Pin the Tale on the Donkey

Topic One, continued: "How are these Russian-language
malefactors going about their attacks ?" one might ask.


The Linux tool cURL was used to capture the sourcecode at each of the listed URLs, first as HTML; and then those files were renamed as text files so that it would be difficult inadvertenly to open any of them with a vulnerable operating system & browser combination.  I extracted all the material separated by <script>...</script> in the sourcecodes in the order in which it appears, plus references to social media and a URL used for generating and installing metadata on domains from outside without using any FTP client, http://ogp.me/ns.

Your browser will treat both the Scripts links and the SourceCode links as plain text. This has the slight handicap of failing to convert any of the Cyrillic character codes; but we are looking for English-language malware. The AS9123 and AS24940 autonomous systems were chosen because their domains were used as intermediaries by all three of the major operators, Alexey Khoroshilov, MRS1, and Michel Clarisse. All the listed URLs in the first column were submitted to http://urlquery.net/ without finding any malware. The malefactors under study here would not have been hammering away at MiDomane.com since September of 2016 without letup or entry just for the fun of it ...

If you download the sourcecode text files to your own computer and rename them as HTML for viewing with your browser, you won't be protected, because all the files and images linked within that sourcecode will be retrieved from the mother ship unless your computer is not connected to the Internet in any way; beware !

Two last pages indicate somewhat more clearly what is going on: Autonomous System 9123 ... Autonomous System 24940
... See especially the Facebook Button and the Twitter Button
Screenshots.

Intermediary URLs [links --> urlquery.net]
Scripts
SourceCode
Int.ASN
UserAgent (no two combinations are alike)
Main ASN
http://gkclab.com/ Link to List gkclab.com.html AS9123 Mozilla/6.0 (compat.; MSIE2.00; Windows 2003) AS48347
https://nevapotolok.ru/услуги/ремонт-натя
Link to List
nevapotolok.ru.html
AS9123 Mozilla/6.0 (compat.; MSIE6.00; Windows 2002) AS48347
https://giftbig.ru/zerkalai/
Link to List
giftbig.ru.html
AS9123 Mozilla/4.0 (compa.; MSIE6.00; Windows 2002) AS48347
https://giftbig.ru/nastolnye-nabori/
Link to List
giftbig.ru02.html
AS9123 Mozilla/5.0 (compat.; MSIE5.00; Windows 2009) AS48347
http://gkclab.com/engl/acoustic/acoustic.html Link to List
gkclab.ru02.html
AS9123 Mozilla/3.0 (compat.; MSIE7.00; Windows 2004) AS48347
http://xn----dtbbjn3acd8j.xn--p1ai/ Link to List
xn----dtb...8j.xn..ai AS9123 Mozilla/6.0 (compat.; MSIE5.00; Windows 2008) AS48347
https://nashkomp.ru/category/telegram Link to List
nashkomp.ru.html
AS9123 Mozilla/4.0 (compat.; MSIE3.00; Windows 2009) AS48347
https://vseprobrak.ru/esli-muzh-pet-kazhduyu-
pyatnitsu-s-druzyami-sovetyi-psihologa
Link to List
vseprobrak.ru.html AS9123 Mozilla/5.0 (compat.; MSIE3.00; Windows 2005) AS48347
https://nashkomp.ru/ustanovka-telegram Link to List
nashkomp.ru02.html
AS9123 Mozilla/6.0 (compat.; MSIE6.00; Windows 2003) AS48347
https://estate24.moscow/streets/beregovaja-ulica/ Link to List
estate24.moscow.html
AS9123 Mozilla/6.0 (compat.; MSIE6.00; Windows 2002) AS48347
https://vseprobrak.ru/ne-tolko-vodka-est-
u-muzha-stihi-dlya-muzha-chtobyi-ne-pil
Link to List
vseprobrak.ru02.html AS9123 Mozilla/2.0 (compat.; MSIE5.00; Windows 2009) AS48347
http://xn----dtbbjn3acd8j.xn--p1ai/about/ Link to List
xn----dt...j.x...i02.html AS9123 Mozilla/7.0 (compat.; MSIE5.00; Windows 2009) AS48347
https://in-sto.ru/poleznye-stati/ Link to List
in-sto.ru.html
AS9123 Mozilla/6.0 (compat.; MSIE2.00; Windows 2007) AS48666
https://flyontime.ru/tours/kupit-tur-v-tailand/ Link to List
flyontime.ru.html
AS9123 Mozilla/7.0 (compat.; MSIE7.00; Windows 2006) AS48666
https://in-sto.ru/product-category/stendy-razvala-
shojdenia/techno-vector/techno-vektor-7-truck/
Link to List
in-sto.ru02.html
AS9123 Mozilla/8.0 (compat.; MSIE4.00; Windows 2007) Michel
Clarisse

https://giftbig.ru/podstavki-i-
krepleniya-pod-oruzhie-or/
Link to List
giftbig.ru03.html
AS9123 Mozilla/5.0 (compat.; MSIE2.00; Windows 2002) Michel
Clarisse
https://flyontime.ru/tours/kupit-tur-v-tunis/ Link to List
flyontime.ru2.html
AS9123 Mozilla/7.0 (compat.; MSIE2.00; Windows 2003) Michel
Clarisse
https://www.fermeru.pro/kak/pticevodstvo/
kuri/porodi-kur/myasnie-porodi-kur
Link to List www.fermeru.ru.html
AS24940
Mozilla/6.0 (compat.; MSIE3.00; Windows 2003) AS48666
https://www.divanos.com.ua/category/fabriki Link to List divanos.com.ua.html
AS24940 Mozilla/6.0 (compat.; MSIE6.00; Windows 2007) AS48666
https://www.divanos.com.ua/
category/kozhanye-divany
Link to List divanos.com.ua2.html
AS24940 Mozilla/3.0 (compat.; MSIE3.00; Windows 2004)
AS48666
http://otzovikotdbix.ru/otdyih-v-evpatorii-
otzyivyi-otdyihayushhih-2015/
Link to List otzovikotdbix.ru.html AS24940 Mozilla/6.0 (compat.; MSIE7.00; Windows 2004) AS48666
http://otzovikotdbix.ru/stoimost-putevki-v-
turtsiyu-na-dvoih-vse-vklyucheno/
Link to List otzov...dbix.ru02.html AS24940 Mozilla/5.0 (compat.; MSIE4.00; Windows 2005) AS48666
http://autofuct.ru/pravilnaya-
posadka-za-rulem-avtomobilya/
Link to List autofuct.ru.html
AS24940 Mozilla/3.0 (compat.; MSIE5.00; Windows 2008) AS48666
http://otzovikotdbix.ru/otdyih-v-noyabre-
na-more-za-granitsey-gde-teplo-nedorogo/
Link to List otzov...dbix.ru03.html AS24940 Mozilla/2.0 (compat.; MSIE2.00; Windows 2002) AS48666
http://www.rabota-biznes.com/
category/poleznue-stati
Link to List rabota-biznes.com.html
AS24940 Mozilla/7.0 (compat.; MSIE7.00; Windows 2003) AS48666
http://www.rabota-biznes.com/
category/uridicheskie-tonkosti
Link to List ra..a-bi..es.com02.html AS24940 Mozilla/3.0 (compat.; MSIE6.00; Windows 2006) AS48666
http://www.beton-area.com/category/postroyki Link to List beton-area.com.html AS24940 Mozilla/2.0 (compat.; MSIE4.00; Windows 2005) AS48666
http://www.rabota-biznes.com/category/
kreditu-zaumu-mikrozaimu
Link to List ra..a-bi..es.com03.html AS24940 Mozilla/3.0 (compat.; MSIE3.00; Windows 2008) Michel
Clarisse

http://www.beton-area.com/category/postroyki Link to List beton-area.com02.html AS24940 Mozilla/3.0 (compat.; MSIE6.00; Windows 2008) Michel
Clarisse
http://www.rabota-biznes.com/
category/uridicheskie-tonkosti
Link to List ra..a-bi..es.com04.html AS24940 Mozilla/4.0 (compat.; MSIE5.00; Windows 2009) Michel
Clarisse