# 
# this list of ponmocup malware redirection domains and infected web-servers is maintained by 
# email:   toms.security.stuff -at- gmail.com
# twitter: @c_APT_ure
# blog:    http://c-apt-ure.blogspot.com/
#
# for use with CIF see malware-feeds here:
# http://security-research.dyndns.org/pub/malware-feeds/
# 
date started: Mon May 21 00:00:02 PDT 2018
checking domain: www.jacquestrifin.be --> seems to be INFECTED: http://golfforkids.assistlist.com/__utm.gif --> DNS: golfforkids.assistlist.com (golfforkids.assistlist.com) / 31.210.96.158
checking domain: upetterbeek.be --> seems to be INFECTED: http://seelback.tfgjustsayin.net/avatar/b8805389ee4391c3f8f9b91ce3cf11b9 --> DNS: seelback.tfgjustsayin.net (seelback.tfgjustsayin.net) / 31.210.96.157
checking domain: www.supportedholidaysantequera.co.uk --> seems to be INFECTED: http://shahree.azdiscus.com/url --> DNS: shahree.azdiscus.com (shahree.azdiscus.com) / 141.8.224.93
checking domain: www.ilmatrimoniocivile.it --> seems to be INFECTED: http://yoheezy.devilwithacause.com/site/overlay/introduce_boyfriend_overlay --> DNS: yoheezy.devilwithacause.com (yoheezy.devilwithacause.com) / 31.210.96.155
checking domain: www.dynasun.com --> seems to be INFECTED: http://thousandmilitary.com/cgi-bin/r.cgi --> DNS: thousandmilitary.com (thousandmilitary.com) / 185.53.178.8
checking domain: www.agliran.co.il --> seems to be INFECTED: http://mercysiste.vehicleservicediscount.com/new/www/delivery/ajs.php --> DNS: mercysiste.vehicleservicediscount.com (mercysiste.vehicleservicediscount.com) / failed: Name or service not known.
checking domain: www.aca-uccle.be --> seems to be INFECTED: http://omonkhegbele.wenerdhard.com/servlet/ajrotator/2000399/0/vj --> DNS: omonkhegbele.wenerdhard.com (omonkhegbele.wenerdhard.com) / 31.210.96.155
checking domain: www.upetterbeek.be --> seems to be INFECTED: http://seelback.tfgjustsayin.net/snf/playdomapi.js.php --> DNS: seelback.tfgjustsayin.net (seelback.tfgjustsayin.net) / 31.210.96.157
checking domain: www.destrangers.org --> seems to be INFECTED: http://bidin.golfnewslouisiana.com/b --> DNS: bidin.golfnewslouisiana.com (bidin.golfnewslouisiana.com) / failed: Name or service not known.
checking domain: gezinsbondzarren.be --> seems to be INFECTED: http://kumher.savedalyfield.com/s --> DNS: kumher.savedalyfield.com (kumher.savedalyfield.com) / 207.244.67.218
checking domain: 1980622.com --> seems to be INFECTED: http://trafficsources.org/cgi-bin/r.cgi --> DNS: trafficsources.org (trafficsources.org) / 103.224.182.249
checking domain: afag.com.br --> seems to be INFECTED: http://travelmeant.net/cgi-bin/r.cgi --> DNS: travelmeant.net (travelmeant.net) / 103.224.182.245
checking domain: agirazul.com.br --> seems to be INFECTED: http://lewisentitled.com/cgi-bin/r.cgi --> DNS: lewisentitled.com (lewisentitled.com) / 72.52.4.122
checking domain: agroservis.rs --> seems to be INFECTED: http://voictoall.com/cgi-bin/r.cgi --> DNS: voictoall.com (voictoall.com) / 185.141.60.13
checking domain: avionhome.com.tw --> seems to be INFECTED: http://intronetech.com/cgi-bin/r.cgi --> DNS: intronetech.com (intronetech.com) / 141.8.224.169
checking domain: beakable.com --> seems to be INFECTED: http://zhylyanova.mygaycrush.com/BurstingPipe/adServer.bs --> DNS: zhylyanova.mygaycrush.com (zhylyanova.mygaycrush.com) / failed: Name or service not known.
checking domain: blackcanyoncoffee.com --> seems to be INFECTED: http://mudras.jordandowney.net/s --> DNS: mudras.jordandowney.net (mudras.jordandowney.net) / failed: Name or service not known.
checking domain: blog.autourdeminuit.com --> seems to be INFECTED: http://trackallnet.com/cgi-bin/r.cgi --> DNS: trackallnet.com (trackallnet.com) / 141.8.224.169
checking domain: bluewingz.com --> seems to be INFECTED: http://metromanias.com/cgi-bin/r.cgi --> DNS: metromanias.com (metromanias.com) / 208.73.210.202, 208.73.210.217, 208.73.211.177,  /
checking domain: cdcookingbook.com --> seems to be INFECTED: http://severalcamp.com/cgi-bin/r.cgi --> DNS: severalcamp.com (severalcamp.com) / 72.52.4.119
checking domain: demo.crg-sa.com --> seems to be INFECTED: http://sslabssys.com/cgi-bin/r.cgi --> DNS: sslabssys.com (sslabssys.com) / 108.61.19.11
checking domain: diningcity.net --> seems to be INFECTED: http://allintercom.net/cgi-bin/r.cgi --> DNS: allintercom.net (allintercom.net) / 185.53.178.9
checking domain: d-math1.com --> seems to be INFECTED: http://renolla.golfnewsnewyork.com/data/RNRoc1azVY00oW --> DNS: renolla.golfnewsnewyork.com (renolla.golfnewsnewyork.com) / 141.8.224.93
checking domain: duikeninzutphen.nl --> seems to be INFECTED: http://trialworld.net/cgi-bin/r.cgi --> DNS: trialworld.net (trialworld.net) / 103.224.182.241
checking domain: eniaktesting.com --> seems to be INFECTED: http://severalcamp.com/cgi-bin/r.cgi --> DNS: severalcamp.com (severalcamp.com) / 72.52.4.119
checking domain: equestrianinfluence.com --> seems to be INFECTED: http://capitalinformer.com/cgi-bin/r.cgi --> DNS: capitalinformer.com (capitalinformer.com) / 54.208.77.124
checking domain: espn-la.com --> seems to be INFECTED: http://guillaran.newcarsat.com/new2/www/delivery/lg.php --> DNS: guillaran.newcarsat.com (guillaran.newcarsat.com) / failed: Name or service not known.
checking domain: exclusivesms.com --> seems to be INFECTED: http://ifteiha.lions-mark.com/b/ss/ahmhondacomprod/0/FAS-1.3/s04833861524239 --> DNS: ifteiha.lions-mark.com (ifteiha.lions-mark.com) / 204.11.56.48
checking domain: ezkahuda.cz --> seems to be INFECTED: http://costslaid.com/cgi-bin/r.cgi --> DNS: costslaid.com (costslaid.com) / 185.53.179.6
checking domain: famedomain.com --> seems to be INFECTED: http://metromanias.com/cgi-bin/r.cgi --> DNS: metromanias.com (metromanias.com) / 208.73.210.217, 208.73.211.165, 208.73.210.202,  /
checking domain: forum.auto.am --> seems to be INFECTED: http://witchwyd.bestsilvercufflinks.com/pview --> DNS: witchwyd.bestsilvercufflinks.com (witchwyd.bestsilvercufflinks.com) / 31.210.96.156
checking domain: harlawacademy.org --> seems to be INFECTED: http://teethalong.org/cgi-bin/r.cgi --> DNS: teethalong.org (teethalong.org) / 172.98.192.35
checking domain: janeece.com --> seems to be INFECTED: http://virtualmapping.org/cgi-bin/r.cgi --> DNS: virtualmapping.org (virtualmapping.org) / 185.53.179.7
checking domain: jornalsodesporto.com --> seems to be INFECTED: http://yononz.totalslipsolutions.net/url --> DNS: yononz.totalslipsolutions.net (yononz.totalslipsolutions.net) / 178.211.33.205
checking domain: karavelle.com.br --> seems to be INFECTED: http://britts.oharvest.net/b --> DNS: britts.oharvest.net (britts.oharvest.net) / 31.210.96.156
checking domain: kw-dl.com --> seems to be INFECTED: http://trafficsources.org/cgi-bin/r.cgi --> DNS: trafficsources.org (trafficsources.org) / 103.224.182.249
checking domain: leandromauricio.com --> seems to be INFECTED: http://trafficsources.org/cgi-bin/r.cgi --> DNS: trafficsources.org (trafficsources.org) / 103.224.182.249
checking domain: matzlpage.de --> seems to be INFECTED: http://forhed.dealerholidayevent.com/b/ss/avgfreepublicww/1/H.17/s57541987974985 --> DNS: forhed.dealerholidayevent.com (forhed.dealerholidayevent.com) / failed: Name or service not known.
checking domain: mile2000.com --> seems to be INFECTED: http://infernomag.com/cgi-bin/r.cgi --> DNS: infernomag.com (infernomag.com) / 91.195.240.40
checking domain: myexfuzeoffice.com --> seems to be INFECTED: http://batilekaleka.laallstars.com/url --> DNS: batilekaleka.laallstars.com (batilekaleka.laallstars.com) / 178.211.33.205
checking domain: ncpo.cc --> seems to be INFECTED: http://travelmeant.net/cgi-bin/r.cgi --> DNS: travelmeant.net (travelmeant.net) / 103.224.182.245
checking domain: northbatonrougejournal.com --> seems to be INFECTED: http://severalcamp.com/cgi-bin/r.cgi --> DNS: severalcamp.com (severalcamp.com) / 72.52.4.119
checking domain: ofarroupilha.com.br --> seems to be INFECTED: http://infernomag.com/cgi-bin/r.cgi --> DNS: infernomag.com (infernomag.com) / 91.195.240.40
checking domain: perca.pl --> seems to be INFECTED: http://trafficsources.org/cgi-bin/r.cgi --> DNS: trafficsources.org (trafficsources.org) / 103.224.182.249
checking domain: php2.twinner.com.tw --> seems to be INFECTED: http://35518.flatblastard.com/url --> DNS: 35518.flatblastard.com (35518.flatblastard.com) / 91.207.4.51
checking domain: phuongdanhvonghe.edu.vn --> seems to be INFECTED: http://everybodynames.org/cgi-bin/r.cgi --> DNS: everybodynames.org (everybodynames.org) / 103.224.182.241
checking domain: pileus.fr --> seems to be INFECTED: http://severalcamp.com/cgi-bin/r.cgi --> DNS: severalcamp.com (severalcamp.com) / 72.52.4.119
checking domain: pmmilrec.com --> seems to be INFECTED: http://elinah.midnightastronomy.com/t.gif --> DNS: elinah.midnightastronomy.com (elinah.midnightastronomy.com) / 31.210.96.155
checking domain: pntc.ac.th --> seems to be INFECTED: http://twowayserf.com/cgi-bin/r.cgi --> DNS: twowayserf.com (twowayserf.com) / 103.224.212.222
checking domain: police.moraga.ca.us --> seems to be INFECTED: http://clubshop.boeckman.net/delivery/lg.php --> DNS: clubshop.boeckman.net (clubshop.boeckman.net) / 31.210.96.158
checking domain: radiogurbeti.com --> seems to be INFECTED: http://sonagara.slyforkfarm.com/pview --> DNS: sonagara.slyforkfarm.com (sonagara.slyforkfarm.com) / failed: Name or service not known.
checking domain: reimagery.com --> seems to be INFECTED: http://stiepcic.z-sat.com/spc.php --> DNS: stiepcic.z-sat.com (stiepcic.z-sat.com) / 31.210.96.158
checking domain: rose.kuro-tejina.com --> seems to be INFECTED: http://intronetech.com/cgi-bin/r.cgi --> DNS: intronetech.com (intronetech.com) / 141.8.224.169
checking domain: saobacdau.com.vn --> seems to be INFECTED: http://underbuild.net/cgi-bin/r.cgi --> DNS: underbuild.net (underbuild.net) / 162.222.213.196
checking domain: sseo.elk.pl --> seems to be INFECTED: http://gensapa.valentinesalesevent.com/_xhr/ugccomments/ --> DNS: gensapa.valentinesalesevent.com (gensapa.valentinesalesevent.com) / failed: Name or service not known.
checking domain: stillcatholic.com --> seems to be INFECTED: http://zahasky.greatserviceforless.com/plugins/easyXDM/cors/ --> DNS: zahasky.greatserviceforless.com (zahasky.greatserviceforless.com) / failed: Name or service not known.
checking domain: stw-eu.com --> seems to be INFECTED: http://interestingchapter.net/cgi-bin/r.cgi --> DNS: interestingchapter.net (interestingchapter.net) / 209.99.64.43
checking domain: syrena.gminanekla.pl --> seems to be INFECTED: http://apartliberal.com/cgi-bin/r.cgi --> DNS: apartliberal.com (apartliberal.com) / 103.224.182.241
checking domain: theflightattendantlife.com --> seems to be INFECTED: http://skagger.automotiveservicesavings.com/s --> DNS: skagger.automotiveservicesavings.com (skagger.automotiveservicesavings.com) / failed: Name or service not known.
checking domain: upunder.com --> seems to be INFECTED: http://everybodynames.org/cgi-bin/r.cgi --> DNS: everybodynames.org (everybodynames.org) / 103.224.182.241
checking domain: watchourvideo.net --> seems to be INFECTED: http://formedtouch.com/cgi-bin/r.cgi --> DNS: formedtouch.com (formedtouch.com) / 103.224.182.241
checking domain: wbu.wroc.pl --> seems to be INFECTED: http://travelmeant.net/cgi-bin/r.cgi --> DNS: travelmeant.net (travelmeant.net) / 103.224.182.245
checking domain: wodzirejka.com.pl --> seems to be INFECTED: http://formedtouch.com/cgi-bin/r.cgi --> DNS: formedtouch.com (formedtouch.com) / 103.224.182.241
checking domain: workpanel.de --> seems to be INFECTED: http://creighton.wenerdhard.com/new2/www/delivery/lg.php --> DNS: creighton.wenerdhard.com (creighton.wenerdhard.com) / 31.210.96.155
checking domain: www.actiogen.com --> seems to be INFECTED: http://teethalong.org/cgi-bin/r.cgi --> DNS: teethalong.org (teethalong.org) / 172.98.192.35
checking domain: www.alhassanain.com --> seems to be INFECTED: http://travelmeant.net/cgi-bin/r.cgi --> DNS: travelmeant.net (travelmeant.net) / 103.224.182.245
checking domain: www.alnimrexpo.com --> seems to be INFECTED: http://severalcamp.com/cgi-bin/r.cgi --> DNS: severalcamp.com (severalcamp.com) / 72.52.4.119
checking domain: www.apmc.com.hk --> seems to be INFECTED: http://capitalinformer.com/cgi-bin/r.cgi --> DNS: capitalinformer.com (capitalinformer.com) / 54.208.77.124
checking domain: www.aspi.ag --> seems to be INFECTED: http://umxamzah.mrsstyleseeker.com/__utm.gif --> DNS: umxamzah.mrsstyleseeker.com (umxamzah.mrsstyleseeker.com) / 31.210.96.157
checking domain: www.bharatinfoline.com --> seems to be INFECTED: http://lesbon.ksupridewrestling.com/b/ss/wmg,wmgatl,wmgd2cparamore,wmgparamoreall/1/H.20.3/s76891938059694 --> DNS: lesbon.ksupridewrestling.com (lesbon.ksupridewrestling.com) / 213.247.47.190, 173.239.8.164, 173.239.5.6
checking domain: www.bienenmilch.com --> seems to be INFECTED: http://jonestown.serenehomeandlandscapes.com/__utm.gif --> DNS: jonestown.serenehomeandlandscapes.com (jonestown.serenehomeandlandscapes.com) / failed: Name or service not known.
checking domain: www.bodasexclusivas.com --> seems to be INFECTED: http://compass.automotiveeventregistration.com/__utm.gif --> DNS: compass.automotiveeventregistration.com (compass.automotiveeventregistration.com) / 72.21.92.51
checking domain: www.carlosmeschini.com.br --> seems to be INFECTED: http://fulpagar.tropicaltoner.com/b --> DNS: fulpagar.tropicaltoner.com (fulpagar.tropicaltoner.com) / 31.210.96.158
checking domain: www.carlosvuam.com --> seems to be INFECTED: http://lewisentitled.com/cgi-bin/r.cgi --> DNS: lewisentitled.com (lewisentitled.com) / 72.52.4.122
checking domain: www.choice.md --> seems to be INFECTED: http://rangihaeata.hurricanesandylegaladvice.com/delivery/lg.php --> DNS: rangihaeata.hurricanesandylegaladvice.com (rangihaeata.hurricanesandylegaladvice.com) / failed: Name or service not known.
checking domain: www.comune.santa-maria-capua-vetere.ce.it --> seems to be INFECTED: http://gesneriaceae.telecomillinois.com/__utm.gif --> DNS: gesneriaceae.telecomillinois.com (gesneriaceae.telecomillinois.com) / failed: Name or service not known.
checking domain: www.creativ-art1.com --> seems to be INFECTED: http://vermillon.serenehomeandlandscapes.com/__utm.gif --> DNS: vermillon.serenehomeandlandscapes.com (vermillon.serenehomeandlandscapes.com) / failed: Name or service not known.
checking domain: www.dallascustomfurniture.com --> seems to be INFECTED: http://bonusforall.net/cgi-bin/r.cgi --> DNS: bonusforall.net (bonusforall.net) / failed: Name or service not known.
checking domain: www.doctorhelp.de --> seems to be INFECTED: http://switchett.virtualsofts.com/event.js --> DNS: switchett.virtualsofts.com (switchett.virtualsofts.com) / 173.239.8.164, 213.247.47.190, 173.239.5.6
checking domain: www.dreamboxturk.com --> seems to be INFECTED: http://baylet.autoeventregistration.com/url --> DNS: baylet.autoeventregistration.com (baylet.autoeventregistration.com) / failed: Name or service not known.
checking domain: www.dulceselsombreron.com --> seems to be INFECTED: http://thousandmilitary.com/cgi-bin/r.cgi --> DNS: thousandmilitary.com (thousandmilitary.com) / 185.53.178.8
checking domain: www.ejmii.com --> seems to be INFECTED: http://mahaphontrakoon.vehicleservicediscount.com/fpc.pl --> DNS: mahaphontrakoon.vehicleservicediscount.com (mahaphontrakoon.vehicleservicediscount.com) / failed: Name or service not known.
checking domain: www.elsiedesigns.com --> seems to be INFECTED: http://allintercom.net/cgi-bin/r.cgi --> DNS: allintercom.net (allintercom.net) / 185.53.178.9
checking domain: www.enimex.gr --> seems to be INFECTED: http://trafficsources.org/cgi-bin/r.cgi --> DNS: trafficsources.org (trafficsources.org) / 103.224.182.249
checking domain: www.farmasanmodababy.com --> seems to be INFECTED: http://metromanias.com/cgi-bin/r.cgi --> DNS: metromanias.com (metromanias.com) / 208.73.210.217, 208.73.210.202, 208.73.211.177,  /
checking domain: www.fatherlinh.com --> seems to be INFECTED: http://germanattention.org/cgi-bin/r.cgi --> DNS: germanattention.org (germanattention.org) / 68.178.213.61
checking domain: www.fishingtackleindia.com --> seems to be INFECTED: http://urladyms.newlogiq.com/st --> DNS: urladyms.newlogiq.com (urladyms.newlogiq.com) / 31.210.96.155
checking domain: www.freesure.com.tr --> seems to be INFECTED: http://earlyanswered.com/cgi-bin/r.cgi --> DNS: earlyanswered.com (earlyanswered.com) / 141.8.224.93
checking domain: www.freilandschwein.info --> seems to be INFECTED: http://earlyanswered.com/cgi-bin/r.cgi --> DNS: earlyanswered.com (earlyanswered.com) / 141.8.224.93
checking domain: www.geoffwhite.ws --> seems to be INFECTED: http://trackallnet.com/cgi-bin/r.cgi --> DNS: trackallnet.com (trackallnet.com) / 141.8.224.169
checking domain: www.greenfieldadvisorsltd.com --> seems to be INFECTED: http://moutsiouna.iretarpg.com/t.gif --> DNS: moutsiouna.iretarpg.com (moutsiouna.iretarpg.com) / 185.53.178.7
checking domain: www.gswsftp01.com --> seems to be INFECTED: http://parallag.bmemkitchens.com/tracker --> DNS: parallag.bmemkitchens.com (parallag.bmemkitchens.com) / failed: Name or service not known.
checking domain: www.highsport.se --> seems to be INFECTED: http://udomchum.telecommichigan.com/t.gif --> DNS: udomchum.telecommichigan.com (udomchum.telecommichigan.com) / failed: Name or service not known.
checking domain: www.hostal3soles.com --> seems to be INFECTED: http://besidesdream.com/cgi-bin/r.cgi --> DNS: besidesdream.com (besidesdream.com) / 103.224.182.246
checking domain: www.hostpix.de --> seems to be INFECTED: http://xlau.kalkanturqouise.com/dcsis0ifv10000gg3ag82u4rf_7b1e/dcs.gif --> DNS: xlau.kalkanturqouise.com (xlau.kalkanturqouise.com) / failed: Connection timed out.
checking domain: www.ijerd.com --> seems to be INFECTED: http://verzeroli.outbreakm3dia.com/new2/www/delivery/lg.php --> DNS: verzeroli.outbreakm3dia.com (verzeroli.outbreakm3dia.com) / 162.222.213.197
checking domain: www.jalba.gr --> seems to be INFECTED: http://watchingsquare.com/cgi-bin/r.cgi --> DNS: watchingsquare.com (watchingsquare.com) / 103.224.182.251
checking domain: www.jornalfarroupilha.com.br --> seems to be INFECTED: http://infernomag.com/cgi-bin/r.cgi --> DNS: infernomag.com (infernomag.com) / 91.195.240.40
checking domain: www.jornalocaminho.com.br --> seems to be INFECTED: http://gramelis.newyorkmascot.com/b --> DNS: gramelis.newyorkmascot.com (gramelis.newyorkmascot.com) / 103.224.212.222
checking domain: www.jtcomms.com --> seems to be INFECTED: http://solichana.telecommichigan.com/tracker --> DNS: solichana.telecommichigan.com (solichana.telecommichigan.com) / failed: Name or service not known.
checking domain: www.karavelle.com.br --> seems to be INFECTED: http://britts.oharvest.net/delivery/lg.php --> DNS: britts.oharvest.net (britts.oharvest.net) / 31.210.96.156
checking domain: www.klanglos-studio.de --> seems to be INFECTED: http://camplong.barbeveragesnv.com/pview --> DNS: camplong.barbeveragesnv.com (camplong.barbeveragesnv.com) / failed: Name or service not known.
checking domain: www.kyalasushi.com --> seems to be INFECTED: http://vesman.autoserviceevent.com/js_flat_1_0/ --> DNS: vesman.autoserviceevent.com (vesman.autoserviceevent.com) / failed: Name or service not known.
checking domain: www.larcheedmonton.org --> seems to be INFECTED: http://capitalinformer.com/cgi-bin/r.cgi --> DNS: capitalinformer.com (capitalinformer.com) / 54.208.77.124
checking domain: www.lipika.com --> seems to be INFECTED: http://malamut.revolverindy.com/pagead/ads --> DNS: malamut.revolverindy.com (malamut.revolverindy.com) / 67.227.226.240
checking domain: www.livre-etre-bien.com --> seems to be INFECTED: http://nedou.kidstryingtopayforcollege.com/s --> DNS: nedou.kidstryingtopayforcollege.com (nedou.kidstryingtopayforcollege.com) / 81.92.219.61
checking domain: www.log-in-verlag.de --> seems to be INFECTED: http://wcameron.powerplaycreative.com/__utm.gif --> DNS: wcameron.powerplaycreative.com (wcameron.powerplaycreative.com) / failed: Name or service not known.
checking domain: www.loxsavvy.com.au --> seems to be INFECTED: http://trialworld.net/cgi-bin/r.cgi --> DNS: trialworld.net (trialworld.net) / 103.224.182.241
checking domain: www.maquinaslitograficas.com --> seems to be INFECTED: http://metromanias.com/cgi-bin/r.cgi --> DNS: metromanias.com (metromanias.com) / 208.73.210.202, 208.73.210.217, 208.73.211.177,  /
checking domain: www.mazus-art.com --> seems to be INFECTED: http://allintercom.net/cgi-bin/r.cgi --> DNS: allintercom.net (allintercom.net) / 185.53.178.9
checking domain: www.medical-swiss.com --> seems to be INFECTED: http://zulainis.lakevillacomputerservice.com/b/ss/avgcorporatepublicww/1/H.22.1/s47566796703844 --> DNS: zulainis.lakevillacomputerservice.com (zulainis.lakevillacomputerservice.com) / 81.92.219.61
checking domain: www.miniaturesupplier.com --> seems to be INFECTED: http://koumparou.mwhiteman.com/img/3.gif --> DNS: koumparou.mwhiteman.com (koumparou.mwhiteman.com) / failed: Name or service not known.
checking domain: www.mitsuadvclub.net --> seems to be INFECTED: http://loardy.exquisiteclasscenter.com/url --> DNS: loardy.exquisiteclasscenter.com (loardy.exquisiteclasscenter.com) / 178.211.33.203
checking domain: www.movingtransfer.com --> seems to be INFECTED: http://taiugac.vehicleservicediscount.com/openx/www/delivery/lg.php --> DNS: taiugac.vehicleservicediscount.com (taiugac.vehicleservicediscount.com) / failed: Name or service not known.
checking domain: www.msm.mc --> seems to be INFECTED: http://poserio.thecaregrouppc.net/b --> DNS: poserio.thecaregrouppc.net (poserio.thecaregrouppc.net) / 185.53.178.6
checking domain: www.mywoom.com --> seems to be INFECTED: http://virtualmapping.org/cgi-bin/r.cgi --> DNS: virtualmapping.org (virtualmapping.org) / 185.53.179.7
checking domain: www.neonconcursos.com.br --> seems to be INFECTED: http://interestingchapter.net/cgi-bin/r.cgi --> DNS: interestingchapter.net (interestingchapter.net) / 209.99.64.43
checking domain: www.nwd-ly.com --> seems to be INFECTED: http://metromanias.com/cgi-bin/r.cgi --> DNS: metromanias.com (metromanias.com) / 208.73.210.202, 208.73.210.217, 208.73.211.177,  /
checking domain: www.oo5.com --> seems to be INFECTED: http://uglyugly.savedalyfield.com/b/ss/natgeongkidsmagccom,natgeoglobal/1/H.23.8/s35583777969137 --> DNS: uglyugly.savedalyfield.com (uglyugly.savedalyfield.com) / 37.48.65.148
checking domain: www.pfotenranch.de --> seems to be INFECTED: http://zaquitsha.vetsingreensboro.com/s --> DNS: zaquitsha.vetsingreensboro.com (zaquitsha.vetsingreensboro.com) / 185.53.178.7
checking domain: www.radiogurbeti.com --> seems to be INFECTED: http://sonagara.slyforkfarm.com/s --> DNS: sonagara.slyforkfarm.com (sonagara.slyforkfarm.com) / failed: Name or service not known.
checking domain: www.retrosheet.org --> seems to be INFECTED: http://trafficsources.org/cgi-bin/r.cgi --> DNS: trafficsources.org (trafficsources.org) / 103.224.182.249
checking domain: www.rgjassociation.info --> seems to be INFECTED: http://weedx.fubarpaintball.com/__utm.gif --> DNS: weedx.fubarpaintball.com (weedx.fubarpaintball.com) / failed: Name or service not known.
checking domain: www.rich.co.ke --> seems to be INFECTED: http://andritsos.newyorkjester.com/b --> DNS: andritsos.newyorkjester.com (andritsos.newyorkjester.com) / failed: Name or service not known.
checking domain: www.rollershop.de --> seems to be INFECTED: http://yinpou.aredietsok.com/st --> DNS: yinpou.aredietsok.com (yinpou.aredietsok.com) / 50.63.202.76
checking domain: www.santuariodalapa.pt --> seems to be INFECTED: http://tixon.theafternoonjoker.com/api/getCount2.php --> DNS: tixon.theafternoonjoker.com (tixon.theafternoonjoker.com) / 31.210.96.158
checking domain: www.sdfbd.org --> seems to be INFECTED: http://handsexual.com/cgi-bin/r.cgi --> DNS: handsexual.com (handsexual.com) / 208.91.196.32
checking domain: www.sri.cmu.ac.th --> seems to be INFECTED: http://twansha.yourcakedecoratingclass.com/__utm.gif --> DNS: twansha.yourcakedecoratingclass.com (twansha.yourcakedecoratingclass.com) / failed: Name or service not known.
checking domain: www.successinteaching.info --> seems to be INFECTED: http://protechere.com/cgi-bin/r.cgi --> DNS: protechere.com (protechere.com) / 104.171.24.26, 104.171.24.25, 2620:107:7000::1c0f:2001
checking domain: www.televideoproductions.com --> seems to be INFECTED: http://interestingchapter.net/cgi-bin/r.cgi --> DNS: interestingchapter.net (interestingchapter.net) / 209.99.64.43
checking domain: www.therapiehyperbare.com --> seems to be INFECTED: http://tagipur.mrsstyleseeker.com/st --> DNS: tagipur.mrsstyleseeker.com (tagipur.mrsstyleseeker.com) / 31.210.96.157
checking domain: www.timelessimagesmi.com --> seems to be INFECTED: http://abusalewm.exceltoner.com/pview --> DNS: abusalewm.exceltoner.com (abusalewm.exceltoner.com) / 31.210.96.158
checking domain: www.tri-tex.net --> seems to be INFECTED: http://vicrant.newworldheroes.com/__utm.gif --> DNS: vicrant.newworldheroes.com (vicrant.newworldheroes.com) / 31.210.96.158
checking domain: www.turbo-mixer.de --> seems to be INFECTED: http://schmakel.strongpsychic.com/fbml/ajax/uiserver.php --> DNS: schmakel.strongpsychic.com (schmakel.strongpsychic.com) / 31.210.96.155
checking domain: www.vfbhermsdorf.de --> seems to be INFECTED: http://hinouchi.greatserviceforless.com/gadgets/ifr --> DNS: hinouchi.greatserviceforless.com (hinouchi.greatserviceforless.com) / failed: Name or service not known.
checking domain: www.vidvanern.se --> seems to be INFECTED: http://usnai.restoremystuff.com/neo/darla/php/fc.php --> DNS: usnai.restoremystuff.com (usnai.restoremystuff.com) / 31.210.96.156
checking domain: www.vitaminbude.de --> seems to be INFECTED: http://karepii.dealerholidayevent.com/imgres --> DNS: karepii.dealerholidayevent.com (karepii.dealerholidayevent.com) / failed: Name or service not known.
checking domain: www.wallyontheweb.com --> seems to be INFECTED: http://ichinohe.casabodamia.com/b/ss/jobsdb-prd-id/1/H.23.6/s79051225238867 --> DNS: ichinohe.casabodamia.com (ichinohe.casabodamia.com) / 141.8.224.169
checking domain: www.wcgconline.net --> seems to be INFECTED: http://keniisha.realdealpsychic.com/s --> DNS: keniisha.realdealpsychic.com (keniisha.realdealpsychic.com) / 31.210.96.155
checking domain: www.wonderwhistle.co.uk --> seems to be INFECTED: http://infernomag.com/cgi-bin/r.cgi --> DNS: infernomag.com (infernomag.com) / 91.195.240.40
checking domain: www.zoeblitzer-natursteine.de --> seems to be INFECTED: http://besidesdream.com/cgi-bin/r.cgi --> DNS: besidesdream.com (besidesdream.com) / 103.224.182.246
checking domain: zarov.com.br --> seems to be INFECTED: http://upanesh.kemperfitness.com/t.gif --> DNS: upanesh.kemperfitness.com (upanesh.kemperfitness.com) / 173.239.8.164, 213.247.47.190, 173.239.5.6
date finished: Mon May 21 00:34:57 PDT 2018