IP Address Inspector

L.Nicolai commented...

LATEST UPDATE!!
Now listed CBL: http://cbl.abuseat.org/lookup.cgi?ip=188.92.76.167
IP Address 188.92.76.167 is listed in the CBL. It appears to be infected with a spam sending trojan, proxy or some other form of botnet.

It was last detected at 2014-11-04 11:00 GMT (+/- 30 minutes).

This IP address is infected with, or is NATting for a machine infected with Tinba.
Tinba (also known as "tiny banker" and "illi") is a ebanking trojan aimed to steal credentials for online banking accounts. It spreads through hijacked websites (drive-by exploits) and malicious email attachments.

The CBL detection is being made using sinkholing techniques.

This was detected by a TCP/IP connection from 188.92.76.167 on port 31359 going to IP address 82.165.37.127 (the sinkhole) on port 80.

The botnet command and control domain for this connection was "nwqncchffxvhhyv.com".
November 04 2014 08:38 AM

T.Gues commented...

this IP range 188.92.76.167 and ip range 188.92.76.0 - 188.92.76.255 is just BAD. IP
shows on logs as accessing sites with a refer. From what I've read these refer sites are associated with a large russian DDOS botnet. The size in bytes shows up as 0 but the 200 mean it has been successful in retrieving the information from the HTTP. http://www.windowsecurity.com/whitepapers/misc/Hackers_Tricks_to_Avoid_Detection_.html

REFER LINKS DO NOT CLICK::

http://wmaid.com/explore/(site.com)
http://futurepathonline.com/sitemap-systran-7-torrent-3gna1
http://futurepathonline.com/sitemap-systran-7-torrent-3gna1

also associated with
gofuckbiz.com
September 04 2014 10:37 PM

K.Nox commented...

Refer spam by tapping pages with HEAD and leaving "hxxp://[compromisedserver]/sitemap-plex-youtube-plugin-7yd03" as the referrer. Still no good traffic coming from this IP.
September 03 2014 06:30 PM

D.McHugh4 commented...

THIS IS AN ADDITIONAL LOG ENTRY TO THE ONE BELOW.

BE AWARE OF THIS SITE IN YOUR LOGS. I have been dealing with this site in my logs for months using various malicious methods to probe or sometimes try to inject code.

/
Http Code: 403 Date: Aug 24 01:35:02 Http Version: HTTP/1.0 Size in Bytes: -
Referer: http://wmaid.com/explore/CENSORED.com/
Agent: Mozilla/5.0 (compatible; WebMasterAid/1.0; +http://wmaid.com/explore/)
August 24 2014 08:17 PM

D.McHugh4 commented...

This IP is adaptive and tries numerous ways to breach servers. DO NOT FOLLOW OR GO TO THEIR SITES.

Http Code: 403 Date: Aug 24 01:35:02 Http Version: HTTP/1.0 Size in Bytes: -
Referer: http://wmaid.com/explore/CENSORED.com/
Agent: Mozilla/5.0 (compatible; WebMasterAid/1.0; +http://wmaid.com/explore/)
August 24 2014 08:07 AM

T.PERFECT NAME commented...

...
what do you expect folks......... look where the IP originates from. They've got nothing better to do in life.
...
July 15 2014 02:33 PM

B.Garden commented...

Now trying to promote...
http://www.google.com/search?q=easylifeapp+profile
Their Facebook page is a disaster... Reviewers hate it .. to quote "You are a bunch of parasites! I did NOT ask for this to put on my PC!"
July 11 2014 11:33 AM

B.Garden commented...

Referrer Spammer: http://wmaid.com/explore/****.com/
July 08 2014 10:41 PM

B.Garden commented...

Referrer Spammer: Now trying to peddle Akado. Site that claims to clean up companies website reputation.
July 02 2014 01:16 AM

D.McHugh4 commented...

Repeat Offender! Attempted to probe my server again. Jun 7 2014

/
Http Code: 403 Date: Jun 07 01:01:27 Http Version: HTTP/1.0 Size in Bytes: 302
Referer: http://wmaid.com/explore/CENSORED.com
Agent: Mozilla/5.0 (compatible; WebMasterAid/1.0; +http://wmaid.com/explore/
June 20 2014 02:37 PM

D.McHugh4 commented...

Repeat Offender! Attempted to probe my server again. Jun 05 2014

May 26 2014
Referer: http://www.google.com/search?q=installerex+f##eb##k

Jun 05 2014
Http Code: 403 Date: Jun 05 10:23:11 Http Version: HTTP/1.0 Size in Bytes: 302
Referer: http://wmaid.com/explore/my sites name.com
Agent: Mozilla/5.0 (compatible; WebMasterAid/1.0; +http://wmaid.com/explore/)
June 05 2014 01:20 PM

B.Garden commented...

Referrer Spammer: Leads to wmaid.com
May 31 2014 08:29 PM

T.PERFECT NAME commented...

...
I NEED TO BAN ALL OF EASTERN EUROPE AND CHINA.
...
May 28 2014 01:46 PM

L.Nicolai commented...

Extremely annoying and dangerous!
Try to insert something:
http://www.google.com/search?q=installerex+official+website

Listed in Spamhaus CBL:
http://cbl.abuseat.org/lookup.cgi?ip=188.92.76.167
It appears to be infected with a spam sending trojan, proxy or some other form of botnet.

This IP address is infected with, or is NATting for a machine infected with the ZeuS trojan, also known as "Zbot" and "WSNPoem". ZeuS is a malicious software (malware) used by cybercriminals to commit ebanking fraud and steal sensitive personal data, such as credentials (username, password) for online services (email, webmail, etc.).

The infection was detected by observing this IP address attempting to make contact to a ZeuS Command and Control server (C&C), a central server used by the criminals to control with ZeuS infected computers (bots).
This was detected by a TCP/IP connection from 188.92.76.167 on port 1417 going to IP address 82.165.37.26 (the sinkhole) on port 80.
The botnet command and control domain for this connection was "newandrefurbelectronics.com".
May 27 2014 10:30 AM

B.Garden commented...

Trying to insert something:
http://www.google.com/search?q=installerex+facebook
See here for details:
http://malwaretips.com/blogs/win32-installerex-bi-pup-virus/
May 26 2014 10:49 PM

D.McHugh4 commented...

Attempted to install something in my server. May 26 2014

/
Http Code: 403 Date: May 26 15:12:53 Http Version: HTTP/1.0 Size in Bytes: 327
Referer: http://www.google.com/search?q=installerxxxxx+f##eb##k
Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
May 26 2014 09:10 PM

B.Garden commented...

Back again with referrer spam.
May 22 2014 06:39 AM

B.Garden commented...

Already banned all of Latvia - but this moron keeps trying . . .
http://r-e-f-e-r-e-r.com/
August 29 2013 07:58 AM

C.JJ commented...

188.92.76.167 - - [19/Jul/2013:20:33:02 +0200] "GET /phppath/php HTTP/1.0" 403 1290 "-" "-"
July 19 2013 06:09 PM

M.Anderson20 commented...

Same/
July 01 2013 05:50 PM

K.Nox commented...

There is no good (or legitimate) traffic from this IP. Permaban and proceed.
June 07 2013 05:31 PM

M.Kraaijeveld commented...

Now spam referrering with "http://r-e-f-e-r-e-r.com/"

Domain Name: R-E-F-E-R-E-R.COM

Registration Date: 03-Jun-2013
Expiration Date: 03-Jun-2014

Status:LOCKED
Note: This Domain Name is currently Locked.
This feature is provided to protect against fraudulent acquisition of the domain name,
as in this status the domain name cannot be transferred or modified.

Name Servers:
ns1.fozzy.com
ns2.fozzy.com


Registrant Contact Details:
PrivacyProtect.org
Domain Admin (contact@privacyprotect.org)
ID#10760, PO Box 16
Note - Visit PrivacyProtect.org to contact the domain owner/operator
Nobby Beach
Queensland,QLD 4218
AU
Tel. +45.36946676

Administrative Contact Details:
PrivacyProtect.org
Domain Admin (contact@privacyprotect.org)
ID#10760, PO Box 16
Note - Visit PrivacyProtect.org to contact the domain owner/operator
Nobby Beach
Queensland,QLD 4218
AU
Tel. +45.36946676

Technical Contact Details:
PrivacyProtect.org
Domain Admin (contact@privacyprotect.org)
ID#10760, PO Box 16
Note - Visit PrivacyProtect.org to contact the domain owner/operator
Nobby Beach
Queensland,QLD 4218
AU
Tel. +45.36946676

Billing Contact Details:
PrivacyProtect.org
Domain Admin (contact@privacyprotect.org)
ID#10760, PO Box 16
Note - Visit PrivacyProtect.org to contact the domain owner/operator
Nobby Beach
Queensland,QLD 4218
AU
Tel. +45.36946676
June 06 2013 12:40 PM

B.Garden commented...

Not a day goes by without attempting to access my sites.
May 27 2013 08:02 AM

M.Kraaijeveld commented...

Now spam referrering as "http://tkdot.com/"
May 23 2013 10:17 AM

P.L commented...

Base Network Information
Network Handle: ADTECHNOLOGY-LV-NET
Network IP Range: 188.92.76.0 - 188.92.76.255
Network CIDR: 188.92.76.0/24
Status: ASSIGNED PA
Allocating Source: RIPE

Maintainer ID: ADTECHNOLOGY-MNT
Owner Contact
Organization: AD TECHNOLOGY DATACENTER
Technical Contact
Tech NIC Handle: GA5137-RIPE
Name: Gundars Arbidans
Phone: +371 2 8399495
Address: Mehanizatoru iela 7, Preili, LV-5301

This spambot is just one part of a giant spam botnet operation running from the ADTECHNOLOGY-LV-NET data centers.

188.92.76.167 is located in Latvia. This IP address is assigned to ADTECHNOLOGY-LV-NET ranging from 188.92.76.0 - 188.92.76.255. Hostname for ADTECHNOLOGY-LV-NET is AD TECHNOLOGY SIA.

Data-Centre:
Dedicated servers are collocated in Latvia, in the company’s AD TECHNOLOGY data-centre. Data-centre is equipped with uninterruptible power, air conditioning and data transmission channel monitoring systems. The total traffic capacity of the channels for access to Latvian resources makes more than 400 Mbit/s. The access to the international resources of the Internet network is achieved by means of two channels with STM-1 capacity, rented from different operators, STM-4 channel in Helsinki and STM-1 channel in New York. Connecting to the external operators Deutsche Telecom (622 mbit/s, connection in Helsinki), Telia&Sonera (100mbit/s, connection in London) and MCI (100 Mbit/s, connection in New York), Telia&Sonera (100 mbit/s, connection in New York).
March 19 2013 03:04 PM

B.Garden commented...

Back again with the following....
http://rujamiza.skysols.in/info/**************.com/
Banned whole range from Latvia
March 19 2013 07:17 AM

R.Bowen4 commented...

spammer hit my server and doubled the load in minutes. Banned
March 19 2013 02:45 AM

S.Ryan5 commented...

--
Yep, hardcore referer spammer; banning the whole IP range since those countries have no business being anywhere near my sites, and are typically up to no good anyways.
--
Deny from 188.0.0.0/8
--
March 15 2013 04:21 PM

M.Gamer commented...

Repeated Referring http://leaguan.netfast.org/info/mgshots.com
IP banned.
March 15 2013 04:48 AM

P.L commented...

Spammer Link ...Banned

IP-Adresse: 188.92.76.167


[Wed Mar 13 11:13:35 2013] [error] [client 188.92.76.167] referer: http://uzmamoe.hostzi.com/
[Wed Mar 13 11:07:14 2013] [error] [client 188.92.76.167] referer: http://uzmamoe.hostzi.com/
[Wed Mar 13 11:00:51 2013] [error] [client 188.92.76.167] referer: http://uzmamoe.hostzi.com/
[Wed Mar 13 10:54:41 2013] [error] [client 188.92.76.167] referer: http://uzmamoe.hostzi.com/
[Wed Mar 13 10:48:40 2013] [error] [client 188.92.76.167] referer: http://uzmamoe.hostzi.com/
[Wed Mar 13 10:42:03 2013] [error] [client 188.92.76.167] referer: http://uzmamoe.hostzi.com/
[Wed Mar 13 10:35:56 2013] [error] [client 188.92.76.167] referer: http://uzmamoe.hostzi.com/
[Wed Mar 13 10:30:10 2013] [error] [client 188.92.76.167] referer: http://uzmamoe.hostzi.com/
[Wed Mar 13 10:23:58 2013] [error] [client 188.92.76.167] referer: http://uzmamoe.hostzi.com/
[Wed Mar 13 10:17:35 2013] [error] [client 188.92.76.167] referer: http://uzmamoe.hostzi.com/
[Wed Mar 13 10:11:22 2013] [error] [client 188.92.76.167] referer: http://uzmamoe.hostzi.com/
[Wed Mar 13 10:04:52 2013] [error] [client 188.92.76.167] referer: http://uzmamoe.hostzi.com/
[Wed Mar 13 09:58:39 2013] [error] [client 188.92.76.167] referer: http://uzmamoe.hostzi.com/
[Wed Mar 13 09:52:25 2013] [error] [client 188.92.76.167] referer: http://uzmamoe.hostzi.com/
[Wed Mar 13 09:46:06 2013] [error] [client 188.92.76.167] referer: http://uzmamoe.hostzi.com/
[Wed Mar 13 09:39:58 2013] [error] [client 188.92.76.167] referer: http://uzmamoe.hostzi.com/
March 13 2013 05:12 PM

C.JJ commented...

188.92.76.167 - - [13/Mar/2013:12:58:06 +0200] "GET /admin/phpmyadmin/scripts/setup.php HTTP/1.1" 403 619 "-" "-" "-"
188.92.76.167 - - [13/Mar/2013:12:58:06 +0200] "GET /admin/pma/scripts/setup.php HTTP/1.1" 403 619 "-" "-" "-"
188.92.76.167 - - [13/Mar/2013:12:58:06 +0200] "GET /admin/scripts/setup.php HTTP/1.1" 403 619 "-" "-" "-"
188.92.76.167 - - [13/Mar/2013:12:58:06 +0200] "GET /db/scripts/setup.php HTTP/1.1" 403 619 "-" "-" "-"
188.92.76.167 - - [13/Mar/2013:12:58:06 +0200] "GET /dbadmin/scripts/setup.php HTTP/1.1" 403 619 "-" "-" "-"
188.92.76.167 - - [13/Mar/2013:12:58:06 +0200] "GET /myadmin/scripts/setup.php HTTP/1.1" 403 619 "-" "-" "-"
188.92.76.167 - - [13/Mar/2013:12:58:06 +0200] "GET /mysql-admin/scripts/setup.php HTTP/1.1" 403 619 "-" "-" "-"
188.92.76.167 - - [13/Mar/2013:12:58:06 +0200] "GET /mysql/scripts/setup.php HTTP/1.1" 403 619 "-" "-" "-"
188.92.76.167 - - [13/Mar/2013:12:58:06 +0200] "GET /mysqladmin/scripts/setup.php HTTP/1.1" 403 619 "-" "-" "-"
188.92.76.167 - - [13/Mar/2013:12:58:06 +0200] "GET /mysqlmanager/scripts/setup.php HTTP/1.1" 403 619 "-" "-" "-"
...
March 13 2013 08:14 AM

B.Lemieux commented...

Referring http://wimiciy.bmtc.ca/info/, goes to smrush.
March 12 2013 12:25 PM

B.Garden commented...

LATVIA, RIGA, RIGA
Referring URL: http://fiwefuf.xlphp.net/
Which goes to semrush
March 12 2013 03:48 AM