The whole malware campaign started from a Dutch webhoster Webzilla, and some other Dutch hosters.
Now these new domains, often not yet blocked or given as malicious,
they were reported by Security.NL’s SecGuru_OTX (info credits here should go to him!).
I give them as he gave them in his post at Security.nl news:
-185.117.73.18
*.inbvq0t.-top
*.tyxnetcomp.-com
-108.61.167.148
*.yourdreamwealth. com
*.maslakagaoglu1453. com
*.superwealthysecret. com
*.maslakmyhome. net
*.maslaknurolplaza. net
*.maslak-eclipse. com
*.maslaknurolplaza. com
*.theloveimpact. com
*.leventkanyon. net
*.maslak-eclipse. net
*.maslakmashattan. net
*.maslak-myhome. com
*.maslakkiralikofis. com
*.thedailyshortcuts. com
*.maslaksatilikofis. com
*.thelovehandout. com
*.yourdailyshortcut. com
*.thelifestyledesigners. com
*.maslakparkplaza. net
*.maslakparkplaza. com
*.maslakresidence. org
*.maslakmashattan. org
*.best4u. bg
-109.234.34.166
*.usocenter. net
*.yapikrediplaza. com
*.vekogizplaza. net
*.polarisplaza. com
*.vadistanbul. biz
*.toruntower. net
*.moormanenterprisesllc. com
*.medlawinc. us
*.springgizplaza. net
*.mmlc. us
*.medparency. org
*.medparency. us
*.tekfentower. net
*.maslakvadistanbul. net
*.sunplaza. org
*.medlawinc. org
*.spine-tower. org
*.spineplaza. com
*.spine-tower. net
*.nidakulelevent. net
*.yapikrediplaza. net
*.trumptower. biz
*.nidapark. net
*.nidaparkseyrantepe. net
dm-hosting. ru
*.nidakule. net
upavito. ru
*.moormanmedia. com
add.spine-tower. org
*.saffo. ru
*.dm-hosting. ru
*.kanapka. ru
kanapka. ru
*.nuroltower. biz
hosting-serverok. ru
*.hosting-serverok. ru
axciom-ofline. com
*.upavito. ru
Do to this list as you see appropriate (add to a blocklist, block with block this link, add to IDs etc. etc.
polonus (volunteer website security analyst and website error-hunter)
