MegaRBL Hacked!

corey

Hey guys I'm here to report it looks like megarbl has been hacked. https://www.megarbl.net/account says 'helo dude' and when you go to their home page it tries to get you to download a weird spammy looking thing.

InceptionHosting

somethings going on with it that's for sure, what an odd target!

ulayer

Saw this last week, it's especially fishy because their SSL/TLS certificate is using traffic.club, adserver.traffic.club and track.traffic.club as the subject alt names.

WSS

Registrar URL: http://www.tldregistrarsolutions.com
Updated Date: 2019-11-25T11:05:27Z
Creation Date: 2012-11-24T17:26:03Z
Registrar Registration Expiration Date: 2019-11-24T17:26:03Z

InceptionHosting

oooo.... oops!

jureve

Ouch!

corey

@WSS said:
Registrar URL: http://www.tldregistrarsolutions.com
Updated Date: 2019-11-25T11:05:27Z
Creation Date: 2012-11-24T17:26:03Z
Registrar Registration Expiration Date: 2019-11-24T17:26:03Z

Domain hasn't been released back to the public yet. The owners still have time to renew. It should still be pointing to their server.

Daniel

Seems like the domain is pointing to some sketchy-looking parking service.
https://dnstools.ws/lookup/megarbl.net/NS/
https://dnstools.ws/lookup/megarbl.net/A/

My guess is their registrar is one of those registrars that points expired domains to landing pages full of ads, rather than just showing a "this domain has expired" notice.

corey

@Daniel said:
Seems like the domain is pointing to some sketchy-looking parking service.
https://dnstools.ws/lookup/megarbl.net/NS/
https://dnstools.ws/lookup/megarbl.net/A/

My guess is their registrar is one of those registrars that points expired domains to landing pages full of ads, rather than just showing a "this domain has expired" notice.

Those are some sketchy ads with tons of redirects. Very weird.

Neoon

Happens, if the domain does expire and had a decent amount of traffic, people snapping it up and redirecting it into an ad paradise.

masedi

domain expired, not yet renewed, whats going on?