Sundown EK using 40.69.68.179, Which is Assigned to Microsoft Corporation (MSFT).

Here is a picture of traffic collected during some of my investigations today:

traffic-1traffic-2

I didn’t think to look at the Whois information belonging to 40.69.68.179 until one of my friends, @Ledtech3, pointed this out:

arin-whois

Checking the IPs resolution history shows the first time a domain resolved to it was today, 01/25/17. All of the domains appear to be Sundown EK sub-domains on using the .mobi TLD:

Sundown EK Sub-Domain First Seen Last Seen
fkp.oig.mobi 1/25/2017 13:10 1/25/2017 13:10
st.ohu.mobi 1/25/2017 12:50 1/25/2017 12:50
ypn.oif.mobi 1/25/2017 12:26 1/25/2017 12:26
vm.oif.mobi 1/25/2017 12:26 1/25/2017 12:26
wnb.oif.mobi 1/25/2017 12:24 1/25/2017 12:24
tn.oif.mobi 1/25/2017 12:24 1/25/2017 12:24
dlu.oif.mobi 1/25/2017 12:23 1/25/2017 12:23
fh.oif.mobi 1/25/2017 12:23 1/25/2017 12:23
at.oif.mobi 1/25/2017 12:23 1/25/2017 12:23
ewi.ohs.mobi 1/25/2017 12:21 1/25/2017 12:21
hon.ohs.mobi 1/25/2017 12:21 1/25/2017 12:21
hgk.ohs.mobi 1/25/2017 12:20 1/25/2017 12:20
by.ohs.mobi 1/25/2017 12:18 1/25/2017 12:18
og.ohs.mobi 1/25/2017 12:18 1/25/2017 12:18
bs.ohs.mobi 1/25/2017 12:16 1/25/2017 12:16
sqk.ohb.mobi 1/25/2017 12:16 1/25/2017 12:16
ctl.ohb.mobi 1/25/2017 12:11 1/25/2017 12:15
ke.ohb.mobi 1/25/2017 12:13 1/25/2017 12:13
xpk.ohb.mobi 1/25/2017 12:12 1/25/2017 12:12
ho.ohb.mobi 1/25/2017 12:11 1/25/2017 12:11
bde.ohg.mobi 1/25/2017 12:04 1/25/2017 12:10
jr.ohg.mobi 1/25/2017 12:09 1/25/2017 12:09
npz.ohg.mobi 1/25/2017 12:09 1/25/2017 12:09
rug.ohg.mobi 1/25/2017 12:06 1/25/2017 12:06
qzs.ohp.mobi 1/25/2017 12:03 1/25/2017 12:03
rqz.ohp.mobi 1/25/2017 12:03 1/25/2017 12:03
kj.ohp.mobi 1/25/2017 12:02 1/25/2017 12:02
jpw.ohp.mobi 1/25/2017 12:01 1/25/2017 12:01
xi.ohp.mobi 1/25/2017 12:00 1/25/2017 12:00
hu.oia.mobi 1/25/2017 12:00 1/25/2017 12:00
oi.ohn.mobi 1/25/2017 11:59 1/25/2017 11:59
ja.ohn.mobi 1/25/2017 11:58 1/25/2017 11:58
cp.ohn.mobi 1/25/2017 11:57 1/25/2017 11:57
dcz.ohn.mobi 1/25/2017 11:55 1/25/2017 11:55
hq.ohn.mobi 1/25/2017 11:55 1/25/2017 11:55
mf.ohn.mobi 1/25/2017 11:54 1/25/2017 11:54
nj.ohu.mobi 1/25/2017 11:52 1/25/2017 11:52
nvt.ohu.mobi 1/25/2017 11:52 1/25/2017 11:52
gk.ohu.mobi 1/25/2017 11:49 1/25/2017 11:49
vdm.ohu.mobi 1/25/2017 11:49 1/25/2017 11:49
lea.ohu.mobi 1/25/2017 11:46 1/25/2017 11:46
yht.ohu.mobi 1/25/2017 11:46 1/25/2017 11:46
jsg.ohu.mobi 1/25/2017 11:44 1/25/2017 11:44
nz.oht.mobi 1/25/2017 11:36 1/25/2017 11:36
ef.oib.mobi 1/25/2017 11:32 1/25/2017 11:32
kqb.oib.mobi 1/25/2017 11:30 1/25/2017 11:30
qid.oib.mobi 1/25/2017 11:27 1/25/2017 11:27
fcz.oib.mobi 1/25/2017 11:27 1/25/2017 11:27
ev.oib.mobi 1/25/2017 11:26 1/25/2017 11:26
six.oib.mobi 1/25/2017 11:24 1/25/2017 11:24
kb.ohy.mobi 1/25/2017 11:17 1/25/2017 11:17
tf.ohy.mobi 1/25/2017 11:16 1/25/2017 11:16
sl.ohy.mobi 1/25/2017 11:15 1/25/2017 11:15
op.ohn.mobi 1/25/2017 11:12 1/25/2017 11:12
sg.ohn.mobi 1/25/2017 11:10 1/25/2017 11:10
sua.ohn.mobi 1/25/2017 11:09 1/25/2017 11:09
roi.oib.mobi 1/25/2017 11:06 1/25/2017 11:06
wbn.oib.mobi 1/25/2017 11:06 1/25/2017 11:06
cx.oib.mobi 1/25/2017 11:05 1/25/2017 11:05
ad.oib.mobi 1/25/2017 11:00 1/25/2017 11:04
yqn.oib.mobi 1/25/2017 11:03 1/25/2017 11:03
akw.ohk.mobi 1/25/2017 10:57 1/25/2017 10:57
eg.ohk.mobi 1/25/2017 10:56 1/25/2017 10:56
swv.oht.mobi 1/25/2017 10:53 1/25/2017 10:53
sd.oht.mobi 1/25/2017 10:52 1/25/2017 10:52
ag.oht.mobi 1/25/2017 10:45 1/25/2017 10:52
bj.oht.mobi 1/25/2017 10:41 1/25/2017 10:51
qrn.oht.mobi 1/25/2017 10:50 1/25/2017 10:50
df.oht.mobi 1/25/2017 10:42 1/25/2017 10:42
fre.ohg.mobi 1/25/2017 10:37 1/25/2017 10:37
ibo.ohg.mobi 1/25/2017 10:32 1/25/2017 10:35
gy.ohg.mobi 1/25/2017 10:35 1/25/2017 10:35
opv.ohl.mobi 1/25/2017 10:33 1/25/2017 10:33
yn.ohl.mobi 1/25/2017 10:32 1/25/2017 10:32
adi.ohl.mobi 1/25/2017 10:31 1/25/2017 10:31
klc.ohl.mobi 1/25/2017 10:30 1/25/2017 10:30
axp.ohl.mobi 1/25/2017 10:26 1/25/2017 10:30
pb.ohl.mobi 1/25/2017 10:30 1/25/2017 10:30
dwh.ohl.mobi 1/25/2017 10:28 1/25/2017 10:28
xg.ohj.mobi 1/25/2017 10:25 1/25/2017 10:25
dc.ohj.mobi 1/25/2017 10:24 1/25/2017 10:24
jhn.ohj.mobi 1/25/2017 10:16 1/25/2017 10:23
ld.ohj.mobi 1/25/2017 10:23 1/25/2017 10:23
adj.ohj.mobi 1/25/2017 10:16 1/25/2017 10:22
qu.ohj.mobi 1/25/2017 10:21 1/25/2017 10:21
nfc.ohj.mobi 1/25/2017 10:20 1/25/2017 10:20
zjn.ohc.mobi 1/25/2017 10:10 1/25/2017 10:10
dw.ohc.mobi 1/25/2017 10:08 1/25/2017 10:08
dro.ohc.mobi 1/25/2017 10:06 1/25/2017 10:06
yhn.ogn.mobi 1/25/2017 10:04 1/25/2017 10:04
vq.ogn.mobi 1/25/2017 10:03 1/25/2017 10:03
ab.ogn.mobi 1/25/2017 10:02 1/25/2017 10:02
su.ogn.mobi 1/25/2017 10:02 1/25/2017 10:02
fu.ogn.mobi 1/25/2017 10:01 1/25/2017 10:01
ru.ogn.mobi 1/25/2017 10:00 1/25/2017 10:00
bws.ogn.mobi 1/25/2017 9:58 1/25/2017 9:59
oc.ogy.mobi 1/25/2017 9:44 1/25/2017 9:44
du.ogy.mobi 1/25/2017 9:44 1/25/2017 9:44
kg.ogy.mobi 1/25/2017 9:43 1/25/2017 9:43
fw.ogy.mobi 1/25/2017 9:42 1/25/2017 9:42
it.ogy.mobi 1/25/2017 9:41 1/25/2017 9:41
yp.ogy.mobi 1/25/2017 9:40 1/25/2017 9:40
lf.ohc.mobi 1/25/2017 9:28 1/25/2017 9:34
sb.ohc.mobi 1/25/2017 9:34 1/25/2017 9:34
shz.ohc.mobi 1/25/2017 9:34 1/25/2017 9:34
yo.ohc.mobi 1/25/2017 9:32 1/25/2017 9:32
mv.ohc.mobi 1/25/2017 9:31 1/25/2017 9:31
xu.ohc.mobi 1/25/2017 9:30 1/25/2017 9:30
ij.ogs.mobi 1/25/2017 9:13 1/25/2017 9:25
kms.ogs.mobi 1/25/2017 9:24 1/25/2017 9:24
nri.ogs.mobi 1/25/2017 9:23 1/25/2017 9:23
xn.ogs.mobi 1/25/2017 9:23 1/25/2017 9:23
sq.ogs.mobi 1/25/2017 9:22 1/25/2017 9:22
go.ogs.mobi 1/25/2017 9:20 1/25/2017 9:21
sh.ogs.mobi 1/25/2017 9:20 1/25/2017 9:20
ju.ogs.mobi 1/25/2017 9:13 1/25/2017 9:20
nxc.ogs.mobi 1/25/2017 9:13 1/25/2017 9:13
bp.ogs.mobi 1/25/2017 9:05 1/25/2017 9:12
ql.ogs.mobi 1/25/2017 9:11 1/25/2017 9:11
lh.ogs.mobi 1/25/2017 9:09 1/25/2017 9:11
mlr.ogs.mobi 1/25/2017 9:11 1/25/2017 9:11
hg.ogs.mobi 1/25/2017 8:59 1/25/2017 9:02
phc.ogs.mobi 1/25/2017 9:01 1/25/2017 9:01
zn.ogs.mobi 1/25/2017 9:00 1/25/2017 9:00
gh.ogs.mobi 1/25/2017 8:55 1/25/2017 9:00
cd.ogs.mobi 1/25/2017 8:56 1/25/2017 8:58
yj.ogt.mobi 1/25/2017 8:53 1/25/2017 8:53
lqn.ogt.mobi 1/25/2017 8:53 1/25/2017 8:53
ol.ogt.mobi 1/25/2017 8:52 1/25/2017 8:52
uz.ogt.mobi 1/25/2017 8:52 1/25/2017 8:52
tec.ogt.mobi 1/25/2017 8:51 1/25/2017 8:51
jv.ogt.mobi 1/25/2017 8:48 1/25/2017 8:50
hwz.ogt.mobi 1/25/2017 8:49 1/25/2017 8:49
jme.ogt.mobi 1/25/2017 8:48 1/25/2017 8:48
cnx.ogq.mobi 1/25/2017 8:41 1/25/2017 8:45
qb.ogq.mobi 1/25/2017 8:44 1/25/2017 8:44
ye.ogq.mobi 1/25/2017 8:42 1/25/2017 8:42
nh.ogq.mobi 1/25/2017 8:40 1/25/2017 8:40
gym.ogq.mobi 1/25/2017 8:38 1/25/2017 8:38
egr.ogq.mobi 1/25/2017 8:36 1/25/2017 8:38
eh.ogy.mobi 1/25/2017 8:29 1/25/2017 8:34
qzy.ogy.mobi 1/25/2017 8:33 1/25/2017 8:33
zr.ogy.mobi 1/25/2017 8:33 1/25/2017 8:33
tol.ogy.mobi 1/25/2017 8:32 1/25/2017 8:32
ka.ogy.mobi 1/25/2017 8:32 1/25/2017 8:32
hc.ogy.mobi 1/25/2017 8:30 1/25/2017 8:30
fv.ogy.mobi 1/25/2017 8:26 1/25/2017 8:26
lrc.ohl.mobi 1/25/2017 8:24 1/25/2017 8:24
pvd.ohl.mobi 1/25/2017 8:24 1/25/2017 8:24
cp.ohl.mobi 1/25/2017 8:14 1/25/2017 8:23
rd.ohl.mobi 1/25/2017 8:21 1/25/2017 8:21
ld.ogy.mobi 1/25/2017 8:03 1/25/2017 8:12
rth.ogy.mobi 1/25/2017 8:12 1/25/2017 8:12
xgb.ogy.mobi 1/25/2017 8:11 1/25/2017 8:11
vua.ogy.mobi 1/25/2017 8:10 1/25/2017 8:10
gq.ogy.mobi 1/25/2017 8:05 1/25/2017 8:05
mk.ogy.mobi 1/25/2017 8:04 1/25/2017 8:04
kea.ogt.mobi 1/25/2017 7:55 1/25/2017 8:01
kg.ogt.mobi 1/25/2017 7:54 1/25/2017 8:01
tbp.ogt.mobi 1/25/2017 8:00 1/25/2017 8:00
hb.ogt.mobi 1/25/2017 7:54 1/25/2017 8:00
sf.ogt.mobi 1/25/2017 8:00 1/25/2017 8:00
xwn.ohj.mobi 1/25/2017 7:53 1/25/2017 7:54
kpv.ohj.mobi 1/25/2017 7:52 1/25/2017 7:54
vc.ohj.mobi 1/25/2017 7:53 1/25/2017 7:53
hf.ohj.mobi 1/25/2017 7:52 1/25/2017 7:52
pd.ohj.mobi 1/25/2017 7:52 1/25/2017 7:52
fg.ohj.mobi 1/25/2017 7:52 1/25/2017 7:52
van.ohj.mobi 1/25/2017 7:51 1/25/2017 7:51
ox.ohj.mobi 1/25/2017 7:51 1/25/2017 7:51
spx.ohj.mobi 1/25/2017 7:50 1/25/2017 7:50
hlp.ohc.mobi 1/25/2017 7:44 1/25/2017 7:44
vlw.ohc.mobi 1/25/2017 7:42 1/25/2017 7:42
arw.ohc.mobi 1/25/2017 7:41 1/25/2017 7:41
erv.ohc.mobi 1/25/2017 7:41 1/25/2017 7:41
ejd.ohc.mobi 1/25/2017 7:40 1/25/2017 7:40
zam.ogt.mobi 1/25/2017 7:33 1/25/2017 7:33
xcw.ogt.mobi 1/25/2017 7:32 1/25/2017 7:32
hg.ogt.mobi 1/25/2017 7:32 1/25/2017 7:32
uox.ogt.mobi 1/25/2017 7:30 1/25/2017 7:30
co.ogt.mobi 1/25/2017 7:30 1/25/2017 7:30
ko.ogt.mobi 1/25/2017 7:30 1/25/2017 7:30
xvs.ohl.mobi 1/25/2017 7:25 1/25/2017 7:25
bl.ohl.mobi 1/25/2017 7:24 1/25/2017 7:24
eso.ohl.mobi 1/25/2017 7:24 1/25/2017 7:24
io.ohl.mobi 1/25/2017 7:23 1/25/2017 7:23
rxf.ohl.mobi 1/25/2017 7:22 1/25/2017 7:22
fl.ohl.mobi 1/25/2017 7:21 1/25/2017 7:21
fg.ohl.mobi 1/25/2017 7:20 1/25/2017 7:20
ks.ohl.mobi 1/25/2017 7:20 1/25/2017 7:20
si.ohl.mobi 1/25/2017 7:15 1/25/2017 7:15
bcv.ohl.mobi 1/25/2017 7:14 1/25/2017 7:14
igl.ohl.mobi 1/25/2017 7:13 1/25/2017 7:13
wrz.ohl.mobi 1/25/2017 7:12 1/25/2017 7:12
qhz.ohl.mobi 1/25/2017 7:11 1/25/2017 7:11
dgh.ohl.mobi 1/25/2017 7:10 1/25/2017 7:10
hj.ogt.mobi 1/25/2017 7:03 1/25/2017 7:03
nlw.ogt.mobi 1/25/2017 7:03 1/25/2017 7:03
grw.ogt.mobi 1/25/2017 7:01 1/25/2017 7:01
wy.ohd.mobi 1/25/2017 6:55 1/25/2017 6:55
pna.ohd.mobi 1/25/2017 6:54 1/25/2017 6:54
hao.ohd.mobi 1/25/2017 6:49 1/25/2017 6:49
vdr.ohj.mobi 1/25/2017 6:42 1/25/2017 6:42
uoj.ohj.mobi 1/25/2017 6:40 1/25/2017 6:40
li.ohj.mobi 1/25/2017 6:40 1/25/2017 6:40
sm.ohd.mobi 1/25/2017 6:35 1/25/2017 6:35
med.ogt.mobi 1/25/2017 5:17 1/25/2017 6:34
lkt.ohd.mobi 1/25/2017 6:32 1/25/2017 6:32
ed.ohd.mobi 1/25/2017 6:32 1/25/2017 6:32
wd.ohd.mobi 1/25/2017 6:31 1/25/2017 6:31
ojm.ohd.mobi 1/25/2017 6:31 1/25/2017 6:31
oe.ogt.mobi 1/25/2017 5:22 1/25/2017 6:27
dxu.ogx.mobi 1/25/2017 6:25 1/25/2017 6:25
pq.ogx.mobi 1/25/2017 6:24 1/25/2017 6:24
ka.ogx.mobi 1/25/2017 6:24 1/25/2017 6:24
vym.ogx.mobi 1/25/2017 6:22 1/25/2017 6:22
nk.ogx.mobi 1/25/2017 6:22 1/25/2017 6:22
wiy.ogx.mobi 1/25/2017 6:21 1/25/2017 6:21
vwj.ogx.mobi 1/25/2017 6:20 1/25/2017 6:20
rz.ohd.mobi 1/25/2017 6:15 1/25/2017 6:15
px.ohd.mobi 1/25/2017 6:14 1/25/2017 6:14
tih.ohd.mobi 1/25/2017 6:13 1/25/2017 6:13
pvd.ohd.mobi 1/25/2017 6:11 1/25/2017 6:11
hk.ohd.mobi 1/25/2017 6:06 1/25/2017 6:10
nsm.ohd.mobi 1/25/2017 6:05 1/25/2017 6:10
abq.ohd.mobi 1/25/2017 6:04 1/25/2017 6:04
uxy.ogl.mobi 1/25/2017 6:03 1/25/2017 6:03
yzl.ogl.mobi 1/25/2017 6:01 1/25/2017 6:01
zix.ogl.mobi 1/25/2017 6:00 1/25/2017 6:00
ahx.ogl.mobi 1/25/2017 6:00 1/25/2017 6:00
uty.ohc.mobi 1/25/2017 5:55 1/25/2017 5:55
ex.ohc.mobi 1/25/2017 5:54 1/25/2017 5:54
qt.ohc.mobi 1/25/2017 5:51 1/25/2017 5:51
se.ohc.mobi 1/25/2017 5:50 1/25/2017 5:50
aw.ohc.mobi 1/25/2017 5:50 1/25/2017 5:50
oy.ogt.mobi 1/25/2017 5:43 1/25/2017 5:43
up.ogt.mobi 1/25/2017 5:42 1/25/2017 5:42
du.ogt.mobi 1/25/2017 5:42 1/25/2017 5:42
qnm.ogt.mobi 1/25/2017 5:40 1/25/2017 5:40
rcs.ohl.mobi 1/25/2017 5:35 1/25/2017 5:35
uz.ohl.mobi 1/25/2017 5:33 1/25/2017 5:33
tf.ohl.mobi 1/25/2017 5:32 1/25/2017 5:32
ya.ohl.mobi 1/25/2017 5:30 1/25/2017 5:30
vhp.ogt.mobi 1/25/2017 5:22 1/25/2017 5:22
rvh.ogt.mobi 1/25/2017 5:21 1/25/2017 5:21
ofu.ogt.mobi 1/25/2017 5:21 1/25/2017 5:21
hrk.ogt.mobi 1/25/2017 5:18 1/25/2017 5:21
goz.ogt.mobi 1/25/2017 5:20 1/25/2017 5:20
pim.ogt.mobi 1/25/2017 5:14 1/25/2017 5:14
mz.ogt.mobi 1/25/2017 5:13 1/25/2017 5:13
gy.ogt.mobi 1/25/2017 5:11 1/25/2017 5:11
hdc.ogt.mobi 1/25/2017 5:10 1/25/2017 5:10
swo.ogt.mobi 1/25/2017 5:10 1/25/2017 5:10
df.ogt.mobi 1/25/2017 5:10 1/25/2017 5:10

If you want to download this list you can find it below:

Microsoft-corporation-40-69-68-179.xlsx

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: