Five DDNS Hostnames, One Backend, Tied to DarkHotel Downloader
A UPX-packed downloader flagged since 2014 phones home to five hostnames spread across four free dynamic-DNS brands, all resolving to the identical backend panel path and parameter. The overlap points to one operator rotating disposable infrastructure rather than four separately registered domains.
Five command-and-control hostnames spread across four unrelated free dynamic-DNS providers — Zyns, Crabdance (used twice), ServeHTTP, and Mooo — all resolve to the identical backend panel path, `/bin/home/home.php and /bin/home/view.php, and all carry the same encoded parameter string, a2=1ae8bdddea716a1fa3c8492572357e80. That repetition is the news here: gigamiros.zyns.com, microzion.crabdance.com, mirosmial.crabdance.com, microgenuinsman.servehttp.com and nanobis.mooo.com look, on the…
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read