Neosploit Redirectors

These are redirecting to neosploit/fiesta.

1) www.dreamincode.net/forums/topic/100672-how-to-get-all-ip-addresses-of-a-systems-connected-to-a-lan/ > Compromised Site
2) meleyomiho.longmusic.com/s406ezzwryav12/4e7302eaa7dc50f5769349bc18584ceb/ > DYN REDIR
3) meleyomiho.longmusic.com/hfbd8ppo/?4 > NEO GATE

1) www.dreamincode.net/forums/topic/256685-sending-a-message-to-multiple-clients/ > Compromised Site
2) qudixev.longmusic.com/2evr0hzwkxlarrx3/4e73527aa7dc50f53669349bc18c84ceb/ > DYN REDIR
3) qudixev.longmusic.com/hfbd8ppo/?4 > NEO GATE

More Examples:

budplix.changeip.name/omoslvzcvnwjnljqf/4e73014aa7dc50f6369349bc18884ceb/
cejapavqze.longmusic.com/cbz7yezbvuotg/517dd3bd75bb1f24fca169919bcf7ddf/
cothvu.changeip.name/llwstbzxwmika34/4e73014aa7dc96f0769349bc18884ceb/
denepsfol.changeip.name/yqvpnszxwaz0rkuh/fa4d85395479a005de13a117d67b10c1/
fjlide.longmusic.com/ipddy7zthhob3yds/54adcdea94611ad546a79d12229cdba6/
gevqeoq.longmusic.com/kkbjezulwaen/4e73014aa7dc50f0769378bc18884ceb/
gofozcawo.changeip.name/fcvekvzxw0wqhn/54adcdea9731134546a79d12229cdba6/
joduegqeh.changeip.name/bqdjr2zjypg7j/4e73014aa7dc50f0569349bc18884ceb/

You can regex logs for HTTP URI of:

^http:\/\/[a-z]{6,10}\.(hopto\.org|changeip\.name|longmusic\.com|ftpserver\.biz|dns04\.com|myvnc\.com|servehttp\.com|sytes\.net)\/[a-z0-9]{10,17}\/[a-f0-9]{32}\/$

See examples of Neosploit Redirectors on UrlQuery.net

Comments are closed.