Alert: 199.19.215.0/24

People often ask me what I do to try and escape or get a break from work, and I always give the same answer - I don't get time for breaks - too much to do (thought I had 3,000 active cases, turns out it's over 600,000 and growing daily). The latest ones involve not surprisingly, the Blackhole exploit kit.

A friend dropped me a note due to something that had been found and he's needing analysis. I did that, then scanned the rest of the range looking for more, and found a second server involved.

199.19.215.133
199.19.215.19

Both of these are on Vexxhost' IP space, and Vexxhost are being completely unresponsive (were sent an e-mail etc 2 days ago).

Filenames are a little different from last time, code is still stupidly easy to decode though (see previous blogs on that). In this case, the files are at;

hxxp://199.19.215.133/stats/content/jav2.jar
hxxp://199.19.215.133/stats/files/18
hxxp://199.19.215.133/stats/files/19
hxxp://199.19.215.133/stats/files/23
hxxp://199.19.215.133/stats/files/24

hxxp://199.19.215.19/stats/content/jav2.jar
hxxp://199.19.215.19/stats/files/18
hxxp://199.19.215.19/stats/files/19
hxxp://199.19.215.19/stats/files/23
hxxp://199.19.215.19/stats/files/24