Concerned about recent PAN-OS and other firewall/VPN CVEs? Take advantage of Zscaler’s special offer today

Zscaler Blog

Get the latest Zscaler blog updates in your inbox

Security Research

Ongoing Angler Exploit Kit And Bedep Fraud Campaign

February 11, 2015 - 4 min read
In our recent post covering CVE-2015-0311, two of the Command and Control (C&C) domains used in the Domain Generation Algorithm (DGA), mapped back to the same Server IP address - They were also using the same nameservers for resolution:
We took a closer look at the domains using these nameservers and found a distinct correlation between the C&C servers being used in this and other, possibly unrelated campaigns. In the past month, we've tracked over 70 domains involved in malware C&C or other malicious activity involving Click Fraud & Ransomware campaigns. These domains were registered via "Domain Context" and use "" nameservers for resolution.

To recap, we saw the initial binary was executed via the CVE-2015-0311 exploit, which then attempted resolution of multiple domains that were generated through a DGA:

Below is partial whois information for the two domains that resolved at that time:

Taking a closer look at these domains, we noticed that they share some commonalities, specifically their nameservers and IPs:

Comparison of C2 Domains
DomainIPObserved MethodRegistrarCreation DateContactNameserver(s)
gaabbezrezrhe1k.com46.105.251.1POST /domaincontext2015-01-19contact,
wzrdirqvrh07.com46.105.251.1POST /domaincontext2015-01-21yingw90,

Taking a look at other domains registered around that time via "Domain Context" by '' and also utilizing "" for resolution, we find the following 39 domains:

Looking at the same time period for domains registered through "Domain Context", using "Privacy Protect", and using "" for resolution, we find an additional 32 domains, which also seem to fit the general theme of a DGA:

The vast majority of these domains were resolving to Bedep's C&C servers. The following is a POST request to a C&C server from a Bedep infected system containing base64 encoded data:


However, some of the domains are being used in other seemingly unrelated malicious campaigns. For example the domain '' was identifed by Kafeine as hosting a Reveton ransom page. 

Other domains being used to monetize Bedep infections via click fraud include:

And the following domains are intermediaries hosting encrypted files:

Unfortunately, there are several different IPs in use on various ASNs:

C2 IP Information
IPNetblockASN OVH ISPOVH_65488197 OVH Static IPAS16276 OVH SASAS16276 OVH ISPOVH OVH SAS Dedicated ServersAS16276 OVH SASAS16276 OVH ISPOVH_65488197 OVH Static IPAS16276 OVHOVH OVH SAS Dedicated serversAS16276 RR-RC-Enet-ColumbusEE3-DOMAS10297 for Nobis Technology Group, LLCNETBLK-NOBIS-TECHNOLOGY-GROUP-18AS15003 for Nobis Technology Group, LLCNETBLK-NOBIS-TECHNOLOGY-GROUP-18AS15003 OVHIUNET-BNET80 OVH SASAS1267 AS29073 Route objectNL-ECATEL-20100816 Ecatel LTDAS29073 LimitedRSDEDI-KBPNNOIL Dedicated Server HostingAS35662 route objectRSDEDI-IBOBAPEP Dedicated Server HostingAS35662 WorldStream IPv4.19AS49981 Solutions InternationalHSI-3AS30083 Solutions InternationalHSI-3AS30083 Solutions InternationalHSI-4AS30083 routeHSI-2AS30083


Attackers continue to move away from single IPs and small IP pools, preferring to distribute the infrastructure across multiple netblocks. This ensures their infrastructure is more resilient to blocks and takedown attempts allowing the attackers to continue to profit from compromised devices. Likewise, if a registrar or nameserver with poor reputation is found, specific actors will continue to leverage them until mitigations are put in place. 
form submtited
Thank you for reading

Was this post useful?

dots pattern

Get the latest Zscaler blog updates in your inbox

By submitting the form, you are agreeing to our privacy policy.