CastleCops® Exploit Malware

whois

at 20 Oct, 2007 @ 08:40:54

GeekTools Whois Proxy v5.0.4 Ready.
Checking access for 204.152.186.155... ok.

Checking server [whois.crsnic.net]

Checking server [whois.enom.com]
Results:
=-=-=-=

Registration Service Provided By: Enom, Inc
Contact: CustomerSupport@enom.com
Visit: www.enom.com

Domain name: planetanim.com

Administrative Contact:
   Wioland Jean-Christophe
   Jean-Christophe Wioland (jean-christophe.wioland@planetanim.com)
   +1.0147338951
   Fax: +1.9999999999
   42, rue Rene Delattre
   Saran, NA 45770
   FR

Technical Contact:
   Ikoula
   Hostmaster Ikoula (nic@ikoula.com)
   0892350503
   Fax:
   Energy Park, Immeuble Energy 6, 130 bd de Verdun
   Courbevoie,  92413
   FR

Registrant Contact:
   Ikoula
   Hostmaster Ikoula (nic@ikoula.com)
   0892350503
   Fax:
   Energy Park, Immeuble Energy 6, 130 bd de Verdun
   Courbevoie,  92413
   FR

Status: Locked

Name Servers:
   ns1.ikoula.fr
   ns2.ikoula.fr

Creation date: 03 Jan 2000 17:40:10
Expiration date: 03 Jan 2010 00:00:00
=-=-=-=
The data in this whois database is provided to you for information
purposes only, that is, to assist you in obtaining information about or
related to a domain name registration record. We make this information
available "as is," and do not guarantee its accuracy. By submitting a
whois query, you agree that you will use this data only for lawful
purposes and that, under no circumstances will you use this data to: (1)
enable high volume, automated, electronic processes that stress or load
this whois database system providing you this information; or (2) allow,
enable, or otherwise support the transmission of mass unsolicited,
commercial advertising or solicitations via direct mail, electronic
mail, or by telephone. The compilation, repackaging, dissemination or
other use of this data is expressly prohibited without prior written
consent from us.

We reserve the right to modify these terms at any time. By submitting
this query, you agree to abide by these terms.
Version 6.3 4/3/2002

Results brought to you by the GeekTools WHOIS Proxy
Server results may be copyrighted and are used with permission.
Your host (204.152.186.155) has visited 2641 times today.

dig any

at 20 Oct, 2007 @ 08:40:53

;www.planetanim.com.		IN	A
www.planetanim.com.	86400	IN	CNAME	planetanim.com.
planetanim.com.		86400	IN	A	213.246.37.148
planetanim.com.		86400	IN	NS	ns3.ikoula.fr.
planetanim.com.		86400	IN	NS	ns.planetanim.com.
planetanim.com.		86400	IN	NS	ns2.ikoula.fr.
planetanim.com.		86400	IN	NS	ns1.ikoula.fr.
;planetanim.com.			IN	A
planetanim.com.		86400	IN	A	213.246.37.148
;planetanim.com.			IN	MX
planetanim.com.		86400	IN	MX	10 mail.planetanim.com.
;planetanim.com.			IN	NS
planetanim.com.		86400	IN	NS	ns2.ikoula.fr.
planetanim.com.		86400	IN	NS	ns1.ikoula.fr.
planetanim.com.		86400	IN	NS	ns3.ikoula.fr.
planetanim.com.		86400	IN	NS	ns.planetanim.com.
;planetanim.com.			IN	SOA
planetanim.com.		86400	IN	SOA	ns.planetanim.com. jean-christophe.wioland.planetanim.com. 1154353324 10800 3600 604800 3600
;planetanim.com.			IN	TXT
;www.planetanim.com.		IN	CNAME
www.planetanim.com.	86399	IN	CNAME	planetanim.com.
;www.planetanim.com.		IN	PTR
www.planetanim.com.	86399	IN	CNAME	planetanim.com.
;planetanim.com.			IN	KEY
;www.planetanim.com.		IN	HINFO
www.planetanim.com.	86398	IN	CNAME	planetanim.com.
;www.planetanim.com.		IN	AAAA
www.planetanim.com.	86398	IN	CNAME	planetanim.com.
;; Query time: 176 msec
;; SERVER: 204.152.187.13#53(204.152.187.13)
;; WHEN: Sat Oct 20 08:40:53 2007
;; MSG SIZE  rcvd: 113

fetched page

at 29 Aug, 2007 @ 03:32:44
MD5 Fingerprint: c03eddca84ff5e6fb7a08216d8393b3b
SHA1 Fingerprint: 47074bd6138769b46d38d75839591f63c03326d5

HTTP/1.1 200 OK
Date: Wed, 29 Aug 2007 03:32:36 GMT
Server: Apache/2.2.2 (Fedora)
Last-Modified: Mon, 27 Aug 2007 20:19:26 GMT
ETag: "66400d-b60-12b58f80"
Accept-Ranges: bytes
Content-Length: 2912
Content-Type: text/html

MIRT^(TM)

Malware Incident Reporting and Termination^(TM) Squad

status: confirmed malware

Report for at 29 Aug, 2007 @ 03:32:43

whois

dig any

host

fetched page

Corresponding BGP Origin ASN

Possible BGP peer ASNs one AS hop away from BGP Origin ASN

AS Description of a given BGP ASN


	2002-2008 � Computer Cops LLC dba CastleCops®. All rights reserved. Acceptable Use Policy. Use signifies your agreement. 133ppm 0.466s (0.374s) Making cybercriminals unhappy since 2002*

MIRT(TM)

Malware Incident Reporting and Termination(TM) Squad

status: confirmed malware

Report for at 29 Aug, 2007 @ 03:32:43

whois

dig any

host

fetched page

Corresponding BGP Origin ASN

Possible BGP peer ASNs one AS hop away from BGP Origin ASN

AS Description of a given BGP ASN

MIRT^(TM)

Malware Incident Reporting and Termination^(TM) Squad