New Koobface Domains [Updated]

Following are several domains affiliated with the Koobface worm, most of which are new or not widely known yet in the security community:

• schoefffayandtony.blogspot .com (Wepawet, Web of Trust)
• marylenerother.blogspot .com (Wepawet, Web of Trust)
• terrilyoguez.blogspot .com (Wepawet, Web of Trust)
• abdelalibokolas.blogspot .com (Wepawet, Web of Trust)
• coloradowin .com (Wepawet 1 2 3, Web of Trust)
• connecticuttea .com (Wepawet 1 2, Web of Trust)
• shanghaiwebcamera .com (Wepawet, Web of Trust)
• herangi .com (Wepawet 1 2, Web of Trust, MalwareURL, Malware Domain List, Norton Safe Web, DNS-BH, hpHosts, McAfee SiteAdvisor, VirusTotal)
• renewalretreat .com (Wepawet 1 2, Web of Trust, VirusTotal)*
• gxf .co.il (Wepawet 1 2 3, Web of Trust)*
• online-doors .co.uk (Wepawet 1 2, Web of Trust, McAfee SiteAdvisor, VirusTotal)*
   
• bhattimarbella.blogspot .com (Wepawet, Web of Trust)
• dorritlaurence.blogspot .com (Wepawet, Web of Trust)
• pylesaldinaldin.blogspot .com (Wepawet, Web of Trust)
• noreenlackie.blogspot .com (Wepawet, Web of Trust)
• sheardmiyeashya.blogspot .com (Wepawet, Web of Trust)
• milauckasnidalnidal.blogspot .com (Wepawet, Web of Trust)
• captjomarjomar.blogspot .com (Wepawet, Web of Trust)
• sharbelfleet.blogspot .com (Wepawet, Web of Trust)
• prestegaardboujida.blogspot .com (Wepawet, Web of Trust)
• spizzichinokailakaila.blogspot .com (Wepawet, Web of Trust)
• tempeaguero.blogspot .com (Wepawet, Web of Trust)
• yomiyomihampton-quinn.blogspot .com (Wepawet, Web of Trust)
• peraltanihatnihat.blogspot .com (Finjan detects Troj/JSRedir-AN, Unmask Parasites detects as suspicious, Web of Trust)
• bmwmodeltoys .com (Wepawet 1 2 3 etc., Web of Trust)
• csbizassist .org (Wepawet 1 2, Web of Trust, VirusTotal)*
• oyfontario .ca (Wepawet 1 2, Web of Trust, VirusTotal)*
• 1025wynr .net (Wepawet 1 2, Web of Trust, VirusTotal)*
• rominessheetmetal .com (Wepawet 1 2, Web of Trust, VirusTotal)*
• latentglobalmalaysia .com (Wepawet 1 2, Web of Trust, VirusTotal)*
• cahillappraisal .com (Wepawet 1 2, Web of Trust, Norton Safe Web)*
• fastpitchequipment .com (Wepawet 1 2, Web of Trust, Norton Safe Web, VirusTotal)*
• engravings .com (Wepawet 1 2, Web of Trust, Malware Domain List, Norton Safe Web, VirusTotal)*
    
• pablopicassosite .com (Wepawet 1 2, Web of Trust)

Many of the Wepawet reports also include a number of malicious URLs hosted at various IP addresses, at least some of which appear to be individual infected PCs whose IPs are probably dynamically assigned by the ISP.

Credit to my wife for reporting suspicious bit.ly redirect URLs that were being spread by a hacked Facebook account, which led to my investigation and discovery of these domains.

*Note that some of these domains were registered years ago. Their homepages may or may not be safe, but specific URLs hosted on these domains redirect to malicious sites or contain malware. Until the site owners remove the infected pages, these domains should not be trusted.

UPDATE, 8 Feb 2010 @ 06:20 PST: Added a second batch of sites.
UPDATE, 8 Feb 2010 @ 13:40 PST: Added pablopicassosite and VirusTotal links.
UPDATE, 8 Apr 2010 @ 21:30 PDT: I recently noticed that the Unmask Parasites blog linked back to this post. They've added an incredible amount of depth to this discussion, so please check out their article.


For more from the JoshMeister on Security, please subscribe to the RSS feed or follow me on Twitter.