BEK2 :8080 Redirectors

These redirect to the BEK variant that uses :8080 from mass phishing.

HTTP Request Method = GET
Regex HTTP URI for “\.htm\?[A-Z0-9]{3,}=[A-Z0-9]{5,}$”

eg.

http://kazanhospital .ru/osc.htm?TZPJ6=D3DVRRBQ5OUJLV85WPG
http://danadala .ru:8080/forum/links/column.php

http://www.borgometeo .it/mail.htm?FO0IGS=8OP4BWSO
http://bunakaranka .ru:8080/forum/links/column.php

http://wt.ktus.ttct.edu .tw/sites/default/files/upload.htm?v203=3dr1g9rfkk
http://moneymakergrow .ru:8080/forum/links/column.php

http://www.gcpvail .com/modules/mail.htm?vp9y3=1ybzz81887575rrcki
http://bunakaranka.ru:8080/forum/links/column.php

See examples of BEK2 :8080 Redirectors on UrlQuery.net

Comments are closed.