Comments on: SimpleTDS as part of RedKit Exploit Kit http://ondailybasis.com/blog/?p=1236 Thu, 14 Mar 2013 08:01:10 +0000 hourly 1 http://wordpress.org/?v=3.5.1 By: Denis http://ondailybasis.com/blog/?p=1236&cpage=1#comment-515 Denis Fri, 07 Sep 2012 11:04:51 +0000 http://ondailybasis.com/blog/?p=1236#comment-515 2MimoJP
Well, good for You. But why You surprized – on underground market, if You wish to pay, always You’ll find someone who will sell You all, even stuff that available for free. :)

]]> By: MimoJP http://ondailybasis.com/blog/?p=1236&cpage=1#comment-506 MimoJP Wed, 05 Sep 2012 14:39:06 +0000 http://ondailybasis.com/blog/?p=1236#comment-506 > Or You blocked by list of IP’s of known malware hunting companies, they also available for sale.

Oh for sale? I don’t know how much data that is and for what price but –> since the beginning of 2012 I collected such lists (from phish-kits or backdoored sites) and put the data into a sqlite db. Currently 1812 entries of IPs/ranges – for free :D

]]> By: Denis http://ondailybasis.com/blog/?p=1236&cpage=1#comment-501 Denis Wed, 05 Sep 2012 06:38:59 +0000 http://ondailybasis.com/blog/?p=1236#comment-501 Thx, MimoJP!
It actually is interesting to see internal config, but legally problematic to break-in to the malicious hosts, even if they spread malware and vulnerable to public exploits :)
In fact, for now chain is partially dead, so it possible You get 302 to Google,
Or You blocked by list of IP’s of known malware hunting companies, they also available for sale.
Regards
D.L.

]]> By: MimoJP http://ondailybasis.com/blog/?p=1236&cpage=1#comment-499 MimoJP Wed, 05 Sep 2012 02:25:21 +0000 http://ondailybasis.com/blog/?p=1236#comment-499 Hello,

Nice post, thanks much!
It would be interesting to see the .htaccess file from such sites.
My first attempt to get the above mentioned payload ended up with a redirect to google.com.
Checking from different IPs gave the desired data though – which suggests blocking of certain IPs is used.

Cheers

]]>