https://www.botnets.fr/index.php?action=history&feed=atom&title=More_details_of_the_Dorifel_serversMore details of the Dorifel servers - Revision history2026-10-23T23:08:26ZRevision history for this page on the wikiMediaWiki 1.43.11https://www.botnets.fr/index.php?title=More_details_of_the_Dorifel_servers&diff=2364&oldid=prevEric.freyssinet: 1 revision imported2015-02-07T14:27:18Z<p>1 revision imported</p>
<p><b>New page</b></p><div>{{Publication<br />
|Image=<br />
|Legend=<br />
|Document=<br />
|Licence=<br />
|Video=<br />
|Link=http://rickey-g.blogspot.nl/2012/08/more-details-of-dorifel-servers.html blogspot.com<br />
|Author=Rickey Gevers, <br />
|NomRevue=Criminal brought to justice!<br />
|Date=10/08/2012<br />
|Editor=Rickey Gevers<br />
|Year=2012<br />
|ISBN=<br />
|Page=<br />
|Abstract=Below are my findings of the two servers used in the (targetted) attack mainly taking place in the Netherlands.<br />
<br />
We have 2 server setups that are close to identical, their ip-adresses are:<br />
184.22.103.202 (Domain: reslove-dns.com)<br />
184.82.162.163 (Domains: 10ba.com, windows-update-server.com, wsef32asd1.org, dns-local.org)<br />
Both are hosted within AS21788<br />
<br />
From now on I consider both IP-adresses as one server. Or both IP-adresses as a proxy.<br />
|Botnet=Dorifel, <br />
|Malware=, <br />
|CCProtocol=, <br />
|Operation=, <br />
|Keyword=, <br />
}}</div>Eric.freyssinet