Home

Asprox domain Jan 26 and some more Downadup/Conficker

January 26, 2009 - 19:13 — Rune

The Asprox domain:
debug-script40.biz. (Found on URIBL.COM).
Not serving the usual javascript files at the moment.
(There are probably more of them)

Some expected Downadup/Conficker domains, shows up on the Asprox botnet:
fmhxqutvccr.org, fmkopswuzhj.biz, fuougcdv.org, fvwugekf.info, fwkbt.info, gbxpxugx.org, ghtileh.biz, gnyluuxneo.com.
And highly possible several others.

An image illustrates one common IP:
Showing both Asprox and Downadup domains on the same IP

See also: "fnygfr.com - Asprox? Downadup/Conficker?"

Whois info

debug-script40.biz - Asprox

Domain Name:                                 DEBUG-SCRIPT40.BIZ
Domain ID:                                   D29440427-BIZ
Sponsoring Registrar:                        DIRECTI INTERNET SOLUTIONS PVT. LTD. D/B/A PUBLICDOMAINREGISTRY.COM
Sponsoring Registrar IANA ID:                303
Domain Status:                               clientTransferProhibited
Registrant ID:                               DI_9279155
Registrant Name:                             Richard Toth
Registrant Organization:                     N/A
Registrant Address1:                         5086 GOLF CLUB LANE
Registrant City:                             BROOKSVILLE
Registrant State/Province:                   Florida
Registrant Postal Code:                      34609
Registrant Country:                          United States
Registrant Country Code:                     US
Registrant Phone Number:                     +001.3525448160
Registrant Email:                            uramymutegeq@gmail.com
Administrative Contact ID:                   DI_9279155
Administrative Contact Name:                 Richard Toth
Administrative Contact Organization:         N/A
Administrative Contact Address1:             5086 GOLF CLUB LANE
Administrative Contact City:                 BROOKSVILLE
Administrative Contact State/Province:       Florida
Administrative Contact Postal Code:          34609
Administrative Contact Country:              United States
Administrative Contact Country Code:         US
Administrative Contact Phone Number:         +001.3525448160
Administrative Contact Email:                uramymutegeq@gmail.com
Billing Contact ID:                          DI_9279155
Billing Contact Name:                        Richard Toth
Billing Contact Organization:                N/A
Billing Contact Address1:                    5086 GOLF CLUB LANE
Billing Contact City:                        BROOKSVILLE
Billing Contact State/Province:              Florida
Billing Contact Postal Code:                 34609
Billing Contact Country:                     United States
Billing Contact Country Code:                US
Billing Contact Phone Number:                +001.3525448160
Billing Contact Email:                       uramymutegeq@gmail.com
Technical Contact ID:                        DI_9279155
Technical Contact Name:                      Richard Toth
Technical Contact Organization:              N/A
Technical Contact Address1:                  5086 GOLF CLUB LANE
Technical Contact City:                      BROOKSVILLE
Technical Contact State/Province:            Florida
Technical Contact Postal Code:               34609
Technical Contact Country:                   United States
Technical Contact Country Code:              US
Technical Contact Phone Number:              +001.3525448160
Technical Contact Email:                     uramymutegeq@gmail.com
Name Server:                                 NS1.DEBUG-SCRIPT40.BIZ
Name Server:                                 NS2.DEBUG-SCRIPT40.BIZ
Name Server:                                 NS3.DEBUG-SCRIPT40.BIZ
Name Server:                                 NS4.DEBUG-SCRIPT40.BIZ
Name Server:                                 NS5.DEBUG-SCRIPT40.BIZ
Created by Registrar:                        DIRECTI INTERNET SOLUTIONS PVT. LTD. D/B/A PUBLICDOMAINREGISTRY.COM
Last Updated by Registrar:                   DIRECTI INTERNET SOLUTIONS PVT. LTD. D/B/A PUBLICDOMAINREGISTRY.COM
Domain Registration Date:                    Mon Jan 26 09:55:15 GMT 2009
Domain Expiration Date:                      Mon Jan 25 23:59:59 GMT 2010
Domain Last Updated Date:                    Mon Jan 26 10:04:43 GMT 2009

; <<>> DiG 9.3.5-P2 <<>> debug-script40.biz
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31529
;; flags: qr rd ra; QUERY: 1, ANSWER: 14, AUTHORITY: 5, ADDITIONAL: 0

;; QUESTION SECTION:
;debug-script40.biz.            IN      A

;; ANSWER SECTION:
debug-script40.biz.     600     IN      A       70.232.165.10
debug-script40.biz.     600     IN      A       71.8.90.224
debug-script40.biz.     600     IN      A       71.93.85.208
debug-script40.biz.     600     IN      A       71.235.251.99
debug-script40.biz.     600     IN      A       75.0.255.167
debug-script40.biz.     600     IN      A       75.11.10.101
debug-script40.biz.     600     IN      A       75.75.104.133
debug-script40.biz.     600     IN      A       76.124.170.244
debug-script40.biz.     600     IN      A       76.181.133.63
debug-script40.biz.     600     IN      A       173.16.99.131
debug-script40.biz.     600     IN      A       69.14.27.151
debug-script40.biz.     600     IN      A       69.176.46.57
debug-script40.biz.     600     IN      A       70.154.82.100
debug-script40.biz.     600     IN      A       70.226.124.102

;; AUTHORITY SECTION:
debug-script40.biz.     7200    IN      NS      NS2.debug-script40.biz.
debug-script40.biz.     7200    IN      NS      NS4.debug-script40.biz.
debug-script40.biz.     7200    IN      NS      NS1.debug-script40.biz.
debug-script40.biz.     7200    IN      NS      NS3.debug-script40.biz.
debug-script40.biz.     7200    IN      NS      NS5.debug-script40.biz.

;; Query time: 458 msec
;; SERVER: 217.13.7.140#53(217.13.7.140)
;; WHEN: Mon Jan 26 17:38:20 2009
;; MSG SIZE  rcvd: 350

fmhxqutvccr.org - Downadup/Conficker

Domain ID:D155143935-LROR
Domain Name:FMHXQUTVCCR.ORG
Created On:20-Jan-2009 10:07:21 UTC
Last Updated On:20-Jan-2009 10:16:08 UTC
Expiration Date:20-Jan-2010 10:07:21 UTC
Sponsoring Registrar:The Registry at Info Avenue d/b/a Spirit Telecom (R111-LROR)
Status:CLIENT TRANSFER PROHIBITED
Status:TRANSFER PROHIBITED
Registrant ID:DI_9249308
Registrant Name:DAVID SHOEMAKER
Registrant Organization:N/A
Registrant Street1:306 Fairway Lane
Registrant Street2:
Registrant Street3:
Registrant City:Yorktown
Registrant State/Province:Virginia
Registrant Postal Code:23693
Registrant Country:US
Registrant Phone:+001.9044430013
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:dshoemater@gmail.com
Admin ID:DI_9249308
Admin Name:DAVID SHOEMAKER
Admin Organization:N/A
Admin Street1:306 Fairway Lane
Admin Street2:
Admin Street3:
Admin City:Yorktown
Admin State/Province:Virginia
Admin Postal Code:23693
Admin Country:US
Admin Phone:+001.9044430013
Admin Phone Ext.:
Admin FAX:
Admin FAX Ext.:
Admin Email:dshoemater@gmail.com
Tech ID:DI_9249308
Tech Name:DAVID SHOEMAKER
Tech Organization:N/A
Tech Street1:306 Fairway Lane
Tech Street2:
Tech Street3:
Tech City:Yorktown
Tech State/Province:Virginia
Tech Postal Code:23693
Tech Country:US
Tech Phone:+001.9044430013
Tech Phone Ext.:
Tech FAX:
Tech FAX Ext.:
Tech Email:dshoemater@gmail.com
Name Server:NS1.FMHXQUTVCCR.ORG
Name Server:NS2.FMHXQUTVCCR.ORG
Name Server:NS3.FMHXQUTVCCR.ORG
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:

; <<>> DiG 9.3.5-P2 <<>> fmhxqutvccr.org
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6470
;; flags: qr rd ra; QUERY: 1, ANSWER: 14, AUTHORITY: 3, ADDITIONAL: 0

;; QUESTION SECTION:
;fmhxqutvccr.org.               IN      A

;; ANSWER SECTION:
fmhxqutvccr.org.        600     IN      A       71.8.90.224
fmhxqutvccr.org.        600     IN      A       71.93.85.208
fmhxqutvccr.org.        600     IN      A       75.11.10.101
fmhxqutvccr.org.        600     IN      A       75.75.104.133
fmhxqutvccr.org.        600     IN      A       76.73.237.59
fmhxqutvccr.org.        600     IN      A       76.124.170.244
fmhxqutvccr.org.        600     IN      A       76.181.133.63
fmhxqutvccr.org.        600     IN      A       98.204.23.155
fmhxqutvccr.org.        600     IN      A       69.14.27.151
fmhxqutvccr.org.        600     IN      A       69.176.46.57
fmhxqutvccr.org.        600     IN      A       70.154.82.100
fmhxqutvccr.org.        600     IN      A       70.216.85.177
fmhxqutvccr.org.        600     IN      A       70.232.165.10
fmhxqutvccr.org.        600     IN      A       70.244.21.167

;; AUTHORITY SECTION:
fmhxqutvccr.org.        86400   IN      NS      ns3.fmhxqutvccr.org.
fmhxqutvccr.org.        86400   IN      NS      ns2.fmhxqutvccr.org.
fmhxqutvccr.org.        86400   IN      NS      ns1.fmhxqutvccr.org.

;; Query time: 235 msec
;; SERVER: 217.13.7.140#53(217.13.7.140)
;; WHEN: Mon Jan 26 18:06:38 2009
;; MSG SIZE  rcvd: 311