Zlkon.lv disconnected - but apparently not completely gone

I was happy to read over at Malware Domain List this morning, that Zlkon.lv had apparently been disconnected. Obviously I had to see where the domains listed in hpHosts, that pointed to zlkon, had now gone to. The results were interesting, but we'll get to that in a second.

I checked the AS report, as referenced in the MDL thread, and indeed it did seem as though Zlkon had gone;

http://www.cidr-report.org/cgi-bin/as-report?as=AS12553

Checking via BGPlay for the dates 28-04-2009 - 29-04-2009 shows;



This shows their upstream as;

http://www.cidr-report.org/cgi-bin/as-report?as=AS5518

If we expand the dates a little, we see that indeed, alot of the previous routes seem to have now gone as of 06:42 yesterday;







As mentioned, I ran the domains listed in hpHosts, that previously resolved to Zlkon.lv IP space, to see where they now resolved to, and the results showed;

95.129.144.210 - NET-VENTREX (UK)
88.80.19.237 - SE-PRQ-20051124 (Sweden)
91.212.65.35 - EUROHOST-NET (Ukraine)
78.26.179.253 - RENOME-SERVICE (Ukraine)
78.129.192.17 - RapidSwitch (UK)
78.129.166.5 - RapidSwitch (Cayman Islands)
77.222.40.234 - SpaceWeb (Russia)
64.191.12.38 - Zlathosting.ru (US)
213.163.91.93 - SERVERBOOST (Netherlands)
211.95.73.189 - UNICOM (China)
203.169.164.18 - HKNET-H (Hong Kong)
195.88.81.37 - ECOWEB (Latvia)
194.247.192.180 - EUNET-YU (Serbia)

Interestingly however, quite a few of them are still resolving to the Zlkon IP space, and are seemingly still active. Meaning either Zlkon is still in the process of being taken down, or has found a new upstream provider already.

See the full results, as of two hours ago;

http://hosts-file.net/misc/zlkon.lv.html

I'm surprised somewhat, that the mainstream tech media hasn't already picked this up, but alas it seems this is certainly the case (or at least, if they have, I've not seen any stories concerning it on any of the RSS feeds I monitor).

Either way, this is great news for us, and is hopefully an end to what is without doubt, one of the worst offenders in the world of malware.

If you've got something to add, or just fancy joining in the discussion, feel free to join us over at the MDL forums;

http://www.malwaredomainlist.com/forums