Research: KoobFace - redir3105.com

I was asked by a friend if I could sniff out all of the IP addresses that the redir3105.com domain was redirecting to, and after spending over 30 mins trying to do it manually, decided to ask a few fellow researchers if they were aware of a way of doing it automatically - sadly they weren't.

I decided therefor, to throw something together myself to see if I could get the results I required, and the results were interesting.

I told the program to send 1000 requests to redir3105.com (spaced out of course), and had it list all of the IP's that it redirected to, including of course, the URL's themselves - out of the 1000 requests, there were only 296 unique IP addresses. Something I was not expecting.

The entire list is below for your blacklisting and/or researching pleasure.

http://112.150.3.52/pid=1000/?ch=&ea=
http://114.73.15.109/pid=1000/?ch=&ea=
http://114.75.22.27/pid=1000/?ch=&ea=
http://115.135.22.77/pid=1000/?ch=&ea=
http://116.54.12.207/pid=1000/?ch=&ea=
http://117.200.211.29/pid=1000/?ch=&ea=
http://117.200.97.85/pid=1000/?ch=&ea=
http://118.100.124.101/pid=1000/?ch=&ea=
http://118.160.194.126/pid=1000/?ch=&ea=
http://119.94.26.9/pid=1000/?ch=&ea=
http://12.219.75.172/pid=1000/?ch=&ea=
http://121.96.106.234/pid=1000/?ch=&ea=
http://121.96.243.32/pid=1000/?ch=&ea=
http://122.51.218.39/pid=1000/?ch=&ea=
http://122.53.59.125/pid=1000/?ch=&ea=
http://122.55.198.199/pid=1000/?ch=&ea=
http://123.255.20.221/pid=1000/?ch=&ea=
http://124.158.70.194/pid=1000/?ch=&ea=
http://125.107.66.47/pid=1000/?ch=&ea=
http://165.132.193.184/pid=1000/?ch=&ea=
http://174.48.92.134/pid=1000/?ch=&ea=
http://188.24.240.254/pid=1000/?ch=&ea=
http://190.26.12.101/pid=1000/?ch=&ea=
http://196.206.192.153/pid=1000/?ch=&ea=
http://196.206.73.192/pid=1000/?ch=&ea=
http://200.104.112.223/pid=1000/?ch=&ea=
http://200.79.214.207/pid=1000/?ch=&ea=
http://201.149.235.248/pid=1000/?ch=&ea=
http://201.160.142.149/pid=1000/?ch=&ea=
http://201.174.213.208/pid=1000/?ch=&ea=
http://201.241.56.215/pid=1000/?ch=&ea=
http://201.88.88.28/pid=1000/?ch=&ea=
http://203.198.108.237/pid=1000/?ch=&ea=
http://203.212.201.31/pid=1000/?ch=&ea=
http://204.13.181.145/pid=1000/?ch=&ea=
http://208.96.79.170/pid=1000/?ch=&ea=
http://212.220.108.203/pid=1000/?ch=&ea=
http://212.35.66.215/pid=1000/?ch=&ea=
http://213.6.65.91/pid=1000/?ch=&ea=
http://218.168.184.2/pid=1000/?ch=&ea=
http://218.172.72.100/pid=1000/?ch=&ea=
http://220.120.131.144/pid=1000/?ch=&ea=
http://220.139.46.84/pid=1000/?ch=&ea=
http://220.158.15.36/pid=1000/?ch=&ea=
http://221.127.120.43/pid=1000/?ch=&ea=
http://221.127.254.54/pid=1000/?ch=&ea=
http://221.128.214.39/pid=1000/?ch=&ea=
http://222.121.227.7/pid=1000/?ch=&ea=
http://24.1.103.249/pid=1000/?ch=&ea=
http://24.116.109.135/pid=1000/?ch=&ea=
http://24.117.234.115/pid=1000/?ch=&ea=
http://24.136.172.239/pid=1000/?ch=&ea=
http://24.14.58.26/pid=1000/?ch=&ea=
http://24.151.168.145/pid=1000/?ch=&ea=
http://24.168.90.30/pid=1000/?ch=&ea=
http://24.17.253.66/pid=1000/?ch=&ea=
http://24.20.125.254/pid=1000/?ch=&ea=
http://24.205.33.85/pid=1000/?ch=&ea=
http://24.209.162.67/pid=1000/?ch=&ea=
http://24.53.141.59/pid=1000/?ch=&ea=
http://24.53.143.254/pid=1000/?ch=&ea=
http://24.62.12.107/pid=1000/?ch=&ea=
http://24.68.70.58/pid=1000/?ch=&ea=
http://24.9.127.102/pid=1000/?ch=&ea=
http://24.94.21.199/pid=1000/?ch=&ea=
http://24.98.202.156/pid=1000/?ch=&ea=
http://24.98.45.0/pid=1000/?ch=&ea=
http://4.229.198.39/pid=1000/?ch=&ea=
http://41.145.183.45/pid=1000/?ch=&ea=
http://41.250.109.63/pid=1000/?ch=&ea=
http://58.114.106.168/pid=1000/?ch=&ea=
http://58.168.129.82/pid=1000/?ch=&ea=
http://58.65.191.77/pid=1000/?ch=&ea=
http://59.155.126.31/pid=1000/?ch=&ea=
http://59.161.179.142/pid=1000/?ch=&ea=
http://59.188.88.11/pid=1000/?ch=&ea=
http://59.93.54.197/pid=1000/?ch=&ea=
http://60.54.5.136/pid=1000/?ch=&ea=
http://61.15.188.202/pid=1000/?ch=&ea=
http://63.162.17.55/pid=1000/?ch=&ea=
http://64.0.31.7/pid=1000/?ch=&ea=
http://64.150.210.201/pid=1000/?ch=&ea=
http://64.231.59.57/pid=1000/?ch=&ea=
http://64.252.0.118/pid=1000/?ch=&ea=
http://65.185.162.122/pid=1000/?ch=&ea=
http://65.190.150.200/pid=1000/?ch=&ea=
http://65.31.182.12/pid=1000/?ch=&ea=
http://65.60.254.45/pid=1000/?ch=&ea=
http://65.71.92.241/pid=1000/?ch=&ea=
http://65.93.183.89/pid=1000/?ch=&ea=
http://66.176.61.63/pid=1000/?ch=&ea=
http://66.19.101.94/pid=1000/?ch=&ea=
http://66.190.74.31/pid=1000/?ch=&ea=
http://66.219.181.18/pid=1000/?ch=&ea=
http://66.229.120.142/pid=1000/?ch=&ea=
http://66.41.5.198/pid=1000/?ch=&ea=
http://67.11.164.89/pid=1000/?ch=&ea=
http://67.125.158.149/pid=1000/?ch=&ea=
http://67.160.192.87/pid=1000/?ch=&ea=
http://67.163.106.143/pid=1000/?ch=&ea=
http://67.163.174.65/pid=1000/?ch=&ea=
http://67.166.193.60/pid=1000/?ch=&ea=
http://67.173.205.65/pid=1000/?ch=&ea=
http://67.186.127.84/pid=1000/?ch=&ea=
http://67.188.3.231/pid=1000/?ch=&ea=
http://67.191.135.77/pid=1000/?ch=&ea=
http://67.78.84.134/pid=1000/?ch=&ea=
http://67.8.151.144/pid=1000/?ch=&ea=
http://68.113.114.253/pid=1000/?ch=&ea=
http://68.116.207.159/pid=1000/?ch=&ea=
http://68.150.167.240/pid=1000/?ch=&ea=
http://68.187.191.41/pid=1000/?ch=&ea=
http://68.190.69.207/pid=1000/?ch=&ea=
http://68.32.26.223/pid=1000/?ch=&ea=
http://68.37.136.97/pid=1000/?ch=&ea=
http://68.39.76.19/pid=1000/?ch=&ea=
http://68.46.36.85/pid=1000/?ch=&ea=
http://68.47.2.220/pid=1000/?ch=&ea=
http://68.54.142.102/pid=1000/?ch=&ea=
http://68.55.133.219/pid=1000/?ch=&ea=
http://68.61.230.159/pid=1000/?ch=&ea=
http://68.61.90.145/pid=1000/?ch=&ea=
http://68.81.240.216/pid=1000/?ch=&ea=
http://68.81.27.105/pid=1000/?ch=&ea=
http://68.84.43.224/pid=1000/?ch=&ea=
http://69.104.143.147/pid=1000/?ch=&ea=
http://69.107.138.172/pid=1000/?ch=&ea=
http://69.133.26.107/pid=1000/?ch=&ea=
http://69.134.107.56/pid=1000/?ch=&ea=
http://69.137.210.2/pid=1000/?ch=&ea=
http://69.139.168.9/pid=1000/?ch=&ea=
http://69.155.214.33/pid=1000/?ch=&ea=
http://69.208.115.88/pid=1000/?ch=&ea=
http://69.228.222.93/pid=1000/?ch=&ea=
http://69.229.248.216/pid=1000/?ch=&ea=
http://69.234.22.21/pid=1000/?ch=&ea=
http://69.244.211.111/pid=1000/?ch=&ea=
http://69.246.104.204/pid=1000/?ch=&ea=
http://69.247.217.222/pid=1000/?ch=&ea=
http://70.116.91.181/pid=1000/?ch=&ea=
http://70.132.18.136/pid=1000/?ch=&ea=
http://70.196.165.240/pid=1000/?ch=&ea=
http://70.200.13.26/pid=1000/?ch=&ea=
http://70.200.22.129/pid=1000/?ch=&ea=
http://70.240.248.105/pid=1000/?ch=&ea=
http://70.246.232.27/pid=1000/?ch=&ea=
http://70.252.72.9/pid=1000/?ch=&ea=
http://70.254.86.110/pid=1000/?ch=&ea=
http://71.104.195.43/pid=1000/?ch=&ea=
http://71.12.171.154/pid=1000/?ch=&ea=
http://71.137.2.191/pid=1000/?ch=&ea=
http://71.142.230.126/pid=1000/?ch=&ea=
http://71.15.38.227/pid=1000/?ch=&ea=
http://71.199.27.34/pid=1000/?ch=&ea=
http://71.202.3.218/pid=1000/?ch=&ea=
http://71.203.145.2/pid=1000/?ch=&ea=
http://71.204.95.218/pid=1000/?ch=&ea=
http://71.226.159.251/pid=1000/?ch=&ea=
http://71.231.232.152/pid=1000/?ch=&ea=
http://71.237.17.143/pid=1000/?ch=&ea=
http://71.239.64.251/pid=1000/?ch=&ea=
http://71.57.217.54/pid=1000/?ch=&ea=
http://71.74.144.92/pid=1000/?ch=&ea=
http://71.91.39.171/pid=1000/?ch=&ea=
http://72.138.0.112/pid=1000/?ch=&ea=
http://72.144.178.53/pid=1000/?ch=&ea=
http://72.178.17.74/pid=1000/?ch=&ea=
http://72.184.202.19/pid=1000/?ch=&ea=
http://72.190.116.60/pid=1000/?ch=&ea=
http://72.191.209.77/pid=1000/?ch=&ea=
http://72.21.144.8/pid=1000/?ch=&ea=
http://72.252.226.107/pid=1000/?ch=&ea=
http://74.198.96.208/pid=1000/?ch=&ea=
http://74.73.206.236/pid=1000/?ch=&ea=
http://75.0.227.244/pid=1000/?ch=&ea=
http://75.11.157.127/pid=1000/?ch=&ea=
http://75.12.117.128/pid=1000/?ch=&ea=
http://75.134.2.114/pid=1000/?ch=&ea=
http://75.136.143.146/pid=1000/?ch=&ea=
http://75.138.53.43/pid=1000/?ch=&ea=
http://75.179.62.135/pid=1000/?ch=&ea=
http://75.194.222.58/pid=1000/?ch=&ea=
http://75.200.145.96/pid=1000/?ch=&ea=
http://75.22.24.108/pid=1000/?ch=&ea=
http://75.22.92.203/pid=1000/?ch=&ea=
http://75.254.191.101/pid=1000/?ch=&ea=
http://75.3.137.94/pid=1000/?ch=&ea=
http://75.45.184.15/pid=1000/?ch=&ea=
http://75.48.250.116/pid=1000/?ch=&ea=
http://75.53.116.243/pid=1000/?ch=&ea=
http://75.62.244.27/pid=1000/?ch=&ea=
http://75.64.62.247/pid=1000/?ch=&ea=
http://75.72.97.91/pid=1000/?ch=&ea=
http://75.76.243.135/pid=1000/?ch=&ea=
http://75.80.113.32/pid=1000/?ch=&ea=
http://75.82.161.35/pid=1000/?ch=&ea=
http://75.83.169.248/pid=1000/?ch=&ea=
http://75.85.226.121/pid=1000/?ch=&ea=
http://76.104.166.143/pid=1000/?ch=&ea=
http://76.104.65.18/pid=1000/?ch=&ea=
http://76.110.112.33/pid=1000/?ch=&ea=
http://76.122.229.203/pid=1000/?ch=&ea=
http://76.127.243.110/pid=1000/?ch=&ea=
http://76.168.96.194/pid=1000/?ch=&ea=
http://76.171.237.159/pid=1000/?ch=&ea=
http://76.172.191.35/pid=1000/?ch=&ea=
http://76.177.207.194/pid=1000/?ch=&ea=
http://76.199.15.205/pid=1000/?ch=&ea=
http://76.199.25.1/pid=1000/?ch=&ea=
http://76.20.64.85/pid=1000/?ch=&ea=
http://76.204.38.108/pid=1000/?ch=&ea=
http://76.210.97.106/pid=1000/?ch=&ea=
http://76.223.0.45/pid=1000/?ch=&ea=
http://76.251.230.131/pid=1000/?ch=&ea=
http://76.251.70.105/pid=1000/?ch=&ea=
http://76.76.182.253/pid=1000/?ch=&ea=
http://76.87.86.254/pid=1000/?ch=&ea=
http://76.91.121.102/pid=1000/?ch=&ea=
http://76.91.7.42/pid=1000/?ch=&ea=
http://76.94.109.213/pid=1000/?ch=&ea=
http://76.98.124.21/pid=1000/?ch=&ea=
http://76.99.107.55/pid=1000/?ch=&ea=
http://77.35.183.120/pid=1000/?ch=&ea=
http://77.35.210.254/pid=1000/?ch=&ea=
http://77.79.140.253/pid=1000/?ch=&ea=
http://78.113.249.123/pid=1000/?ch=&ea=
http://78.145.178.89/pid=1000/?ch=&ea=
http://78.36.78.223/pid=1000/?ch=&ea=
http://78.52.134.110/pid=1000/?ch=&ea=
http://78.73.46.253/pid=1000/?ch=&ea=
http://79.113.182.102/pid=1000/?ch=&ea=
http://79.177.100.28/pid=1000/?ch=&ea=
http://79.183.252.106/pid=1000/?ch=&ea=
http://79.183.254.194/pid=1000/?ch=&ea=
http://79.33.233.190/pid=1000/?ch=&ea=
http://82.114.253.80/pid=1000/?ch=&ea=
http://82.131.218.7/pid=1000/?ch=&ea=
http://82.2.152.50/pid=1000/?ch=&ea=
http://82.81.11.133/pid=1000/?ch=&ea=
http://83.21.35.246/pid=1000/?ch=&ea=
http://83.30.230.109/pid=1000/?ch=&ea=
http://84.110.207.30/pid=1000/?ch=&ea=
http://84.52.62.235/pid=1000/?ch=&ea=
http://84.62.176.250/pid=1000/?ch=&ea=
http://84.73.220.85/pid=1000/?ch=&ea=
http://85.103.22.229/pid=1000/?ch=&ea=
http://85.179.99.47/pid=1000/?ch=&ea=
http://85.227.141.75/pid=1000/?ch=&ea=
http://85.29.144.166/pid=1000/?ch=&ea=
http://85.58.36.112/pid=1000/?ch=&ea=
http://86.108.28.105/pid=1000/?ch=&ea=
http://86.108.5.179/pid=1000/?ch=&ea=
http://86.121.65.139/pid=1000/?ch=&ea=
http://86.3.116.60/pid=1000/?ch=&ea=
http://87.189.214.152/pid=1000/?ch=&ea=
http://88.200.178.68/pid=1000/?ch=&ea=
http://89.138.58.165/pid=1000/?ch=&ea=
http://89.142.160.38/pid=1000/?ch=&ea=
http://89.165.75.168/pid=1000/?ch=&ea=
http://89.191.170.221/pid=1000/?ch=&ea=
http://89.218.81.61/pid=1000/?ch=&ea=
http://89.229.255.83/pid=1000/?ch=&ea=
http://90.151.15.102/pid=1000/?ch=&ea=
http://91.203.157.210/pid=1000/?ch=&ea=
http://92.124.77.47/pid=1000/?ch=&ea=
http://92.40.90.43/pid=1000/?ch=&ea=
http://93.147.218.186/pid=1000/?ch=&ea=
http://94.180.247.226/pid=1000/?ch=&ea=
http://94.253.47.41/pid=1000/?ch=&ea=
http://95.220.73.82/pid=1000/?ch=&ea=
http://95.86.107.220/pid=1000/?ch=&ea=
http://96.39.163.30/pid=1000/?ch=&ea=
http://97.81.245.4/pid=1000/?ch=&ea=
http://97.86.3.240/pid=1000/?ch=&ea=
http://97.92.232.74/pid=1000/?ch=&ea=
http://97.97.91.169/pid=1000/?ch=&ea=
http://98.125.185.62/pid=1000/?ch=&ea=
http://98.151.254.89/pid=1000/?ch=&ea=
http://98.200.118.46/pid=1000/?ch=&ea=
http://98.200.78.41/pid=1000/?ch=&ea=
http://98.215.101.207/pid=1000/?ch=&ea=
http://98.219.92.193/pid=1000/?ch=&ea=
http://98.230.132.63/pid=1000/?ch=&ea=
http://98.246.191.192/pid=1000/?ch=&ea=
http://98.246.75.3/pid=1000/?ch=&ea=
http://98.30.10.150/pid=1000/?ch=&ea=
http://99.130.199.117/pid=1000/?ch=&ea=
http://99.135.184.151/pid=1000/?ch=&ea=
http://99.155.156.201/pid=1000/?ch=&ea=
http://99.160.174.175/pid=1000/?ch=&ea=
http://99.162.32.33/pid=1000/?ch=&ea=
http://99.170.152.193/pid=1000/?ch=&ea=
http://99.177.93.85/pid=1000/?ch=&ea=
http://99.18.224.124/pid=1000/?ch=&ea=
http://99.25.149.254/pid=1000/?ch=&ea=
http://99.53.161.53/pid=1000/?ch=&ea=

And the list of IP's themselves;

112.150.3.52
114.73.15.109
114.75.22.27
115.135.22.77
116.54.12.207
117.200.211.29
117.200.97.85
118.100.124.101
118.160.194.126
119.94.26.9
12.219.75.172
121.96.106.234
121.96.243.32
122.51.218.39
122.53.59.125
122.55.198.199
123.255.20.221
124.158.70.194
125.107.66.47
165.132.193.184
174.48.92.134
188.24.240.254
190.26.12.101
196.206.192.153
196.206.73.192
200.104.112.223
200.79.214.207
201.149.235.248
201.160.142.149
201.174.213.208
201.241.56.215
201.88.88.28
203.198.108.237
203.212.201.31
204.13.181.145
208.96.79.170
212.220.108.203
212.35.66.215
213.6.65.91
218.168.184.2
218.172.72.100
220.120.131.144
220.139.46.84
220.158.15.36
221.127.120.43
221.127.254.54
221.128.214.39
222.121.227.7
24.1.103.249
24.116.109.135
24.117.234.115
24.136.172.239
24.14.58.26
24.151.168.145
24.168.90.30
24.17.253.66
24.20.125.254
24.205.33.85
24.209.162.67
24.53.141.59
24.53.143.254
24.62.12.107
24.68.70.58
24.9.127.102
24.94.21.199
24.98.202.156
24.98.45.0
4.229.198.39
41.145.183.45
41.250.109.63
58.114.106.168
58.168.129.82
58.65.191.77
59.155.126.31
59.161.179.142
59.188.88.11
59.93.54.197
60.54.5.136
61.15.188.202
63.162.17.55
64.0.31.7
64.150.210.201
64.231.59.57
64.252.0.118
65.185.162.122
65.190.150.200
65.31.182.12
65.60.254.45
65.71.92.241
65.93.183.89
66.176.61.63
66.19.101.94
66.190.74.31
66.219.181.18
66.229.120.142
66.41.5.198
67.11.164.89
67.125.158.149
67.160.192.87
67.163.106.143
67.163.174.65
67.166.193.60
67.173.205.65
67.186.127.84
67.188.3.231
67.191.135.77
67.78.84.134
67.8.151.144
68.113.114.253
68.116.207.159
68.150.167.240
68.187.191.41
68.190.69.207
68.32.26.223
68.37.136.97
68.39.76.19
68.46.36.85
68.47.2.220
68.54.142.102
68.55.133.219
68.61.230.159
68.61.90.145
68.81.240.216
68.81.27.105
68.84.43.224
69.104.143.147
69.107.138.172
69.133.26.107
69.134.107.56
69.137.210.2
69.139.168.9
69.155.214.33
69.208.115.88
69.228.222.93
69.229.248.216
69.234.22.21
69.244.211.111
69.246.104.204
69.247.217.222
70.116.91.181
70.132.18.136
70.196.165.240
70.200.13.26
70.200.22.129
70.240.248.105
70.246.232.27
70.252.72.9
70.254.86.110
71.104.195.43
71.12.171.154
71.137.2.191
71.142.230.126
71.15.38.227
71.199.27.34
71.202.3.218
71.203.145.2
71.204.95.218
71.226.159.251
71.231.232.152
71.237.17.143
71.239.64.251
71.57.217.54
71.74.144.92
71.91.39.171
72.138.0.112
72.144.178.53
72.178.17.74
72.184.202.19
72.190.116.60
72.191.209.77
72.21.144.8
72.252.226.107
74.198.96.208
74.73.206.236
75.0.227.244
75.11.157.127
75.12.117.128
75.134.2.114
75.136.143.146
75.138.53.43
75.179.62.135
75.194.222.58
75.200.145.96
75.22.24.108
75.22.92.203
75.254.191.101
75.3.137.94
75.45.184.15
75.48.250.116
75.53.116.243
75.62.244.27
75.64.62.247
75.72.97.91
75.76.243.135
75.80.113.32
75.82.161.35
75.83.169.248
75.85.226.121
76.104.166.143
76.104.65.18
76.110.112.33
76.122.229.203
76.127.243.110
76.168.96.194
76.171.237.159
76.172.191.35
76.177.207.194
76.199.15.205
76.199.25.1
76.20.64.85
76.204.38.108
76.210.97.106
76.223.0.45
76.251.230.131
76.251.70.105
76.76.182.253
76.87.86.254
76.91.121.102
76.91.7.42
76.94.109.213
76.98.124.21
76.99.107.55
77.35.183.120
77.35.210.254
77.79.140.253
78.113.249.123
78.145.178.89
78.36.78.223
78.52.134.110
78.73.46.253
79.113.182.102
79.177.100.28
79.183.252.106
79.183.254.194
79.33.233.190
82.114.253.80
82.131.218.7
82.2.152.50
82.81.11.133
83.21.35.246
83.30.230.109
84.110.207.30
84.52.62.235
84.62.176.250
84.73.220.85
85.103.22.229
85.179.99.47
85.227.141.75
85.29.144.166
85.58.36.112
86.108.28.105
86.108.5.179
86.121.65.139
86.3.116.60
87.189.214.152
88.200.178.68
89.138.58.165
89.142.160.38
89.165.75.168
89.191.170.221
89.218.81.61
89.229.255.83
90.151.15.102
91.203.157.210
92.124.77.47
92.40.90.43
93.147.218.186
94.180.247.226
94.253.47.41
95.220.73.82
95.86.107.220
96.39.163.30
97.81.245.4
97.86.3.240
97.92.232.74
97.97.91.169
98.125.185.62
98.151.254.89
98.200.118.46
98.200.78.41
98.215.101.207
98.219.92.193
98.230.132.63
98.246.191.192
98.246.75.3
98.30.10.150
99.130.199.117
99.135.184.151
99.155.156.201
99.160.174.175
99.162.32.33
99.170.152.193
99.177.93.85
99.18.224.124
99.25.149.254
99.53.161.53

I've not yet ran the list through hpObserver to get the PTR's for the IP's, but will do that later (absolutely knackered at the moment, and busy processing over 2000 other phishing domains).

/edit

hpObserver results (includes PTR) for the IP's;

http://hosts-file.net/misc/hpObserver_-_Koobface.html