Site only blacklisted or also compromised? No Siinkholed by FBI!

Viruses and worms
1

See: http://lists.clean-mx.com/pipermail/viruswatch/20141107/205047.html
and https://www.virustotal.com/nl/url/4f7adb9c66a40b406475f0b9b89644163283e180dcdbfe861ebf3428b447bffe/analysis/1415397385/
Not a safe website environment for visiyors. Site Potentially Harmful.
• Elapsed time so far: 2 seconds
• Waiting for additional response until connection closes…
The domain name zjnnbfmzlxwrgevwhmdbaorxopfin dot com is listed on the Spamhaus DBL.
Domain info: http://whois.domaintools.com/zjnnbfmzlxwrgevwhmdbaorxopfin.com
IP Address 54.83.43.69 - 18,264 other sites hosted on this server
IP badness history: https://www.virustotal.com/nl/ip-address/54.83.43.69/information/
Listed here:
On P2PZeus crackdown by the govmt.
The list below is all of the Gameover Zeus sinkholes we know about, and when we last got a detection from them. it is suggested that you check traffic to all of these IP addresses, but, if you can only do one or two at a time, start with the one at the top and work downwards.

Text
Sinkhole IP Last seen Age Minutes
54.83.43.69 Thu Jun 5 20:41:00 2014 0
142.0.36.234 Wed Jun 4 22:00:00 2014 1361
85.159.211.119 Tue Jun 3 23:54:43 2014 2686
208.64.121.161 Tue Jun 3 03:10:21 2014 3930
198.98.103.253 Mon Jun 2 07:27:04 2014 5114
192.42.116.41 Thu May 29 23:18:47 2014 9922
192.42.119.41 Tue May 27 21:44:04 2014 12897
173.193.197.194 Tue May 27 14:47:45 2014 13313

pol

2

See more of these domains registered with such purposes: http://domains-by-day.com/2014-09-17/domains-1344.html
Also see tastereports on these: http://www.webmail.tastereports.com/archives.html?type=added&registrar_id=65535&stat_date=2014-09-17&start=74400
No all sites in this thread were sonkholed by the FBI. www.zhtccaibhylgathyjvjzojorbebmnf dot com,54.83.43.69,Sinkhole by FBI,
Why they now appeared up in Clean MX VirusWatch Archives is unknown to me.
Cryptolocker was also launched from the IP: 54.83.43.69, see Adam Brenner here: http://comments.gmane.org/gmane.network.tor.relay/4686
IP badness history: https://www.virustotal.com/nl/ip-address/54.83.43.69/information/
domain info: http://whois.domaintools.com/zhtccaibhylgathyjvjzojorbebmnf.com
Quttera Blacklisted. DNS report: http://www.dnsinspect.com/zhtccaibhylgathyjvjzojorbebmnf.com/1415399887
Web servers using private IPs can’t be reached from the Internet. means sinkholed! Reverse DNS zeus-sink.fbi-cyber.net

polonus

3

Update 2018 on sinkholed domain: https://urlquery.net/report/bded8b53-690d-48d0-bf5b-f3f744a01398
see: https://otx.alienvault.com/indicator/ip/192.42.119.41
Read: https://www.abuseat.org/shtracer.pl
see: https://cymon.io/192.42.119.41
Re: https://www.threatminer.org/host.php?q=192.42.119.41

polonus