polonus
1
See: http://killmalware.com/ndsworlds.com/#
Unable to properly scan site. Unable to connect.
Scan result:
<html><head><title></title></head>
<frameset rows="*" frameborder="no" border="0" framespacing="0">
<frame src="http://wikipedia.org" name="mainFrame"></frame>
</frameset>
</html>
On Cloudflare: http://toolbar.netcraft.com/site_report?url=http%3A%2F%2Fndsworlds.com%2F
See IP history: https://www.virustotal.com/nl/ip-address/104.28.9.81/information/
Trojan ZBot detected on IP and Backdoor Sinowall.
polonus
polonus
2
One of the redirects that was taken down: http://hide-my-wallet-now.com/
http://toolbar.netcraft.com/site_report?url=+https%3A%2F%2Fhide-my-wallet-now.com
as well as the url: -http://69.64.57.147/ → a 404 → http://urlquery.net/report.php?id=1438879829533
http://www.dnsinspect.com/hide-my-wallet-now.com/1441663402
Recent zone transfer performed: We found different serial numbers on your name servers, it’s OK if you had modified your zone recently.
No private IPs found for www.hide-my-wallet-now.com… Web servers using private IPs can’t be reached from the Internet.
→ http://whois.domaintools.com/hide-my-wallet-now.com
Hosting History 1 change on 2 unique name servers over 1 year
pol