Sakura EK on waw .pl domains

Have noticed Sakura active on waw.pl root domain.

As @kafeine notes, this is a TDS in front of a particular instance of Sakura.

Examples

adscarl.liabufa.waw. pl/?joke=9
a6johns.omegdia.waw .pl/?joke=9
a2publi.foscidir.waw. pl/?joke=9
99calva.lofnala.waw .pl/?foll=2
7bqjis.triptenlu.waw. pl/?foll=2

Tags seen include joke, poke, moon, foll, good, hera, key, etc.

IPs

50.7.177.254 (fdcservers nl)
50.7.177.253 (fdcservers nl)
50.7.178.13 (fdcservers nl)
85.17.122.119 (leaseweb nl)

Regex for TDS domains

^[a-z0-9]{6,7}\.[a-z]+\.waw\.pl$

Alternate Regex for TDS URI

\.waw\.pl\/\?[a-z]+=[0-9]+?$

Comments are closed.