1 reply to this topic

[Sparsha]

There is a huge list of DNS trojan distributing sites listed on sunbelt blog

64.28.184.181
abccodec(dot)com


64.28.184.167
blackcodec(dot)net


64.28.184.172
citycodec(dot)com


64.28.184.171
cleancodec(dot)com


64.28.184.190
codecbest(dot)com


64.28.184.189
codecdemo(dot)com


64.28.184.188
codecmega(dot)com


64.28.184.186
codecnitro(dot)com


64.28.184.187
codecred(dot)net


64.28.184.185
codecspace(dot)com


64.28.184.183
delficodec(dot)com


64.28.184.168
democodec(dot)com


64.28.184.170
endcodec(dot)com


64.28.184.178
gamecodec(dot)com


64.28.184.169
gigacodec(dot)net


64.28.184.174
herocodec(dot)com


64.28.184.177
ixcodec(dot)com


64.28.184.175
jetcodec(dot)com


64.28.184.164
lightcodec(dot)net


64.28.184.163
mooncodec(dot)com


64.28.184.169
nicecodec(dot)com


64.28.184.182
popcodec(dot)net


64.28.184.162
qazcodec(dot)com


64.28.184.166
redcodec(dot)net


64.28.184.173
stormcodec(dot)net


64.28.184.165
turbocodec(dot)net


64.28.184.176
uincodec(dot)com


64.28.184.179
whitecodec(dot)com


64.28.184.180
xerocodec(dot)com


64.28.184.184
xhcodec(dot)com

Reference: http://sunbeltblog.blogspot.com/2007/10/so...r-blocking.html

[TeMerc]

Blog maintained by one of the pros over at Malware Research:
http://peki.blogspot.com/

Tons of IPs there.