]no-ip[.]infohacked2001[.]hopto[.]orghackedona[.]ddns[.]nethacker-321[.]no-ip[.]bizhacker-81[.]no-ip[.]bizhacker2[.]hopto[.]orghacker421[.]hopto[.]orghackermoqtada[.]no-ip[.]bizhackertn123[.]no-ip[.]bizhackhack2016[.]no-ip[.]infohackhamer[.]zapto[.]orghackinroll[.]ddns[.]nethackme[.]no-ip[.]orghacksd20[.]ddns[.]nethacksyria2[.]myftp[.]bizhadsurvey[.]ddns[.]nethahalol[.]ddns[.]nethahalol[.]no-ip[.]bizhaiderhacer12[.]no-ip[.]bizhajeeeee[.]hopto[.]orghakedpc0000[.]myftp[.]bizhakeerali2[.]ddns[.]nethaker-2119[.]ddns[.]nethaker10[.]ddns[.]nethaker33sadekgafer[.]no-ip[.]bizhakosiken[.]duckdns[.]orghakunamatata007[.]ddns[.]nethala222[.]hopto[.]orghalo12[.]duckdns[.]orghamadagentel[.]ddns[.]nethamed1993[.]ddns[.]nethamidoranis[.]no-ip[.]bizhamidos1342[.]ddns[.]nethamker[.]ddns[.]nethamo55[.]hopto[.]orghamza19991[.]hopto[.]orghamzaelcb[.]ddns[.]nethananox[.]ddns[.]nethardik[.]no-ip[.]infohardstyleraver[.]no-ip[.]orgharoune12[.]myddns[.]mehash0r[.]no-ip[.]bizhasha[.]hopto[.]orghasn9999[.]ddns[.]nethassan100[.]ddns[.]nethassanabd1233[.]ddns[.]nethatam[.]no-ip[.]orghavij[.]ddns[.]nethax[.]no-ip[.]infohaxor[.]hopto[.]orghaxorjib[.]no-ip[.]orghazem123[.]no-ip[.]bizhazhar77[.]no-ip[.]bizhdkhanh123[.]no-ip[.]orghedr78[.]ddns[.]netheemoana[.]hopto[.]orghegazy5753[.]ddns[.]nethehe[.]duckdns[.]orgheikechenmo[.]3322[.]orgheilbronn[.]duckdns[.]orghell2066[.]zapto[.]orghelloandroid[.]no-ip[.]orghero400[.]ddns[.]netheroeschargehacked[.]ddns[.]nethhamokcha[.]ddns[.]nethhhhhfhf[.]ddns[.]nethmt1985[.]ddns[.]nethobi[.]3utilities[.]comhoho121292[.]ddns[.]nethoho39[.]ddnc[.]nethohoangpmy[.]ddns[.]nethooman8219[.]servecounterstrike[.]comhopto[.]orghorcheni123[.]ddns[.]nethoseenoori2277kh[.]ddns[.]nethossam3030[.]ddns[.]nethossar[.]ddns[.]nethosteng123[.]hopto[.]orghosthack25[.]ddns[.]nethouaribey4[.]ddns[.]nethouaribey4[.]no-ip[.]orghousam[.]linkpc[.]nethoussmes[.]zapto[.]orghowie96[.]jios[.]orghpwdza47o8huc1xj[.]myfritz[.]nethqn[.]ddns[.]nethtmp[.]sytes[.]nethttpdssh[.]ddns[.]nethuhuhuya[.]ddns[.]nethuntergold[.]no-ip[.]bizhussein1889[.]no-ip[.]bizhusseinali5698[.]ddns[.]nethusshacka[.]hopto[.]orgi1993[.]ddns[.]netignoredhost[.]no-ip[.]bizimad2001bo[.]hopto[.]orgindusv00[.]duckdns[.]orginfo[.]bounceme[.]netinjectman[.]ddns[.]netinjectman[.]no-ip[.]infointeljet[.]ddns[.]netintelresol[.]ddns[.]netinvisibleghost[.]no-ip[.]bizipv445[.]hopto[.]orgiqram85spy[.]ddns[.]netiran0513[.]ddns[.]netiraqn6777[.]ddns[.]netisamdonita[.]no-ip[.]orgislam2020libya[.]no-ip[.]bizislamway[.]no-ip[.]infoivon9393[.]no-ip[.]orgjackdroid[.]systes[.]netjackdroid1337[.]ddns[.]netjafarman[.]ddns[.]netjalal123[.]hopto[.]orgjalldomain[.]ddns[.]netjas7ser[.]hopto[.]orgjassair[.]hopto[.]orgjastn[.]ddns[.]netjirawat01[.]ddns[.]netjkgytgasjg12[.]serveftp[.]comjnkey[.]ddns[.]netjockerhackerxnxx[.]ddns[.]netjohnharim004[.]ddns[.]netjojomo[.]ddns[.]netjokerbabel[.]no-ip[.]bizjomo[.]zapto[.]orgjosewaldo[.]ddns[.]netjuanblackhak[.]ddns[.]netjuliocoelhodesa[.]hopto[.]orgjun[.]dynu[.]comjustarat[.]noip[.]mek0k0wawa[.]hopto[.]orgkaddress[.]ddns[.]netkaedalsh[.]ddns[.]netkaizen00[.]ddns[.]netkakashi[.]ddns[.]netkaliheh[.]no-ip[.]bizkalinne[.]ddns[.]netkalinus[.]ddns[.]netkalizinho[.]no-ip[.]orgkalljo[.]dvrdns[.]orgkamlabhai123[.]no-ip[.]bizkararkarar0780[.]ddns[.]netkarasqlee9[.]no-ip[.]orgkarenchik19[.]hopto[.]orgkarrarhuseein82[.]ddns[.]netkaskw[.]myftp[.]bizkaskw[.]zapto[.]orgkasofe123123aa[.]no-ip[.]bizkasper[.]ddns[.]netkeskes02122002[.]ddns[.]netkevte26[.]zapto[.]orgkhaleel0[.]zapto[.]orgkhalid-2016[.]noip[.]mekhantac[.]ddns[.]netkheridla[.]hopto[.]orgkilasx[.]ddns[.]netkingdom[.]no-ip[.]bizkinggg[.]ddns[.]netkjgjgkhffh[.]sytes[.]netkka163[.]ddns[.]netkkarox90[.]no-ip[.]orgkmessi[.]myddns[.]mekomplevit-rat[.]ddns[.]netkontolanime[.]no-ip[.]bizkorelev[.]no-ip[.]orgkorg600[.]no-ip[.]bizkrem111[.]ddns[.]netkrlol[.]ddns[.]netksbozo[.]ddns[.]netkskdt[.]ddns[.]netkuraist[.]zapto[.]orgkurd-kar[.]ddns[.]netkusleratnt[.]duckdns[.]orglahyarhmo[.]hopto[.]orglamorash[.]ddns[.]netlaze22[.]hopto[.]orglbossn[.]ddns[.]netlearnxea[.]duckdns[.]orgled5526[.]ddns[.]netlikerrdd[.]myftp[.]bizlinonymousami[.]no-ip[.]orgliquidixen[.]ddns[.]netliquidstone[.]ddns[.]netlizdlezozifpo[.]ddns[.]netlocal1232[.]ddns[.]netlocolocoloco[.]ddns[.]netlolman[.]ddns[.]netlomo[.]comlordxxx[.]myq-see[.]comlosever2[.]no-ip[.]bizlove2014[.]ddns[.]netloveubaby[.]3utilities[.]comlputyr[.]myq-see[.]comluxuriaecu[.]ddns[.]netmadblack0[.]sytes[.]netmadov-matrix25[.]no-ip[.]orgmagemankoktelam[.]ddns[.]netmahamadmahmod[.]ddns[.]netmahasiswa[.]no-ip[.]bizmahdi1379[.]ddns[.]netmahdi3141[.]ddns[.]netmahdibaba123[.]ddns[.]netmajed111111[.]myq-see[.]commajod98m[.]ddns[.]netmakarand[.]no-ip[.]orgmalakatef09[.]ddns[.]netmamal9921[.]ddns[.]netmami5255[.]duckdns[.]orgmar020one[.]hopto[.]orgmarcsil[.]ddns[.]netmariorossi2013[.]homepc[.]itmarknetz[.]hopto[.]orgmarocmaroc[.]hopto[.]orgmartin123456[.]no-ip[.]orgmasafat[.]ddns[.]netmaskaralama[.]ddns[.]netmasterat[.]myftp[.]orgmatgio[.]duckdns[.]orgmatin[.]ddns[.]netmatrix-teste[.]ddns[.]netmayyaha[.]no-ip[.]infomazenttr2[.]hopto[.]orgmazxor[.]zapto[.]orgme512[.]zapto[.]orgmedo7911[.]ddns[.]netmedoahmed3[.]ddns[.]netmedx321[.]ddns[.]netmee2008[.]zapto[.]orgmegalol[.]chickenkiller[.]commehost[.]ddns[.]netmehtab123[.]ddns[.]netmemeaimen10[.]hopto[.]orgmemexmama[.]ddns[.]netmezoo32[.]no-ip[.]bizmghorbani78[.]ddns[.]netmhoammedtty[.]hopto[.]orgmht3[.]ddns[.]netmicro-soft[.]no-ip[.]bizmicrosoft-office[.]ddns[.]netmido28[.]hopto[.]orgmigo2018[.]zapto[.]orgmiioolinase[.]ddns[.]netmikaniki[.]ddns[.]netmikestar[.]no-ip[.]bizmiltin2[.]no-ip[.]orgminou555[.]hopto[.]orgmisterx94[.]ddns[.]netmisty255[.]no-ip[.]orgmixtape2016[.]ddns[.]netmjhooollltuuu[.]no-ip[.]bizmmdjj212[.]myftp[.]bizmobdro[.]hopto[.]orgmobiles0ft[.]no-ip[.]orgmoein1369[.]no-ip[.]bizmoep004[.]no-ip[.]orgmogahed[.]ddns[.]netmoha55[.]no-ip[.]bizmohamed11[.]ddns[.]netmohamed46565656[.]no-ip[.]bizmohamed4dz[.]ddns[.]netmohamedamine[.]ddns[.]netmohamedhg[.]no-ip[.]orgmohamednjrat111[.]no-ip[.]bizmohammad2002[.]no-ip[.]bizmohammadhk[.]ddns[.]netmohammed22468[.]no-ip[.]bizmohammed93mahdi[.]ddns[.]netmohammedwasib[.]ddns[.]netmohfort[.]ddns[.]netmohmad[.]myftp[.]bizmohmdnor[.]ddns[.]netmohsanali79355[.]ddns[.]netmohsenfaz[.]ddns[.]netmoji1936[.]ddns[.]netmokhter222029[.]ddns[.]netmoktarpicaasrinabil[.]zapto[.]orgmomen-swesi[.]no-ip[.]bizmomo2015[.]duckdns[.]orgmon009[.]no-ip[.]bizmonitoring007[.]zapto[.]orgmoonmar10[.]no-ip[.]bizmoosio[.]no-ip[.]bizmoslim[.]ddns[.]netmostafaafroto0[.]ddns[.]netmotoshi[.]zapto[.]orgmoussa-hak[.]no-ip[.]bizmphp[.]hopto[.]orgmpt1969[.]ddns[.]netmrblacklife[.]ddns[.]netmrclone97[.]ddns[.]netmrgnet[.]ddns[.]netmrkriper3331[.]zapto[.]orgmrm2[.]ddns[.]netmrreda98[.]ddns[.]netmsficecream[.]ddns[.]netmsn-web[.]ddnsking[.]commsn79[.]ddns[.]netmstar[.]ddns[.]netmster0102[.]no-ip[.]bizmstfa10[.]ddns[.]netmsupdate[.]myvnc[.]commurryapplicazione[.]no-ip[.]orgmuxamilu[.]hopto[.]orgmwanika[.]no-ip[.]bizmyaw[.]no-ip[.]bizmyfreerat[.]ddns[.]netmyfrenid2x[.]zapto[.]orgmyhost123[.]myftp[.]bizmyillusion02[.]hopto[.]orgmyonline[.]no-ip[.]bizmypy23[.]ddns[.]netmzgerges[.]no-ip[.]biznademhack[.]no-ip[.]orgnadineemma[.]servegame[.]comnamandroidk63[.]zapto[.]orgnapaixonado[.]ddns[.]netnassahsliman[.]ddns[.]netnemesis2017[.]zapto[.]orgnetflix-ip[.]hopto[.]orgnew777[.]ddns[.]netnewword[.]serveblog[.]netnewxor2[.]no-ip[.]orgnexmopro830[.]ddns[.]netninabounita[.]ddns[.]netninjabird29[.]myvnc[.]comnirajpawar1997[.]ddns[.]netnjesra[.]ddns[.]netnododg[.]ddns[.]netnohacker[.]ddns[.]netnoiphackk[.]ddns[.]netnoipjajaja[.]ddns[.]netnoussa[.]no-ip[.]biznowgirlas[.]ddns[.]netnoxrr[.]ddns[.]netnulldoesnotexist[.]duckdns[.]orgoday1995[.]zapto[.]orgoko[.]gotdns[.]chomar[.]no-ip[.]bizoneriakosa[.]ddns[.]netopt91[.]ddns[.]netorihacker[.]ddns[.]netosamarizk[.]ddns[.]netosammer0asmam3a[.]ddns[.]netosmsalem[.]ddns[.]netospr[.]publicvm[.]comoussama1997[.]ddns[.]netoussamadj1997[.]ddns[.]netovirus[.]ddns[.]netowsen[.]ddns[.]netpaaradowx[.]hopto[.]orgpapasystem[.]no-ip[.]orgparrot01[.]hopto[.]orgpars[.]ddns[.]netpersir[.]no-ip[.]bizpetermohsenvi2[.]hopto[.]orgpfijsp[.]noip[.]mephantom94[.]ddns[.]netphotoeditor[.]ddns[.]netphotofix[.]hopto[.]orgpianotiles2[.]ddns[.]netpimpdaddy[.]myq-see[.]compippo86[.]no-ip[.]bizplaystore[.]ddns[.]netportmeim[.]ddns[.]netpremium007[.]zapto[.]orgpriyakumari[.]ddns[.]netprofmilf[.]zapto[.]orgprohacker[.]freedynamicdns[.]orgprojectp[.]ddns[.]netproview[.]ddns[.]netpruebasernesto[.]ddns[.]netpuplicdsl[.]ddns[.]netqq376552030[.]ddns[.]netqwerty1212[.]ddns[.]netr00t[.]myftp[.]bizr3cxw[.]ddns[.]netr90[.]no-ip[.]bizradouan123[.]hopto[.]orgrafkin85[.]ddns[.]netrahimtrx[.]hopto[.]orgraliphesus[.]ddns[.]netrameezmaster[.]ddns[.]netrandsnaira[.]dnsdynamic[.]comrarwindow[.]no-ip[.]bizrat[.]capsulelab[.]usratforandroid[.]ddns[.]netrds11[.]ddns[.]netrecycled[.]no-ip[.]orgredckard[.]ddns[.]netredcode[.]ddns[.]netreddemon[.]ddns[.]netrefsa[.]duckdns[.]orgreich666[.]ddns[.]netreich777[.]ddns[.]netremoteip999[.]ddns[.]netreplace[.]duckdns[.]orgrinalditeam[.]ddns[.]netrmk133[.]hopto[.]orgrmx2121[.]ddns[.]netrockrock[.]ddns[.]netrok13198666[.]no-ip[.]bizron1372[.]ddns[.]netroyalhacker[.]zapto[.]orgrpshowpick[.]ddns[.]netrpswlrkgkarp[.]p-e[.]krrumpelztinzkin[.]sytes[.]netrustyash[.]no-ip[.]bizrzra51126[.]ddns[.]nets[.]ddns[.]nets[.]leas[.]ims3b4s[.]noip[.]mes3rv3randr0id[.]no-ip[.]bizsabbah[.]duckdns[.]orgsadaq[.]ddns[.]netsaiber-far68[.]ddns[.]netsaighinissou[.]ddns[.]netsajadianh[.]ddns[.]netsajjad1994[.]ddns[.]netsajjadnassar3[.]no-ip[.]bizsalah067[.]hopto[.]orgsalarkalat[.]ddns[.]netsalemaziz[.]hopto[.]orgsamdzbba[.]ddns[.]netsamersamerz[.]no-ip[.]bizsamira[.]no-ip[.]bizsammuiyer[.]ddns[.]netsamoomalik[.]no-ip[.]bizsamsung[.]apps[.]linkpc[.]netsamuseucu[.]ddns[.]netsamy777[.]no-ip[.]bizsandhusim001[.]ddns[.]netsara17911[.]no-ip[.]orgsara19918[.]ddns[.]netsarahwygan[.]no-ip[.]bizsaraia[.]ddns[.]netsarasisi[.]no-ip[.]orgsasi546454[.]hopto[.]orgsatahezub[.]no-ip[.]infosava33[.]ddns[.]netsazan765[.]ddns[.]netscropion20078[.]no-ip[.]bizsecureline2244[.]ddns[.]netsecurepurpose[.]no-ip[.]infosecuritytests[.]ddns[.]netsecuritytestt[.]ddns[.]netsersaisa[.]ddns[.]netserver4update[.]serveftp[.]comservice[.]zosys[.]netservidor23[.]ddns[.]netservr[.]hopto[.]orgsesizkal32[.]no-ip[.]bizsetts[.]no-ip[.]orgseven1[.]ddns[.]netseyf2017[.]linkpc[.]netshabbushah[.]duckdns[.]orgshahabhacker[.]ddns[.]netshahidsajan[.]no-ip[.]bizshakaky[.]ddns[.]netshanks[.]no-ip[.]bizsharawy74[.]hopto[.]orgsharmayash[.]no-ip[.]bizsheamusking34[.]no-ip[.]bizsherlockholmes[.]duckdns[.]orgshgt[.]tkshoo2018[.]no-ip[.]orgshop10[.]ddns[.]netshosh[.]ddns[.]netshowj[.]f3322[.]netsilenthunter3021[.]no-ip[.]orgsimbabweratte[.]hopto[.]orgskinchanger[.]hopto[.]orgskipy[.]ddns[.]netskituljko[.]mooo[.]comskylex123[.]hopto[.]orgslavikkalinovskiy[.]ddns[.]netslayslay[.]duckdns[.]orgsmiix2012[.]ddns[.]netsmk22[.]jkt[.]netsnaider[.]hopto[.]orgsniper-f[.]ddns[.]netsniperviruse3[.]hopto[.]orgsniperyakub[.]ddns[.]netsnopi[.]no-ip[.]bizsocialplus[.]ddns[.]netsofemm[.]no-ip[.]bizsomenormalguy[.]duckdns[.]orgsondres1[.]ddns[.]netsonkar412[.]duckdns[.]orgsorry[.]duckdns[.]orgsosg77[.]ddns[.]netsoso[.]noip[.]usspicymemes[.]duckdns[.]orgspiel007[.]ddns[.]orgspofy[.]ddns[.]netspynote-web[.]dynu[.]comsramic[.]ddns[.]netssjf[.]myftp[.]bizssxdswe[.]no-ip[.]orgstandby1537[.]duckdns[.]orgstoring[.]hopto[.]orgstrateg[.]ddns[.]netstux0net[.]no-ip[.]orgsuckmordecock[.]duckdns[.]orgsuperlegitratvirus[.]ddns[.]netsvn-01[.]ddns[.]netsweetman2020[.]no-ip[.]bizsystem32[.]comtaha100iq[.]hopto[.]orgtaherhacker[.]hopto[.]orgtak[.]no-ip[.]infotakpar67[.]no-ip[.]biztaras1928[.]ddns[.]nettargi01[.]hopto[.]orgtatacall[.]servebeer[.]comtataline[.]hopto[.]orgteda11[.]zapto[.]orgtedy1993[.]ddns[.]nettelegram-stickers[.]noip[.]metelegram-tools[.]no-ip[.]bizteolandia[.]no-ip[.]biztest[.]no-ip[.]orgtest[.]pagez[.]krtest145[.]ddns[.]nettest29[.]ddns[.]nettestan[.]ddns[.]nettestandro[.]ddns[.]nettestapkk[.]hopto[.]orgtestkps[.]ddns[.]nettestsr[.]ddns[.]nettestsss[.]ddns[.]nettesttwo2[.]ddns[.]nettestxy[.]ddns[.]netth3expert[.]3utilities[.]comthaer[.]no-ip[.]biztheblack16[.]ddns[.]netthedroidjack[.]ddns[.]netthegangsterrap[.]noip[.]methegod2[.]ddns[.]netthekillers[.]ddns[.]netthelostan[.]ddns[.]netthemayhen23[.]no-ip[.]orgtnaxin[.]msns[.]cntobytori18[.]myftp[.]orgtom928[.]no-ip[.]biztomyyk[.]ddns[.]nettonyjony[.]ddns[.]nettopmax[.]myq-see[.]comtoyman6699[.]no-ip[.]infotrythelast[.]no-ip[.]orgttn10[.]no-ip[.]orgtunisvista[.]3utilities[.]comudown[.]ddns[.]netufologlyly[.]ddns[.]netumar14344[.]ddns[.]netunknownuser[.]no-ip[.]bizupdater[.]myftp[.]orgupdatesystem[.]dynu[.]comupdatexxx[.]hopto[.]orgusa[.]myftp[.]bizusa20002015[.]ddns[.]netusa2222[.]ddns[.]netuserframer[.]sytes[.]netusernamegopro1[.]ddns[.]netusmh[.]myq-see[.]comuzzal619[.]viewdns[.]netvajausing[.]dynu[.]comvb[.]blogsyte[.]comvego[.]ddns[.]netvetalamator1[.]ddns[.]netviagra[.]jumpingcrab[.]comvictim[.]no-ip[.]orgvigo[.]hopto[.]orgvikas[.]no-ip[.]bizvillevalo[.]chickenkiller[.]comvipmustafa[.]no-ip[.]infovoda[.]no-ip[.]orgvolnado[.]sytes[.]netvpn0[.]ddns[.]netvwelxv[.]ddns[.]netw0rm32[.]ddns[.]netwar10ck[.]serveftp[.]comwarl10ck[.]ddns[.]netwarrirrs[.]no-ip[.]orgwasawalid[.]hopto[.]orgwassam100[.]ddns[.]netwasxmrtdub[.]ddns[.]netwatzeb[.]ddns[.]netwcvwcv[.]picp[.]netwebhack2017[.]ddns[.]netwebi7[.]ddns[.]infoweedforlifehacker[.]ddns[.]netwelcomeheretomept[.]ddns[.]netwhatsradar[.]no-ip[.]bizwildu[.]ddns[.]netwilliettinger[.]ccwin32[.]ddns[.]netwindows12345[.]ddns[.]netwindows7trojan[.]ddns[.]netwinlogen[.]duckdns[.]orgwinserver[.]dlinkddns[.]comwoaisue[.]3322[.]orgwogusnb[.]no-ip[.]infowombocombo[.]mooo[.]comwtfwtf[.]duckdns[.]orgwww[.]177mu[.]cnwxf2009817[.]f3322[.]netx300x300xx[.]no-ip[.]orgx64-windows[.]ddns[.]netxa1newold[.]hopto[.]orgxatar12[.]ddns[.]netxilto[.]duckdns[.]orgxingyuekeji[.]f3322[.]netxmohcine[.]ddns[.]netxmppegy[.]comxnxx123[.]publicvm[.]comxomro[.]no-ip[.]bizxos1982[.]ddns[.]netxtiger007[.]ddns[.]netxyz2145[.]ddns[.]netxzoro2016[.]no-ip[.]infoyamsohe[.]ddns[.]netyangweb[.]f3322[.]netyassinescaleo[.]ddns[.]netyelp01[.]f3322[.]orgyorkiepet[.]ddns[.]netyossf2014[.]no-ip[.]bizyou[.]duckdns[.]orgyounix[.]ddns[.]netyousefehab11[.]ddns[.]netyouseffathii[.]ddns[.]netyoussef-1234[.]hopto[.]orgyuosaf1993[.]ddns[.]netyurimacedo1[.]ddns[.]netza3blawy[.]ddns[.]netzaboza2020[.]ddns[.]netzadehasan1[.]ddns[.]netzaheerkhan786[.]ddns[.]netzakifr[.]no-ip[.]bizzakoo1[.]zapto[.]orgzal75zk[.]ddns[.]netzaliminxx[.]duckdns[.]orgzaqatala[.]dynu[.]comzecovpnhasan1123[.]ddns[.]netzennone[.]ddns[.]netzero228[.]ddns[.]netzoheirdroidjack[.]zapto[.]orgzokor-zokor[.]ddns[.]netzola123[.]no-ip[.]bizzongkahani[.]no-ip[.]bizzouhr9[.]hopto[.]orgzxczxczxc[.]ddns[.]net ... Read More

Dear blog readers,The following is a compilation of publicly accessible information on cyber jihad URLs. Sample domains include:hxxp://7hj[.]comhxxp://alhawali[.]comhxxp://almurabeton[.]orghxxp://anwar-islam[.]comhxxp://aqsavoice[.]nethxxp://fateh[.]ornewsindex[.]phphxxp://lvo[.]infohxxp://palestine-info-urdu[.]comhxxp://qudsway[.]orghxxp://web[.]manartv[.]orghxxp://3asfh[.]comhxxp://abrarway[.]comhxxp://al-ansar[.]bizhxxp://al-ansar[.]nethxxp://al-fateh[.]nethxxp://al-mojahedoon[.]nethxxp://al-nour[.]nethxxp://alaaleb[.]orghxxp://alahed[.]orghxxp://alawajy[.]nethxxp://alemdad[.]orghxxp://alftn[.]orghxxp://alhaq[.]infohxxp://alharamain[.]nethxxp://alharamain[.]orghxxp://alhesbah[.]orghxxp://aljarha[.]orghxxp://alkotla[.]comhxxp://alkotla[.]nethxxp://alkotla[.]orghxxp://alm2sda[.]comhxxp://alm2sda[.]nethxxp://almahdiscouts[.]orghxxp://almjlah[.]nethxxp://almoltaqa[.]orghxxp://almuhajiroun[.]com[.]pkhxxp://almuhajiroun[.]comhxxp://almuk[.]comobmhxxp://almuslimoon[.]comhxxp://alnour[.]nethxxp://alokab[.]comhxxp://alqaida[.]comhxxp://alqassam[.]nethxxp://alrassoul[.]orghxxp://alresalah[.]orghxxp://alsakifah[.]orghxxp://alshahd[.]nethxxp://alshorouq[.]orghxxp://alsunnah[.]orghxxp://altartousi[.]comhxxp://alwatanvoice[.]comhxxp://ansaar[.]infohxxp://aqsavoice[.]comhxxp://as-sabeel[.]comhxxp://as-sahwah[.]comhxxp://ayobi[.]comhxxp://b-alshohda[.]comhxxp://baqiatollah[.]orghxxp://barsomyat[.]comhxxp://bouti[.]nethxxp://caliphate[.]nethxxp://cdlr[.]nethxxp://cihad[.]nethxxp://clearguidance[.]comhxxp://d3wa[.]nethxxp://daralislamia[.]comhxxp://donhost[.]co[.]ukhxxp://ekhlaas[.]comhxxp://elehssan[.]comhxxp://et[.]4t[.]comhxxp://ezzedeen[.]nethxxp://faroq[.]nethxxp://faroq[.]orgnewshxxp://fateh-org[.]orghxxp://fateh[.]orghxxp://fateh[.]tvhxxp://fatehfalcons[.]orghxxp://fatehorg[.]orghxxp://forbidden-news[.]comhxxp://forum[.]tevhidweb[.]comhxxp://h-alali[.]nethxxp://hamasonline[.]comhxxp://hamasonline[.]orghxxp://hayaa[.]orghxxp://hilafet[.]comhxxp://hizb-ut-tahrir[.]dkhxxp://hizb-ut-tahrir[.]orghxxp://hizballah[.]orghxxp://hizbollah[.]orghxxp://hizbollah[.]tvhxxp://hosteurope[.]comhxxp://ikhwan[.]nethxxp://ilakat[.]orghxxp://infopalestina[.]comhxxp://instimata[.]comhxxp://intiqad[.]comhxxp://iraqirabita[.]nethxxp://islam-minbar[.]nethxxp://islam-qa[.]comhxxp://islamic-bloc[.]nethxxp://islamic-block[.]orghxxp://islamic-minbar[.]comhxxp://islamicawakening[.]comhxxp://islamicbloc[.]nethxxp://islamicblock[.]comhxxp://islamichackers[.]comhxxp://islammessage[.]comhxxp://istimata[.]comhxxp://iu-shabeba[.]orghxxp://jahido[.]comhxxp://jahido[.]comhxxp://jahra[.]orghxxp://jamaaway[.]orghxxp://jewstoislam[.]comhxxp://jihadbinaa[.]orghxxp://jihadislami[.]orghxxp://jihadonline[.]nethxxp://jihadunspun[.]comhxxp://jimail[.]comhxxp://jimail[.]comhxxp://jimails[.]comhxxp://jwebs[.]nethxxp://jwebs[.]orghxxp://kataeb-ezzeldeen[.]comhxxp://kataebabuali[.]comhxxp://kataebabuali[.]nethxxp://kataebabuali[.]orghxxp://kataebalaqsa[.]comhxxp://kataebalaqsa[.]orghxxp://kataebaqsa[.]comhxxp://kataebaqsa[.]nethxxp://kataebaqsa[.]orghxxp://kataebaqsa1[.]comhxxp://kataebaqsaforum[.]orghxxp://kataebq[.]comhxxp://khayma[.]comhxxp://khiamwatch[.]nethxxp://khilafah[.]comhxxp://maac[.]wshxxp://maktab-al-jihad[.]comhxxp://manartv[.]comhxxp://mawlawi[.]nethxxp://mojahedun[.]comhxxp://moqawama[.]nethxxp://moqawama[.]orghxxp://moqawama[.]tvhxxp://muslimeen[.]co[.]ukhxxp://naimkassem[.]orghxxp://nasrallah[.]nethxxp://nasrollah[.]nethxxp://nasrollah[.]orghxxp://obm[.]clara[.]nethxxp://openforum[.]wshxxp://palestine-info[.]cchxxp://palestine-info[.]co[.]ukhxxp://palestine-info[.]comhxxp://palestine-info[.]infohxxp://palestine-info[.]nethxxp://palestine-info[.]ruhxxp://palestine-persian[.]infohxxp://palestinegallery[.]comhxxp://palestineway[.]comhxxp://palestinianforum[.]nethxxp://palsm[.]comhxxp://palvoice[.]comhxxp://palvoice[.]comhxxp://pflp-gc[.]orghxxp://qal3ah[.]nethxxp://qana[.]nethxxp://qaradawi[.]netsitehxxp://qawim[.]orghxxp://qudsnews[.]nethxxp://qudsonline[.]nethxxp://qudsway[.]comhxxp://qudsway[.]nethxxp://rabdullah[.]comhxxp://rabdullah[.]nethxxp://rantisi[.]nethxxp://register[.]comhxxp://ribaat[.]orghxxp://rightword[.]nethxxp://saaid[.]nethxxp://sabiroon[.]comhxxp://sabiroon[.]nethxxp://sabiroon[.]orghxxp://sadaaljihad[.]nethxxp://sahwah[.]comhxxp://salafiahweb[.]tkhxxp://sarayaalquds[.]comhxxp://sarayaalquds[.]orghxxp://shareeah[.]comhxxp://shareeah[.]orghxxp://shikaki[.]comhxxp://shikaki[.]nethxxp://shuhadaa[.]orghxxp://specialforce[.]nethxxp://sraya[.]comhxxp://stcom[.]nethxxp://tawhed[.]wshxxp://the-revival-forum[.]infohxxp://trouble-free[.]nethxxp://wilayah[.]comhxxp://wilayah[.]irhxxp://wilayah[.]nethxxp://wilayah[.]orghxxp://worldofislam[.]infohxxp://yaislah[.]orghxxp://alaaleb[.]orghxxp://aljarha[.]orghxxp://alkotla[.]comhxxp://alwatanvoice[.]comhxxp://as-sabeel[.]comhxxp://daralislamia[.]comhxxp://dci[.]co[.]irhxxp://elehssan[.]comhxxp://forum[.]tevhidweb[.]comhxxp://ibtekarat[.]comhxxp://infopalestina[.]comhxxp://jihadunspun[.]comhxxp://jwebs[.]orghxxp://khayma[.]comhxxp://palestine-info[.]ruhxxp://qana[.]nethxxp://sarayaalquds[.]comhxxp://the-revival-forum[.]infohxxp://wilayah[.]org ... Read More

This is from the "correct if I'm wrong but this is publicly accessible information so why shouldn't I take a look at it" department.I've been recently going though Snowden's archive and I came across to my favorite presentation which is on the topic of 4th party collection and now that ... Read More

Folks,Do you remember the international embassies web malware exploitation spree using client-side exploits that took place back in 2009 with the Russian Business Network the hosting provider of choice for these campaigns?I recently took the effort to look at my original data set here and tried to enrich it and ... Read More

Dear blog readers,The following is a compilation of URLs of known DDoS attack stresser tools.Sample URLs:hxxp://str3ssed[.]comhxxp://dream-stresser[.]suhxxp://zdstresser[.]nethxxp://darkvr[.]iohxxp://tresser[.]iohxxp://xstress[.]tophxxp://blaststress[.]ruhxxp://dreams-stresser[.]cohxxp://dreams-stresser[.]suhxxp://hatter[.]cloudhxxp://undisclosed[.]ishxxp://mythicalstress[.]xyzhxxp://dragonstresser[.]nethxxp://inverse[.]shhxxp://stresser[.]zonehxxp://ipstresser[.]mehxxp://blaze-api[.]cchxxp://vacstresser[.]orghxxp://stressers[.]iohxxp://stresslab[.]cchxxp://stresser[.]sthxxp://tokenview[.]lifehxxp://stressthem[.]tohxxp://stresshit[.]clubhxxp://stresser[.]ishxxp://cyberbooter[.]nethxxp://stresser[.]gahxxp://metastresser[.]iohxxp://stresser[.]suhxxp://wrldsecurity[.]nethxxp://hexstresser[.]orghxxp://ipstresser[.]ltdhxxp://urgstresser[.]comhxxp://cryptostresser[.]viphxxp://silentstress[.]cchxxp://freestresser[.]tophxxp://joker[.]shhxxp://ddoser[.]viphxxp://stresser[.]websitehxxp://liquidsec[.]spacehxxp://quickdown[.]prohxxp://demonicstresser[.]xyzhxxp://stressed[.]suhxxp://ddos[.]schxxp://panel[.]ddos[.]schxxp://mao-stress[.]techhxxp://neostress[.]nethxxp://crazystresser[.]nethxxp://susstresser[.]xyzhxxp://stresse[.]rehxxp://ddosstresser[.]comhxxp://redstresser[.]nethxxp://zeusstress[.]funhxxp://getstress[.]ushxxp://ipstresser[.]prohxxp://thunderstresser[.]suhxxp://ipstresser[.]sxhxxp://lkxstress[.]suhxxp://starkstresser[.]nethxxp://stresser[.]techhxxp://io9[.]suhxxp://stresser[.]mediahxxp://nkstresser[.]nethxxp://vanishstress[.]comhxxp://booter[.]cchxxp://quantum-stresser[.]orghxxp://Freeddos[.]pwhxxp://cfxsecurity[.]ruhxxp://stresse[.]ruhxxp://ddg[.]lolhxxp://1981[.]rehxxp://mythicalstress[.]nethxxp://stresser[.]pehxxp://packetsto[.]mehxxp://quantum-stress[.]orghxxp://shock-stresser[.]orghxxp://stresser[.]cityhxxp://stresslab[.]sxhxxp://sunstresser[.]nethxxp://informants[.]suhxxp://zerostresser[.]nethxxp://elitesecurity[.]cchxxp://orbitalstress[.]orghxxp://stresser[.]ovhhxxp://wrldsecurity[.]orghxxp://warapi[.]nethxxp://volitystress[.]viphxxp://infinity-studios[.]icuhxxp://stressednet[.]xyzhxxp://stresse[.]apphxxp://solostress[.]nethxxp://silentstress[.]nethxxp://downed[.]ishxxp://cryptostresser[.]orghxxp://rocket-stress[.]comhxxp://ipstresser[.]gghxxp://spacestresser[.]comhxxp://stresseruno[.]nethxxp://royalstresser[.]nethxxp://lkxstress[.]ushxxp://stresser[.]aihxxp://stresser[.]funhxxp://neostresser[.]ushxxp://webstress[.]xyzhxxp://999stresser[.]gayhxxp://l7stresser[.]comhxxp://nukebooter[.]orghxxp://stresser[.]unohxxp://virtualstress[.]nethxxp://TarkovStresser[.]comhxxp://rolexapi[.]xyzhxxp://quez[.]inhxxp://redstresser[.]orghxxp://atomic-stresser[.]xyzhxxp://bootcaat[.]frhxxp://apinigger[.]buzzhxxp://alya[.]devhxxp://ackflood[.]ishxxp://stresserhub[.]orghxxp://inverse[.]besthxxp://securityhide[.]nethxxp://stresse[.]cathxxp://ripstresser[.]tophxxp://digitalstress[.]nethxxp://topstresser[.]tophxxp://scystress[.]xyzhxxp://silentstress[.]wtfhxxp://powerstresser[.]prohxxp://destroyersv[.]besthxxp://sunipstresser[.]comhxxp://stressergg[.]comhxxp://atom-stresser[.]nethxxp://anonstress[.]comhxxp://zxstresser[.]xyzhxxp://ciasecrets[.]suhxxp://cloudleague[.]dehxxp://intelsecrets[.]suhxxp://downon[.]clickhxxp://prostress[.]prohxxp://ipstress[.]viphxxp://pluto[.]cxhxxp://ovhstresser[.]comhxxp://orbital-solutions[.]xyzhxxp://nulling[.]ithxxp://minecraftstresser[.]nethxxp://loudstresser[.]nethxxp://inversecurity[.]orghxxp://exoticbooter[.]comhxxp://spacestresser[.]nethxxp://hkstresser[.]nethxxp://hirestresser[.]nethxxp://high-stress[.]comhxxp://heydos[.]cchxxp://freestresser[.]net ... Read More

In this post I'll elaborate more on some of the current activities of a well known Darkode forum member namely Nassef which we can clearly see here in the Darkode repository of research.Known email: [email protected] currently active known domain registrations:hxxp://tonymontana.suhxxp://hack-mirror.nethxxp://tonymontana.cardshxxp://tonymontana.cashhxxp://tonymontana.bizSample photos of related Darkode members:Sample personal photo of Eric L Crocker also ... Read More

This is the second tip of the day where I'll do my best to use Technical Collection and offer a peek inside a pretty in-depth and comprehensive list of 138 ransomware-themed Tox IDs for research and analysis and attribution purposes.Here's the complete list of ransowmare-themed Tox IDs:9A751AC90A5F020521EE40D58208C272BD18D2E0C934AB6DA9B918627578095CD9847E24CE593488458145EB62D7D3947E3811234F4663D9B5AEEF6584AB08A2099A7F946664BBA2B0D30BFCD83B98E47E1929E5EF9A665CEAB53177FC376B6CC857D3148334017A3CE26910DF690179C0937367B422CD7498D5F2AAF33F58F67A332F8520CF0279A5FBB4611E0121AE421AE1D49ACEABB27367B422CD7498D5F2AAF33F58F67A332F8520CF0279A5FBB4611E0121AE421AE1D49ACEABB2D3404141459BC7206CC4AFEC16A3403F262C0937A732C12644E7CA97F0615201A519F7EAB2E24AE245548F2A225882951FB14E9BF87EE01A0C10AE159B99D1EA62620D91A372205227254A9FD27A7B3711CD1442A8FAC19BB5780FF291101F6286A62AD21E5F7F08BD5F5F1B9803AAC6ECF94A4966259BE6EB1341A2A6A06EA25D747354257EA47F5FD4987A0760FFAEAB1E8E8955A0354FA4B3B0845DA242A64BF17E0DB4278EDF85855739667D3E2AE8B89D5439015F07E81D12D767FCAB33BC51AFAC64D98226826E70B483593C81CB22E6A3B504F7A75348C38C862F00042F5245ACA0FE105A82525ECB94DD2977B4A1F8A5A7CF82F12D720DD8C8D9CCA3F98B6F52D911126AC1DF9500B1A73716BCF40745086F7184A33EA0141B7D3F852431C8FDD2E1E8FAF9277E9FDC117B471C054B722BCBF41A918EF3C485712742088F5C3E81B2FDD91ADEA6BA55F4A856D90A65E99D20192D52C7C18F3D2693ED2453E64C53EC0CCF0255AB2291F019B65BA84442B313C410DE132E59CAB3D74D1DADE95B52928E4D9DFC003FF5ADB2E082F59377D049A91952E8BB3B419DB2FA9D3F7229828E766B9058D329B2B4BC0EDDD11612CBCCFA4811532CABC76ACF703074E0D1501F841883E6E3CFEC0E4C8E7F7B6E01F6E86CF70AE8D4E75A59126A2C52FE9F568B4072CA78EF2B3C970FF26770BFAEAD95194506E6970CC1C395B04159038D785DE316F05CE6DE67324C6038727A5898D120C9033653042E290627914B890A3291013F7377A976A028051C52440C71487D5F14DDA23488458145EB62D7D3947E3811234F4663D9B5AEEF6584AB08A2099A7F946664BBA2B0D30BFC 9796CE1E72A8874D594F6573F44C94FB649473B4194DCD80C406BFE88E4B3662A375E78FB436A4B3B0845DA242A64BF17E0DB4278EDF85855739667D3E2AE8B89D5439015F07E81D12D767FC 36A73D90C66948D9268BDC4174A40E0064C43F10A35AEAA9DD74B3A14EF5654872D5DC67FC14 5B85F0F52F989C42FE18A08351D4B9F50D7A9832DBE4A068346DE35D5CF8F410BF89FA7A7AFF37790E2D198DFD20C9D2887D4EF7C3E2951BB84248D192689B64DCCA3C8BD808A1895676B271 ... Read More