View source for More details of the Dorifel servers

{{Publication
|Image=
|Legend=
|Document=
|Licence=
|Video=
|Link=http://rickey-g.blogspot.nl/2012/08/more-details-of-dorifel-servers.html blogspot.com
|Author=Rickey Gevers, 
|NomRevue=Criminal brought to justice!
|Date=10/08/2012
|Editor=Rickey Gevers
|Year=2012
|ISBN=
|Page=
|Abstract=Below are my findings of the two servers used in the (targetted) attack mainly taking place in the Netherlands.

We have 2 server setups that are close to identical, their ip-adresses are:
184.22.103.202 (Domain: reslove-dns.com)
184.82.162.163 (Domains: 10ba.com, windows-update-server.com, wsef32asd1.org, dns-local.org)
Both are hosted within AS21788

From now on I consider both IP-adresses as one server. Or both IP-adresses as a proxy.
|Botnet=Dorifel, 
|Malware=, 
|CCProtocol=, 
|Operation=, 
|Keyword=, 
}}