Alert: Alliance and Leicester botnet

Oh dear, it started in July, then made a come back the middle of August, and now has returned yet again.

I've checked those that were alive in July, and they're all still dead, so they're not surprisingly, using brand new domains for this one. Quite why the registrars and ICANN et al, are allowing domain names with banking institues in them, astounds me - and obviously, is annoying.

I've only seen one such domain thus far (*.alliance-leicester091.com), but have no doubt there are others out there;

http://hosts-file.net/?s=alliance-leicester091

My friend over at Clean-MX has three dated September 1st and 2nd;

http://support.clean-mx.de/clean-mx/phishing.php?sort=firstseen desc&response=alive&domain=alliance-leicester%

/edit 22:26

Just received another one pointing to a different domain;

www.mybank.alliance-leicester777.com

Anthony added quite a few more to the database too, which makes the current list;

alliance-leicester091.com
alliance-leicester115.com
alliance-leicester117.com
alliance-leicester120.com
alliance-leicester128.com
alliance-leicester136.com
alliance-leicester143.com
alliance-leicester174.com
alliance-leicester185.com
alliance-leicester189.com
alliance-leicester191.com
alliance-leicester210.com
alliance-leicester223.com
alliance-leicester238.com
alliance-leicester240.com
alliance-leicester259.com
alliance-leicester304.com
alliance-leicester308.com
alliance-leicester312.com
alliance-leicester348.com
alliance-leicester353.com
alliance-leicester366.com
alliance-leicester380.com
alliance-leicester395.com
alliance-leicester423.com
alliance-leicester427.com
alliance-leicester446.com
alliance-leicester457.com
alliance-leicester487.com
alliance-leicester492.com
alliance-leicester508.com
alliance-leicester512.com
alliance-leicester519.com
alliance-leicester520.com
alliance-leicester528.com
alliance-leicester536.com
alliance-leicester547.com
alliance-leicester551.com
alliance-leicester579.com
alliance-leicester588.com
alliance-leicester603.com
alliance-leicester615.com
alliance-leicester620.com
alliance-leicester625.com
alliance-leicester628.com
alliance-leicester641.com
alliance-leicester658.com
alliance-leicester718.com
alliance-leicester727.com
alliance-leicester777.com
alliance-leicester808.com
alliance-leicester819.com
alliance-leicester830.com
alliance-leicester850.com
alliance-leicester851.com
alliance-leicester860.com
alliance-leicester872.com
alliance-leicester882.com
alliance-leicester885.com
alliance-leicester886.com
alliance-leicester890.com
alliance-leicester907.com
alliance-leicester917.com
alliance-leicester940.com
alliance-leicester945.com
alliance-leicester963.com
alliance-leicester968.com
alliance-leicester974.com
alliance-leicester975.com
alliance-leicester-co-uk.info
mybank.alliance-leicester091.com
mybank.alliance-leicester777.com
www.alliance-leicester091.com
www.alliance-leicester115.com
www.alliance-leicester117.com
www.alliance-leicester120.com
www.alliance-leicester128.com
www.alliance-leicester136.com
www.alliance-leicester143.com
www.alliance-leicester174.com
www.alliance-leicester185.com
www.alliance-leicester189.com
www.alliance-leicester191.com
www.alliance-leicester210.com
www.alliance-leicester223.com
www.alliance-leicester238.com
www.alliance-leicester240.com
www.alliance-leicester259.com
www.alliance-leicester304.com
www.alliance-leicester308.com
www.alliance-leicester312.com
www.alliance-leicester348.com
www.alliance-leicester353.com
www.alliance-leicester366.com
www.alliance-leicester380.com
www.alliance-leicester395.com
www.alliance-leicester423.com
www.alliance-leicester427.com
www.alliance-leicester446.com
www.alliance-leicester457.com
www.alliance-leicester487.com
www.alliance-leicester492.com
www.alliance-leicester508.com
www.alliance-leicester512.com
www.alliance-leicester519.com
www.alliance-leicester520.com
www.alliance-leicester528.com
www.alliance-leicester536.com
www.alliance-leicester547.com
www.alliance-leicester551.com
www.alliance-leicester579.com
www.alliance-leicester588.com
www.alliance-leicester603.com
www.alliance-leicester615.com
www.alliance-leicester620.com
www.alliance-leicester625.com
www.alliance-leicester628.com
www.alliance-leicester641.com
www.alliance-leicester658.com
www.alliance-leicester718.com
www.alliance-leicester727.com
www.alliance-leicester777.com
www.alliance-leicester808.com
www.alliance-leicester819.com
www.alliance-leicester830.com
www.alliance-leicester850.com
www.alliance-leicester851.com
www.alliance-leicester860.com
www.alliance-leicester872.com
www.alliance-leicester882.com
www.alliance-leicester885.com
www.alliance-leicester886.com
www.alliance-leicester890.com
www.alliance-leicester907.com
www.alliance-leicester917.com
www.alliance-leicester940.com
www.alliance-leicester945.com
www.alliance-leicester963.com
www.alliance-leicester968.com
www.alliance-leicester974.com
www.alliance-leicester975.com
www.alliance-leicester-co-uk.info
www.mybank.alliance-leicester091.com
www.mybank.alliance-leicester777.com

Anthony posted the hpObserver results over at MDL earlier;

http://it-mate.co.uk/temp/hpObserver_-_alliance-leicester_botnet_-_090906-1829.html

I've also ran them through hpObserver again to see if there are any new IP's;

http://it-mate.co.uk/temp/hpObserver_-_alliance-leicester_botnet_-_090906-2314.html