Historical OSINT – Profiling a Compilation of Known Apophis Exploit Kit C&C Public Domains – An OSINT Analysis

I’ve been recently digging into several archives in terms of looking for actionable threat intelligence based on my research circa 2010 with the idea to enrich it in 2022 and collerate it with several of my proprietary databases for threat intelligence and OSINT related materials in terms of fighting and responding to cybercrime hence the results which is an active domain portfolio of Apophis exploit and phishing kit which you can check out in terms of OSINT threat intelligence enrichment.

Sample Apophis C&C domains circa 2010 based on my research include:

hxxp://mystabcounter.info

hxxp://555traff.biz

hxxp://555traff.org

hxxp://555traff.net

hxxp://911traff.com

hxxp://911traff.org

hxxp://911traff.com

hxxp://555traff.ws

hxxp://nod32-spl.net

hxxp://kusik-tusik-trf.com

hxxp://spamh0use.com

hxxp://norton-av2007.com

Sample domain registrant email address account known to have been used in the campaign:

slhdns@gmail.com

Related malicious and fraudulent domains known to have been involved in the campaign include:

hxxp://free-adult-movies.us

hxxp://ellweb.biz

hxxp://flightlesson.us

hxxp://e-on.us

hxxp://masteryourselfandothers.biz

hxxp://sexychannal.biz

hxxp://fkooo.biz

hxxp://le-showroom.biz

hxxp://elwebbz.biz

hxxp://sensorama.us

hxxp://healingmassage.us

hxxp://lisa19.biz

hxxp://free-games-downloads.biz

hxxp://emaszyny.biz

hxxp://free-bizzz.biz

hxxp://ellwebs.biz

hxxp://fsone.us

hxxp://banddindependence.biz

hxxp://freestylecamera.biz

hxxp://wtter.biz

hxxp://little-lolitas.biz

hxxp://a-1express.us

hxxp://sex-total.biz

hxxp://misterfixit.us

hxxp://pantie-fetish.biz

hxxp://wantedbabes.biz

hxxp://papmperedchef.biz

hxxp://webmailccisd.us

hxxp://funi-games.biz

hxxp://karatzikos.biz

hxxp://fuckphotos.biz

hxxp://best-oem-sellers.biz

hxxp://powerstocks.biz

hxxp://connect-group.biz

hxxp://pptsys.biz

hxxp://lambrakis.biz

hxxp://hsmvstatefl.us

hxxp://computerselectronics.us

hxxp://premierprop.biz

hxxp://coloriez.biz

hxxp://crazy-holiday.biz

hxxp://images-porno.biz

hxxp://talentsmodels.biz

hxxp://sukebe.biz

hxxp://taydo.biz

hxxp://texas–holdem.biz

hxxp://mr-rx.biz

hxxp://cptraders.biz

hxxp://financialcareer.biz

hxxp://smallgirls.biz

hxxp://plastercrafts.biz

hxxp://lchs.us

hxxp://poopka.biz

hxxp://solarnet.biz

hxxp://hormonetreatment.us

hxxp://spammed.us

hxxp://photos-pucelles.biz

hxxp://signaturehomesstyles.biz

hxxp://marbleworks.biz

hxxp://simplyuniforms.biz

hxxp://pinballsites.biz

hxxp://cuyahogacouny.us

hxxp://pinkpoodlepets.biz

hxxp://cuyahagacounty.us

hxxp://rachaels.biz

hxxp://kentonkyschools.us

hxxp://iginteinc.biz

hxxp://caimon.us

hxxp://lonestarjewelry.biz

hxxp://vietghost.us

hxxp://igniteing.biz

hxxp://buytickets1.us

hxxp://agame.biz

hxxp://uighurlar.biz

hxxp://joshosler.biz

hxxp://variance.us

hxxp://qudos.biz

hxxp://ketsamil.us

hxxp://quebecauction.biz

hxxp://verumcom.biz

hxxp://privatpornoz.biz

hxxp://trasy.biz

hxxp://fightnight.us

hxxp://trueterm.biz

hxxp://arablusic.us

hxxp://cdcover.us

hxxp://httpimageshack.us

hxxp://iprosper.us

hxxp://prepaid2u.biz

hxxp://kylakeproperty.us

hxxp://printsmart.us

hxxp://inmarcet.biz

hxxp://privatevoicemail.us

hxxp://koicarp.us

hxxp://11burogu.biz

hxxp://traivan.us

hxxp://eroxia.us

hxxp://assmat.biz

hxxp://sauvageonne.biz

hxxp://articlexchange.biz

hxxp://scottsphotography.biz

hxxp://project-management-tools.biz

hxxp://mini-games.biz

hxxp://aqarium-fish.biz

hxxp://imageashack.us

hxxp://beanb.biz

hxxp://rmpnfotec.biz

hxxp://azadari.biz

hxxp://europauto.biz

hxxp://autosourse.biz

hxxp://rowanlaw.us

hxxp://autocadsites.biz

hxxp://renewpcstore.biz

hxxp://whatswhat.us

hxxp://f0reverhealthy.biz

hxxp://boa-constrictor.biz

hxxp://f-chan.us

hxxp://bestemateur.biz

hxxp://everysearch.us

hxxp://wnetwork.biz

hxxp://fanmial.biz

hxxp://brutalfemdom.biz

hxxp://realitywise.biz

hxxp://breadmaker.biz

hxxp://realy-models.biz

hxxp://webform.us

hxxp://lolabbs.biz

hxxp://weknow.us

hxxp://jlove.us

hxxp://zowmebel.biz

hxxp://1001night.biz

hxxp://zodiacpowerring.biz

hxxp://wwwsignaturehomestyles.biz

hxxp://a-deco.biz

hxxp://analized.us

hxxp://ishikari.biz

hxxp://xteenx.biz

hxxp://ffivideo.biz

hxxp://allthingscatholic.us

hxxp://puffgames.biz

hxxp://actiongames.us

hxxp://ffunny-games.biz

hxxp://coasthomes.biz

hxxp://clearhabor.biz

hxxp://at-crew.biz

hxxp://animal-info.biz

hxxp://anoria.biz

hxxp://cl55.biz

hxxp://amitenergy.biz

hxxp://bestcounter.biz

hxxp://bionexus.biz

hxxp://4only.biz

hxxp://bellgard.biz

hxxp://bairo.biz

hxxp://banjosites.biz

hxxp://clthumane.biz

hxxp://autorepairmanuels.biz

hxxp://city-info.biz

hxxp://anywhere-wireless.biz

hxxp://casadellabomboniera.biz

hxxp://centerforrenewal.biz

hxxp://cuteloblog.biz

hxxp://buckneranimalclinic.biz

hxxp://bona-stto.biz

hxxp://1sp.biz

hxxp://easycalender.biz

hxxp://etudiantes-vicieuses.biz

hxxp://fannygames.biz

hxxp://bizibypass.biz

hxxp://ddl-warez.biz

hxxp://fainmail.biz

hxxp://farmersandmerchantsbank.biz

hxxp://atomakayan.biz

hxxp://youxxx.us

hxxp://wmata.us

hxxp://mailarlingtonva.us

hxxp://sexyblackpussy.biz

hxxp://funnygamse.biz

hxxp://funnygaes.biz

hxxp://freetgp.biz

hxxp://www4usonly.biz

hxxp://hena.biz

hxxp://gentrees.biz

hxxp://ignitein.biz

hxxp://hentai-movie.biz

hxxp://igniteic.biz

hxxp://headcutterssalon.biz

hxxp://fuunny-games.biz

hxxp://igniteenergy.biz

hxxp://hrna.biz

hxxp://free-voyeur-cam.biz

hxxp://goldenretire.biz

hxxp://inkkraft.biz

hxxp://heproject.biz

hxxp://funny-gemes.biz

hxxp://ice-out.biz

hxxp://adogslife.biz

hxxp://alterego3d.biz

hxxp://americanriverbikes.biz

hxxp://ecstazy.biz

hxxp://harna.biz

hxxp://africantradebeads.biz

hxxp://funy-game.biz

hxxp://free-gay-movies.biz

hxxp://inginteinc.biz

hxxp://wwwsexbabes.biz

hxxp://wwwmoscarossa.biz

hxxp://wwwsearch.biz

hxxp://funygame.biz

hxxp://fuuny-game.biz

hxxp://e-dict.biz

hxxp://interskay.biz

hxxp://bbw-fat-woman.biz

hxxp://sexbabs.biz

hxxp://youniquedesigns.biz

hxxp://visiongloval.biz

hxxp://seekme.biz

hxxp://pamperedcheff.biz

hxxp://streetdrugs.biz

hxxp://northportrealtor.biz

hxxp://young-peaches.biz

hxxp://boysvids.us

hxxp://coolchasers.us

hxxp://avse.us

hxxp://clearsil.us

hxxp://celebmovie.us

hxxp://myffl.biz

hxxp://sexbabez.biz

hxxp://sexbabies.biz

hxxp://free-search.biz

hxxp://free-voyeur-web.biz

hxxp://sukuname.biz

hxxp://mattun.biz

hxxp://wmclick.biz

hxxp://jun1.biz

hxxp://try-this-search.biz

hxxp://best-search.us

hxxp://topkds.biz

hxxp://traffmoney.biz

hxxp://no-nudes.biz

hxxp://ownmyhome.us

hxxp://teenboyboy.biz

hxxp://may5.biz

hxxp://kisslola.biz

hxxp://mature-sex-pic.biz

hxxp://logocorean.biz

hxxp://medsbymail.biz

hxxp://melissacam.biz

hxxp://mcommuniti.biz

hxxp://katreen.biz

hxxp://nextdoorteens.us

hxxp://viasatelital.us

hxxp://onestoplettingshop.biz

hxxp://hotmapouka.biz

hxxp://agsoftware.biz

hxxp://bun1.biz

hxxp://bsabikesites.biz

hxxp://fragments.biz

hxxp://lovely-nymphets.biz

hxxp://proliferator.biz

hxxp://puertolaboca.us

hxxp://blackandpussy.biz

hxxp://ford-dealers.biz

hxxp://hlplmanhds.biz

hxxp://baosteel.biz

hxxp://begard.biz

hxxp://erotik-geschichten.biz

hxxp://djahmet.biz

hxxp://fonny-games.biz

hxxp://togetherwestand.us

hxxp://fantasy4u.us

hxxp://tympani.us

hxxp://victoryautosales.us

hxxp://veld.us

hxxp://hartlandschool.us

hxxp://whisperedsecrets.us

hxxp://receptor.us

hxxp://sese.us

hxxp://industrialwoodproducts.us

hxxp://cutyourexpenses.us

hxxp://first-school.us

hxxp://cutexpenses.us

hxxp://future4.us

hxxp://tvdirectory.us

hxxp://fashioncamp.us

hxxp://madebyyou.us

hxxp://justleather.us

hxxp://iamhot.us

hxxp://datedetective.us

hxxp://phonetranslators.us

hxxp://eurosport.us

hxxp://lloll.us

hxxp://embelsira.us

hxxp://mainsqueezelove.biz

hxxp://privatporn.biz

hxxp://porn-photo.biz

hxxp://radim.us

hxxp://porn-fotos.biz

hxxp://niceleads.biz

hxxp://spaceresort.us

hxxp://filmscore.us

hxxp://hatachi.us

hxxp://lanciasites.biz

hxxp://needcracks.us

hxxp://muddle.us

hxxp://negaheno.biz

hxxp://truyennguoilon.us

hxxp://net-gams.biz

hxxp://videospornoblog.biz

hxxp://chezbaycakes.biz

hxxp://vb3.biz

hxxp://n0-ip.biz

hxxp://nailwarehouse.biz

hxxp://mynameislolita.biz

hxxp://mountainlakeresort.us

hxxp://hardcore-family-incest.biz

hxxp://hi-web.biz

hxxp://passace.com

hxxp://smartergirl.com

hxxp://howtofixyourharley.com

hxxp://sirevil.us

hxxp://mychices.biz

hxxp://sfondipc.biz

hxxp://wealth-4-u.biz

hxxp://avenge.biz

hxxp://arlingonva.us

hxxp://americawide.us

hxxp://11xp.us

hxxp://arlintonva.us

hxxp://animefans.us

hxxp://genescan.us

hxxp://hallmarkkeepsake.com

hxxp://sundaramusic.com

hxxp://gros-culs.biz

hxxp://moneyconnection.biz

hxxp://graephillips.biz

hxxp://wwwbiehealth.us

hxxp://hollywoodmadam.us

hxxp://enblock.biz

hxxp://oynuyoruz.biz

hxxp://sexbabys.biz

hxxp://nop-ip.biz

hxxp://klinische-forschung.biz

hxxp://grupxtrem.biz

hxxp://vestalgirls.biz

hxxp://nudeliving.us

hxxp://buellsites.biz

hxxp://mcclaincountyassessor.us

hxxp://went2.us

hxxp://mcpsk12md.us

hxxp://muenzversand.biz

hxxp://nighteen.biz

hxxp://customelectronics.us

hxxp://hocsinhvn.biz

hxxp://city-realtor.biz

hxxp://no-p.biz

hxxp://transsahara.biz

hxxp://net-ganes.biz

hxxp://bevardclerk.us

hxxp://netgamez.biz

hxxp://healthfoodsstore.us

hxxp://hiphopcharts.us

hxxp://ebookgenerator.biz

hxxp://ni-ip.biz

hxxp://dataspot.biz

hxxp://moregirls.biz

hxxp://uscharts.us

hxxp://pampredchef.biz

hxxp://carefreehomesep.us

hxxp://fuun-games.biz

hxxp://kellyeducationalservices.us

hxxp://hollywoodsbest.us

hxxp://vintage-furniture.us

hxxp://pamperedche.biz

hxxp://cinacast.us

hxxp://gethitsfrom.us

hxxp://celebrityfuckfest.biz

hxxp://gentle-boys.biz

hxxp://trique-porno.biz

hxxp://pamperedchf.biz

hxxp://carwithheart.biz

hxxp://pamparedchef.biz

hxxp://soccersites.biz

hxxp://pamperchief.biz

hxxp://cutmyexpenses.us

hxxp://girlsseekingboys.com

hxxp://curiosity-shop.biz

hxxp://pamperedcef.biz

hxxp://thebookpeddler.us

hxxp://ozgurboard.us

hxxp://deshimasala.biz

hxxp://pamepredchef.biz

hxxp://shopedmap.biz

hxxp://goshoppingnow.biz

hxxp://dailycash.biz

hxxp://pamoeredchef.biz

hxxp://sleepygirls.us

hxxp://sexpain.biz

hxxp://japanese-kimonos.biz

hxxp://kwbw.biz

hxxp://knifesites.biz

hxxp://top-girlie.biz

hxxp://pcconnect.biz

hxxp://tiket2u.biz

hxxp://magicvideo.biz

hxxp://tankslapper.biz

hxxp://wolrdventures.biz

hxxp://555traff.biz

hxxp://assitante-maternelle.biz

hxxp://ambitenrgy.biz

hxxp://wcw2008.com

hxxp://yourxxxblog.biz

hxxp://ls-dreams.biz

hxxp://deai-joho.biz

hxxp://theadvanced348pills.biz

hxxp://privatporns.biz

hxxp://worldaventures.biz

hxxp://max-models.biz

hxxp://majornet.biz

hxxp://worldventrures.biz

hxxp://realincome4realpeople.biz

hxxp://miffi.biz

hxxp://lolitaskingdom.biz

hxxp://ratemyass.biz

hxxp://themillenium.biz

hxxp://love2005.biz

hxxp://worldventuers.biz

hxxp://worldventues.biz

hxxp://provoke.biz

hxxp://realadvanced348pills.biz

hxxp://wwwpartylite.biz

hxxp://armorgames.biz

hxxp://lampsites.biz

hxxp://labtesting.biz

hxxp://zagevqsoii.biz

hxxp://wwwherna.biz

hxxp://wwwsmartvalue.biz

hxxp://premierorlandoshow.biz

hxxp://xtremescooters.biz

hxxp://pharmaceu.biz

hxxp://patylite.biz

hxxp://pianosites.biz

hxxp://xgarden.biz

hxxp://xmature.biz

hxxp://wwwpamperedchef.biz

hxxp://logocorea.biz

hxxp://traffstats.biz

hxxp://myspaze.biz

hxxp://smartvalu.biz

hxxp://myangelfuns.biz

hxxp://pfshop.biz

hxxp://sinon.biz

hxxp://partylight.biz

hxxp://piscali.biz

hxxp://ventriloserver.biz

hxxp://vintage-lingerie.biz

hxxp://busybee-discounts.biz

hxxp://mycoices.biz

hxxp://tstats.biz

hxxp://rmpinfotecc.biz

hxxp://ruslolitas.biz

hxxp://only4us.biz

hxxp://rmpinfote.biz

hxxp://mo-ip.biz

hxxp://pamperechef.biz

hxxp://superfreak.biz

hxxp://mychoises.biz

hxxp://pamperedcheif.biz

hxxp://rock0em.biz

hxxp://videonymphets.biz

hxxp://lovers-lane.biz

hxxp://rmpinfotac.biz

hxxp://wisconsinapartment.biz

hxxp://sweet-girls.biz

hxxp://pameredchef.biz

hxxp://whiteslave.biz

hxxp://herohona.biz

hxxp://minecharm.biz

hxxp://skysat.biz

hxxp://boxmain.biz

hxxp://dynds.biz

hxxp://dremer.biz

hxxp://dragonpalace.biz

hxxp://doina-sirbu.biz

hxxp://4useonly.biz

hxxp://cccp-top.biz

hxxp://panoromicworld.biz

hxxp://ganntproject.biz

hxxp://sextop.biz

hxxp://pamperedhef.biz

hxxp://virtualzone.biz

hxxp://serendipityboutique.biz

hxxp://photololita.biz

hxxp://parylite.biz

hxxp://rmpinfotce.biz

hxxp://partlite.biz

hxxp://panperedchef.biz

hxxp://sexlagoon.biz

hxxp://mcmmunity.biz

hxxp://statrafongon.biz

hxxp://stockservice.biz

hxxp://jobsinmotors.biz

hxxp://torrent-portal.biz

hxxp://simwork.biz

hxxp://simmaster.biz

hxxp://partyite.biz

hxxp://opse.biz

hxxp://shocknews.biz

hxxp://worldvenures.biz

hxxp://funnigames.biz

Sample malicious MD5s known to have been involved in the campaign include:

375e8a6dd1b666f09f3602ed2e8e05eb

4634d5e104a26616b6666a43b5b1416c

014a6e2a4cc62df769c923f236f2934e

c7a2350a62497f743401946fd63ca25b

b118c68b72595f9c15bdce8fc77fea37

a616b67adbdad8870e751384dd070db5

ccd7b6b6a59bb9925e0af66d60de1e6d

d4627cf4de6a5905dde5df2e69f8944b

0de4b76312dc01ff2d2f473465020619

5ca52919915bbad976fef4165b3f4800

381b27cb8b9976e6820345a49d93fc3b

3cab5169156f2d062b84c519cf2b1802

bbf664bd279580aa717fcff0246b762c

06d0c3af7b80ea0001a5270d59348282

e4e494eff71ad9f14b1a369522fb4c94

Stay tuned!

Leave a Reply

Your email address will not be published. Required fields are marked *

Unit-123.org E-shop Owner Information

Who is Dancho Danchev?

Unit-123.org

Focused on delivering daily batches of personally-produced never-ending supply of high-quality and never-published and released before classified and sensitive Intelligence Deliverables.

Latest Products