# 
# this list of ponmocup malware redirection domains and infected web-servers is maintained by 
# email:   toms.security.stuff -at- gmail.com
# twitter: @c_APT_ure
# blog:    http://c-apt-ure.blogspot.com/
#
# for use with CIF see malware-feeds here:
# http://security-research.dyndns.org/pub/malware-feeds/
# 
date started: Mon Nov  9 00:00:01 PST 2020
checking domain: www.jacquestrifin.be --> seems to be INFECTED: http://golfforkids.assistlist.com/fpc.pl --> DNS: golfforkids.assistlist.com (golfforkids.assistlist.com) / 3.223.115.185
checking domain: upetterbeek.be --> seems to be INFECTED: http://seelback.tfgjustsayin.net/avatar/b8805389ee4391c3f8f9b91ce3cf11b9 --> DNS: seelback.tfgjustsayin.net (seelback.tfgjustsayin.net) / failed: Name or service not known.
checking domain: www.aca-uccle.be --> seems to be INFECTED: http://omonkhegbele.wenerdhard.com/delivery/lg.php --> DNS: omonkhegbele.wenerdhard.com (omonkhegbele.wenerdhard.com) / failed: Connection timed out.
checking domain: www.upetterbeek.be --> seems to be INFECTED: http://seelback.tfgjustsayin.net/avatar/b8805389ee4391c3f8f9b91ce3cf11b9 --> DNS: seelback.tfgjustsayin.net (seelback.tfgjustsayin.net) / failed: Name or service not known.
checking domain: www.destrangers.org --> seems to be INFECTED: http://bidin.golfnewslouisiana.com/neo/darla/php/fc.php --> DNS: bidin.golfnewslouisiana.com (bidin.golfnewslouisiana.com) / failed: Name or service not known.
checking domain: 1980622.com --> seems to be INFECTED: http://trafficsources.org/cgi-bin/r.cgi --> DNS: trafficsources.org (trafficsources.org) / 45.56.79.23, 45.33.2.79, 198.58.118.167,  /
checking domain: afag.com.br --> seems to be INFECTED: http://travelmeant.net/cgi-bin/r.cgi --> DNS: travelmeant.net (travelmeant.net) / failed: Name or service not known.
checking domain: agroservis.rs --> seems to be INFECTED: http://voictoall.com/cgi-bin/r.cgi --> DNS: voictoall.com (voictoall.com) / 160.124.3.195
checking domain: blackcanyoncoffee.com --> seems to be INFECTED: http://mudras.jordandowney.net/show/frame.php --> DNS: mudras.jordandowney.net (mudras.jordandowney.net) / failed: Name or service not known.
checking domain: blog.autourdeminuit.com --> seems to be INFECTED: http://trackallnet.com/cgi-bin/r.cgi --> DNS: trackallnet.com (trackallnet.com) / failed: Name or service not known.
checking domain: bluewingz.com --> seems to be INFECTED: http://metromanias.com/cgi-bin/r.cgi --> DNS: metromanias.com (metromanias.com) / 208.91.197.46
checking domain: cdcookingbook.com --> seems to be INFECTED: http://severalcamp.com/cgi-bin/r.cgi --> DNS: severalcamp.com (severalcamp.com) / 119.28.6.251
checking domain: d-math1.com --> seems to be INFECTED: http://renolla.golfnewsnewyork.com/s --> DNS: renolla.golfnewsnewyork.com (renolla.golfnewsnewyork.com) / failed: Name or service not known.
checking domain: eniaktesting.com --> seems to be INFECTED: http://severalcamp.com/cgi-bin/r.cgi --> DNS: severalcamp.com (severalcamp.com) / 119.28.6.251
checking domain: espn-la.com --> seems to be INFECTED: http://guillaran.newcarsat.com/__utm.gif --> DNS: guillaran.newcarsat.com (guillaran.newcarsat.com) / failed: Name or service not known.
checking domain: famedomain.com --> seems to be INFECTED: http://metromanias.com/cgi-bin/r.cgi --> DNS: metromanias.com (metromanias.com) / 208.91.197.46
checking domain: harlawacademy.org --> seems to be INFECTED: http://teethalong.org/cgi-bin/r.cgi --> DNS: teethalong.org (teethalong.org) / 81.17.18.195
checking domain: janeece.com --> seems to be INFECTED: http://virtualmapping.org/cgi-bin/r.cgi --> DNS: virtualmapping.org (virtualmapping.org) / 104.247.81.52
checking domain: kw-dl.com --> seems to be INFECTED: http://trafficsources.org/cgi-bin/r.cgi --> DNS: trafficsources.org (trafficsources.org) / 45.56.79.23, 198.58.118.167, 45.79.19.196,  /
checking domain: laserme.de --> seems to be INFECTED: https://www.domainkompetenz.de/domain/index.php --> DNS: www.domainkompetenz.de (www.domainkompetenz.de) / 94.130.190.96
checking domain: ncpo.cc --> seems to be INFECTED: http://travelmeant.net/cgi-bin/r.cgi --> DNS: travelmeant.net (travelmeant.net) / failed: Name or service not known.
checking domain: perca.pl --> seems to be INFECTED: http://trafficsources.org/cgi-bin/r.cgi --> DNS: trafficsources.org (trafficsources.org) / 45.56.79.23, 198.58.118.167, 45.79.19.196,  /
checking domain: php2.twinner.com.tw --> seems to be INFECTED: http://32845.flatblastard.com/url --> DNS: 32845.flatblastard.com (32845.flatblastard.com) / 91.207.4.51
checking domain: pileus.fr --> seems to be INFECTED: http://severalcamp.com/cgi-bin/r.cgi --> DNS: severalcamp.com (severalcamp.com) / 119.28.6.251
checking domain: pmmilrec.com --> seems to be INFECTED: http://elinah.midnightastronomy.com/s --> DNS: elinah.midnightastronomy.com (elinah.midnightastronomy.com) / 31.210.96.155
checking domain: police.moraga.ca.us --> seems to be INFECTED: http://jesusonlynet.org/cgi-bin/r.cgi --> DNS: jesusonlynet.org (jesusonlynet.org) / 69.172.201.153
checking domain: sseo.elk.pl --> seems to be INFECTED: http://gensapa.valentinesalesevent.com/__utm.gif --> DNS: gensapa.valentinesalesevent.com (gensapa.valentinesalesevent.com) / failed: Name or service not known.
checking domain: stillcatholic.com --> seems to be INFECTED: http://zahasky.greatserviceforless.com/bbc/bbc/s --> DNS: zahasky.greatserviceforless.com (zahasky.greatserviceforless.com) / failed: Name or service not known.
checking domain: stw-eu.com --> seems to be INFECTED: http://interestingchapter.net/cgi-bin/r.cgi --> DNS: interestingchapter.net (interestingchapter.net) / failed: Name or service not known.
checking domain: syrena.gminanekla.pl --> seems to be INFECTED: http://apartliberal.com/cgi-bin/r.cgi --> DNS: apartliberal.com (apartliberal.com) / failed: Connection timed out.
checking domain: watchourvideo.net --> seems to be INFECTED: http://formedtouch.com/cgi-bin/r.cgi --> DNS: formedtouch.com (formedtouch.com) / failed: Name or service not known.
checking domain: wbu.wroc.pl --> seems to be INFECTED: http://travelmeant.net/cgi-bin/r.cgi --> DNS: travelmeant.net (travelmeant.net) / failed: Name or service not known.
checking domain: workpanel.de --> seems to be INFECTED: http://creighton.wenerdhard.com/delivery/ajs.php --> DNS: creighton.wenerdhard.com (creighton.wenerdhard.com) / failed: Connection timed out.
checking domain: www.actiogen.com --> seems to be INFECTED: http://teethalong.org/cgi-bin/r.cgi --> DNS: teethalong.org (teethalong.org) / 81.17.18.195
checking domain: www.alnimrexpo.com --> seems to be INFECTED: http://severalcamp.com/cgi-bin/r.cgi --> DNS: severalcamp.com (severalcamp.com) / 119.28.6.251
checking domain: www.apmc.com.hk --> seems to be INFECTED: http://capitalinformer.com/cgi-bin/r.cgi --> DNS: capitalinformer.com (capitalinformer.com) / 3.216.121.17, 54.85.65.140
checking domain: www.bodasexclusivas.com --> seems to be INFECTED: http://compass.automotiveeventregistration.com/safe_image.php --> DNS: compass.automotiveeventregistration.com (compass.automotiveeventregistration.com) / 72.21.92.51
checking domain: www.comune.santa-maria-capua-vetere.ce.it --> seems to be INFECTED: http://gesneriaceae.telecomillinois.com/pview --> DNS: gesneriaceae.telecomillinois.com (gesneriaceae.telecomillinois.com) / failed: Name or service not known.
checking domain: www.creatingyourfreedom.com --> seems to be INFECTED: /redirect.php --> DNS: www.godaddy.com (www.godaddy.com) / 104.75.144.99, 2600:1406:21:384::1771, 2600:1406:21:398::1771
checking domain: www.doctorhelp.de --> seems to be INFECTED: http://switchett.virtualsofts.com/pview --> DNS: switchett.virtualsofts.com (switchett.virtualsofts.com) / 173.239.8.164, 173.239.5.6, 213.247.47.190
checking domain: www.dulceselsombreron.com --> seems to be INFECTED: http://thousandmilitary.com/cgi-bin/r.cgi --> DNS: thousandmilitary.com (thousandmilitary.com) / failed: Name or service not known.
checking domain: www.elsiedesigns.com --> seems to be INFECTED: http://allintercom.net/cgi-bin/r.cgi --> DNS: allintercom.net (allintercom.net) / 104.247.81.70
checking domain: www.enimex.gr --> seems to be INFECTED: http://trafficsources.org/cgi-bin/r.cgi --> DNS: trafficsources.org (trafficsources.org) / 45.56.79.23, 198.58.118.167, 45.33.2.79,  /
checking domain: www.farmasanmodababy.com --> seems to be INFECTED: http://metromanias.com/cgi-bin/r.cgi --> DNS: metromanias.com (metromanias.com) / 208.91.197.46
checking domain: www.freesure.com.tr --> seems to be INFECTED: http://earlyanswered.com/cgi-bin/r.cgi --> DNS: earlyanswered.com (earlyanswered.com) / failed: Connection timed out.
checking domain: www.geoffwhite.ws --> seems to be INFECTED: http://trackallnet.com/cgi-bin/r.cgi --> DNS: trackallnet.com (trackallnet.com) / failed: Name or service not known.
checking domain: www.highsport.se --> seems to be INFECTED: http://udomchum.telecommichigan.com/api/getCount2.php --> DNS: udomchum.telecommichigan.com (udomchum.telecommichigan.com) / failed: Name or service not known.
checking domain: www.hostal3soles.com --> seems to be INFECTED: http://besidesdream.com/cgi-bin/r.cgi --> DNS: besidesdream.com (besidesdream.com) / 183.90.228.14
checking domain: www.hostpix.de --> seems to be INFECTED: http://xlau.kalkanturqouise.com/b/ss/jobsdb-prd-id/1/H.23.6/s49453760104071 --> DNS: xlau.kalkanturqouise.com (xlau.kalkanturqouise.com) / failed: Name or service not known.
checking domain: www.jalba.gr --> seems to be INFECTED: http://watchingsquare.com/cgi-bin/r.cgi --> DNS: watchingsquare.com (watchingsquare.com) / failed: Name or service not known.
checking domain: www.jtcomms.com --> seems to be INFECTED: http://solichana.telecommichigan.com/fpc.pl --> DNS: solichana.telecommichigan.com (solichana.telecommichigan.com) / failed: Name or service not known.
checking domain: www.log-in-verlag.de --> seems to be INFECTED: http://wcameron.powerplaycreative.com/__utm.gif --> DNS: wcameron.powerplaycreative.com (wcameron.powerplaycreative.com) / failed: Name or service not known.
checking domain: www.mazus-art.com --> seems to be INFECTED: http://allintercom.net/cgi-bin/r.cgi --> DNS: allintercom.net (allintercom.net) / 104.247.81.70
checking domain: www.msm.mc --> seems to be INFECTED: http://poserio.thecaregrouppc.net/getSegment.php --> DNS: poserio.thecaregrouppc.net (poserio.thecaregrouppc.net) / 104.247.81.130
checking domain: www.mywoom.com --> seems to be INFECTED: http://virtualmapping.org/cgi-bin/r.cgi --> DNS: virtualmapping.org (virtualmapping.org) / 104.247.81.52
checking domain: www.oo5.com --> seems to be INFECTED: http://uglyugly.savedalyfield.com/s --> DNS: uglyugly.savedalyfield.com (uglyugly.savedalyfield.com) / failed: Name or service not known.
checking domain: www.rollershop.de --> seems to be INFECTED: http://yinpou.aredietsok.com/b/ss/wbextextibrd,wbglobalext/1/G.9p2/s5601663509823 --> DNS: yinpou.aredietsok.com (yinpou.aredietsok.com) / failed: Name or service not known.
checking domain: www.santuariodalapa.pt --> seems to be INFECTED: http://tixon.theafternoonjoker.com/b --> DNS: tixon.theafternoonjoker.com (tixon.theafternoonjoker.com) / 31.210.96.158
checking domain: www.sdfbd.org --> seems to be INFECTED: http://handsexual.com/cgi-bin/r.cgi --> DNS: handsexual.com (handsexual.com) / 184.168.131.241
checking domain: www.sri.cmu.ac.th --> seems to be INFECTED: http://twansha.yourcakedecoratingclass.com/1pix.gif --> DNS: twansha.yourcakedecoratingclass.com (twansha.yourcakedecoratingclass.com) / failed: Name or service not known.
checking domain: www.successinteaching.info --> seems to be INFECTED: http://protechere.com/cgi-bin/r.cgi --> DNS: protechere.com (protechere.com) / 47.91.170.222
checking domain: www.timelessimagesmi.com --> seems to be INFECTED: http://abusalewm.exceltoner.com/b/ss/marthacom,marthacomglobal/1/H.22.1/s96150354931952 --> DNS: abusalewm.exceltoner.com (abusalewm.exceltoner.com) / 31.210.96.158
checking domain: www.vfbhermsdorf.de --> seems to be INFECTED: http://hinouchi.greatserviceforless.com/delivery/lg.php --> DNS: hinouchi.greatserviceforless.com (hinouchi.greatserviceforless.com) / failed: Name or service not known.
checking domain: www.vitaminbude.de --> seems to be INFECTED: http://karepii.dealerholidayevent.com/__utm.gif --> DNS: karepii.dealerholidayevent.com (karepii.dealerholidayevent.com) / failed: Name or service not known.
checking domain: www.wonderwhistle.co.uk --> seems to be INFECTED: http://infernomag.com/cgi-bin/r.cgi --> DNS: infernomag.com (infernomag.com) / failed: Connection timed out.
checking domain: www.zoeblitzer-natursteine.de --> seems to be INFECTED: http://besidesdream.com/cgi-bin/r.cgi --> DNS: besidesdream.com (besidesdream.com) / 183.90.228.14
date finished: Mon Nov  9 00:27:58 PST 2020