Fast Flux

 
  Dear Team, 
   
  INTECO-CERT is a public entity devoted to provide preventive and reactive measures against security 
  incidents in Information Technologies to Spanish SMEs and citizens. 
   
  Attached some data about IPs from your country involved in Fast-Flux domains resolution, likely to 
  be members of a botnet. This information is collected by DNS resolution. 
   
  Some of those domains may not resolve, because the files are generated daily with information 
  gathered in last 24 hours. 
   
  File Format: 
   
  [Timestamp] [IP] [Domain] [ASN] [Country] [AS_Name] 
   
  25/4/2010 18:25:01 85.25.73.168 yourtestlab.ru 8972 DE PLUSSERVER-AS PlusServer AG, Germany 
  25/4/2010 18:25:51 85.25.73.168 stareastwork.ru 8972 DE PLUSSERVER-AS PlusServer AG, Germany 
  25/4/2010 21:44:12 85.25.73.168 seagoldonline.ru 8972 DE PLUSSERVER-AS PlusServer AG, Germany 
  25/4/2010 21:38:47 85.25.73.168 rubytube.ru 8972 DE PLUSSERVER-AS PlusServer AG, Germany 
  25/4/2010 21:37:23 85.25.73.168 regaught.ru 8972 DE PLUSSERVER-AS PlusServer AG, Germany 
  25/4/2010 21:45:42 85.25.73.168 redtaggift.ru 8972 DE PLUSSERVER-AS PlusServer AG, Germany 
  25/4/2010 21:45:11 85.25.73.168 redtagcentral.ru 8972 DE PLUSSERVER-AS PlusServer AG, Germany 
  25/4/2010 18:20:49 85.25.73.168 pokesack.ru 8972 DE PLUSSERVER-AS PlusServer AG, Germany 
  25/4/2010 18:26:02 85.25.73.168 pillsshopping.com 8972 DE PLUSSERVER-AS PlusServer AG, Germany 
  25/4/2010 21:37:23 85.25.73.168 oneroomhome.info 8972 DE PLUSSERVER-AS PlusServer AG, Germany 
  25/4/2010 16:43:48 85.25.73.168 suncoastatlas.info 8972 DE PLUSSERVER-AS PlusServer AG, Germany 
  25/4/2010 21:37:48 85.25.73.168 sunstarvideo.info 8972 DE PLUSSERVER-AS PlusServer AG, Germany 
  25/4/2010 18:06:22 85.25.73.168 yoursunvalley.ru 8972 DE PLUSSERVER-AS PlusServer AG, Germany 
  25/4/2010 21:38:19 85.25.73.168 yourprintroom.info 8972 DE PLUSSERVER-AS PlusServer AG, Germany 
  25/4/2010 15:37:13 85.25.73.168 yourblendermagazine.ru 8972 DE PLUSSERVER-AS PlusServer AG, Germany 
  25/4/2010 21:45:11 85.25.73.168 yesdearsite.ru 8972 DE PLUSSERVER-AS PlusServer AG, Germany 
  25/4/2010 15:37:23 85.25.73.168 thestocksite.ru 8972 DE PLUSSERVER-AS PlusServer AG, Germany 
  25/4/2010 15:38:14 85.25.73.168 teamhotworld.ru 8972 DE PLUSSERVER-AS PlusServer AG, Germany 
  25/4/2010 17:43:59 85.25.73.168 sweetsitetools.ru 8972 DE PLUSSERVER-AS PlusServer AG, Germany 
  25/4/2010 17:55:20 85.25.73.168 supersunbeds.info 8972 DE PLUSSERVER-AS PlusServer AG, Germany 
  25/4/2010 21:38:47 85.25.73.168 superhoppie.ru 8972 DE PLUSSERVER-AS PlusServer AG, Germany 
  25/4/2010 21:36:43 85.25.73.168 onelovedirect.at 8972 DE PLUSSERVER-AS PlusServer AG, Germany 
  25/4/2010 15:37:11 85.25.73.168 newworldunion.ru 8972 DE PLUSSERVER-AS PlusServer AG, Germany 
  25/4/2010 15:38:29 85.25.73.168 crewamerica.ru 8972 DE PLUSSERVER-AS PlusServer AG, Germany 
  25/4/2010 21:44:12 85.25.73.168 counterbest.ru 8972 DE PLUSSERVER-AS PlusServer AG, Germany 
  25/4/2010 18:26:13 85.25.73.168 clandarkguide.info 8972 DE PLUSSERVER-AS PlusServer AG, Germany 
  25/4/2010 15:43:44 85.25.73.168 cheatsin.ru 8972 DE PLUSSERVER-AS PlusServer AG, Germany 
  25/4/2010 21:45:43 85.25.73.168 blendermagazineonline.ru 8972 DE PLUSSERVER-AS PlusServer AG, Germany 
  25/4/2010 21:37:47 85.25.73.168 bigorangeblender.ru 8972 DE PLUSSERVER-AS PlusServer AG, Germany 
  25/4/2010 21:38:47 85.25.73.168 battop.ru 8972 DE PLUSSERVER-AS PlusServer AG, Germany 
  25/4/2010 17:54:13 85.25.73.168 aspensupersite.ru 8972 DE PLUSSERVER-AS PlusServer AG, Germany 
  25/4/2010 21:44:12 85.25.73.168 allreadyread.ru 8972 DE PLUSSERVER-AS PlusServer AG, Germany 
  25/4/2010 21:37:23 85.25.73.168 eroomsite.info 8972 DE PLUSSERVER-AS PlusServer AG, Germany 
  25/4/2010 21:44:12 85.25.73.168 genuinehollywood.ru 8972 DE PLUSSERVER-AS PlusServer AG, Germany 
  25/4/2010 21:43:38 85.25.73.168 newhomelady.ru 8972 DE PLUSSERVER-AS PlusServer AG, Germany 
  25/4/2010 21:44:12 85.25.73.168 newgolfonline.ru 8972 DE PLUSSERVER-AS PlusServer AG, Germany 
  25/4/2010 18:25:34 85.25.73.168 myhomeorder.ru 8972 DE PLUSSERVER-AS PlusServer AG, Germany 
  25/4/2010 15:37:07 85.25.73.168 myfreetans.ru 8972 DE PLUSSERVER-AS PlusServer AG, Germany 
  25/4/2010 17:54:14 85.25.73.168 loadtube.ru 8972 DE PLUSSERVER-AS PlusServer AG, Germany 
  25/4/2010 21:38:19 85.25.73.168 harassdeceive.ru 8972 DE PLUSSERVER-AS PlusServer AG, Germany 
  25/4/2010 21:45:11 85.25.73.168 greatmyown.ru 8972 DE PLUSSERVER-AS PlusServer AG, Germany 
  25/4/2010 15:38:30 85.25.73.168 greateastbay.ru 8972 DE PLUSSERVER-AS PlusServer AG, Germany 
  25/4/2010 18:06:33 85.25.73.168 grateinterrupt.ru 8972 DE PLUSSERVER-AS PlusServer AG, Germany 
  25/4/2010 21:45:42 85.25.73.168 airnetdirect.ru 8972 DE PLUSSERVER-AS PlusServer AG, Germany 
   
  **Timestamp format is dd/mm/yyyy hh:mm:ss GMT+2** 
   
  As this information is collected from public services, you can share it with other involved entities 
  (like ISPs, other enterprises or CERTs). 
   
  Thank you for your cooperation to prevent and terminate this kind of activities. 
  You can contact us if you detect any fraudulent activity under a .es domain or related with spanish 
  resources, and we would try to help you to solve it. 
   
  Best Regards, 
  ------------------------------------------------------------------------- 
  INTECO-CERT for SME and citizens 
  incidencias@cert.inteco.es -http://cert.inteco.es 
  PGP Key:http://cert.inteco.es/About/PGP_Public_keys/ 
  National Institute of Communication Technologies 
  Avenida Jose Aguado, 41. 
  24005 - Leon (SPAIN)