GoBrut: A new GoLang Botnet

Introduction Malware written in Go programming language has roots almost a decade ago, few years after first release of the Golang back in 2009, starting, for instance, from old trojan/infostealer samples discovered back since 2012 and abused within cyber-criminal campaigns, to components of one of the most advanced and modern cyber arsenal, the Sofacy one. Times ago it was considered an exotic way to code a malware, nowadays it became something more common each CSIRT has tackled, at least once in its lifetime. In the last month, a particular sample circulated within InfoSec in the community. It is written in Go Language, harder to analyse due to its compilation artifacts and uncommon binary patterns, for this reason Cybaze-Yoroi ZLab decided to deepen the threat and investigate about it.

Technical Analysis GoLang programs compilation generates binaries embedding all the required dependencies, it is one of the principal advantages of this programming language because it avoids the need of installed runtimes within the machine, like the Java Runtime or specific .NET version, simplifying the multiplatform support of the Go applications. One of the main characteristic of the Go compiled binaries is the inclusion of the “Go build ID” field into the PE header.

Hash 94e119d88ff59d33d3c6fe6c346eba274d5fcc971771ec94b86657a0c2217a2d

Threat GoBrut

SSDeep 49152:6+UqQHrw3ygz94d8zgJqatzrYY2o6Kd3xlIUyCo061UlMX:qrwnz6e8l9rUo6KdiJX

The analyzed samples contains this particular field confirming the malware has been written in Go language, despite the lack of signature match running PE identification tools.

Figure 1: Go Build ID signature

Navigating the assembly we were able to isolate some interesting chunks of code revealing malicious capabilities of the sample. We detected an inner routine to set up the Autorun at the machine reboot, granting its persistence on the machine after the reboot by running the following batch utility script to install a copy the malware into the user startup folder (AutorunDropper function).

@echo off if not exist "C:/Users/admin/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup\svchostphb.exe" copy /Y "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchostphb.exe" "C:/Users/admin/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup/svchostphb.exe"

Also, an interesting reference have been found within the RDATA section of this windows executable: a reference to a so called “TryLogin” and “StartBrut” routine, suggesting some kind of offensive capabilities, subsequently described in “The BruteForce Module” section.

Figure 2: References to source code functions in RDATA section

Another interesting finding during the static analysis of the sample is a specific url value, hardcoded into the binary itself. The remote destination points an netherland Provider, ISPIRIA Networks Ltd, hosting the command and control server of the botnet.

Figure 3: Command and Control communication routine

Dynamically running the malware, it starts a series of http requests aimed to register the bot to the discovered server. The GET request parameters contains the “phpadmin” value in a quite interesting “worker” named field, clear reference of the notorious “PhpMyAdmin” database administration tool, widely deployed across the internet and too many times unnecessarily exposed to the internet.

Figure 4: Bot’s registration on the C2

After the check-in, the bot queries a JSON object resembling a sort of bag of tasks, where the C2 instructs it to try a huge amount of logins on the indicated web pages.

Figure 5: Response of C2 with the JSON file containing the targets

The BruteForce Module The core of the bot is the bruteforce module, which has the task to try the login by using the credentials retrieved by the C2, as described in the previous section.

Figure 6: BruteForce module function flow

The routine named “StartBrut” has the purpose to prepare the credentials retrieved from the C2, then subroutine “TryLogin” connects to the target host and tries to authenticate using provided credentials and waits for the server response. During these days the botnet was running a campaign leveraging its “phpadmin” module, resulting in attacks to thousand of PhpMyAdmin installation all over the internet.

Figure 7: Login attempts of the “phpadmin” module

At this point, we decided to collect the list of targets under the botnet attack and, at time of writing, we identified 40000 unique destinations potentially under attack. The distribution of the Top Level Domains shows half of the targets are the “.com” and “.org” ones, surprisingly followed the by Russian TLD, and other Eastern Europe targets. Central and Southern Europe seems are targeted too but with in a lower portion, currently.

Figure 8 : Distribution of TLD

The “.it” domains in the botnet target list are about 400, including professional forum such as “avvocati.it”, e-commerce portals, company websites and also banks such as “bancamacerata[.]it”. A wide spectrum of organization, the full list is available in the section “Italian Targets”.

Investigating the Botnet Digging further into the investigations, we found out this new GoLang bot supports a lot more features, not only for “PhpMyAdmin” one. In fact, we discovered the bot supports 23 functionalities able to target a range of technologies from administrative protocols to CMSes, for instance it is capable to attack SSH logins, FTP sites, exposed MySql service and the two most used CMSes, Wordpress and Joomla. Here the list of discovered functionalities:

● bitrixBrt ● bitrixChk ● cp_b ● cp_chk ● drupalBrt ● drupalChk ● ftp_b ● ftpChk ● joomlaBrt ● joomlaChk ● magentoBrt ● magentoChk ● mysql_b ● OCartBrt ● OCartChk ● php_b ● php_chk ● postgres_b ● ssh_b ● whm_b ● whm_chk ● wpBrt ● wpChk&v

The attack campaigns are pretty dynamic and may change quickly over the time, further analysis pointet to a specific command and control API where the botnet master enables or disables running offensive operation through the “/project/active” server location. Thus, the bots is instructed of which are the current active campaigns and technologies to be targeted. In the end, a recent article by Jérôme Segura reports a piece of the puzzle to complete the plot of this new “GoBot” threat, describing how the bot has been linked to a JavaScript skimmer installation campaign afflicted several web portals in the wild. The piece of

javascript code embedded after the abusive access was able to steal sensitive information such as credentials and credit card numbers, to every user visiting the compromised site. This attack techniques is extremely dangerous and lead to massive data leak for organizations, as observed back in 2018, when the MageCart group hacked the British Airways infrastructure to install javascript skimmers. Cybaze-Yoroi Zlab performed a preliminary check on the targeted italian web sites and, at the moment, no system results to be infected with the skimmer discovered by MB.

Conclusion The usage of Go is surely unusual among the malware writers, but it can become an advantage for the attackers because, like most applications written in Go, the malware’s code is bulky and the malware’s compiled binaries are usually bigger than regular executables, where dependencies are loaded externally. This new “GoBrut” botnet provides also a precious insight of the kind of threat insecure logins and unnecessary exposure are subject to. Showing how cyber-crime actors are able to run wide international criminal operations aimed to opportunistically penetrate organizations, to abuse its infrastructure and steal users logins and sensitive data.

Indicator Of Compromise ● C2:

○ http[://5.45.69[.149[:7000 ● Hash:

○ 94e119d88ff59d33d3c6fe6c346eba274d5fcc971771ec94b86657a0c2217a2d

Yara Rules rule gobrut_bott { meta: description = "Yara rule for GoBrut Bot in Go Language" author = "Yoroi - ZLab" last_updated = "2019-02-25" tlp = "white" category = "informational" strings: // Go build $go = { 47 6f 20 62 75 69 6c 64 20 49 44 3a 20 } $b1 = { BA D7 F7 AD 02 04 04 91 } $b2 = { 5E 9B 5C 00 60 97 5F }

condition: uint16(0) == 0x5a4d and all of them }

Italian Targets List of the Italian targets of the botnets observed on “27/02/2019”:

http://17kgroup[.]it/phpmyadmin/ http://abitazioniecologiche[.]it/phpmyadmin/ http://advancedmedialab[.]it/phpmyadmin/ http://agendaonline[.]it/phpmyadmin/ http://akrapovic[.]it/phpmyadmin/ http://albagel[.]it/phpmyadmin/ http://ambientebio[.]it/phpmyadmin/ http://amoreanimale[.]it/phpmyadmin/ http://anbima[.]it/phpmyadmin/ http://antoniano[.]it/phpmyadmin/ http://archcongress[.]it/phpmyadmin/ http://ascit[.]it/phpmyadmin/ http://asgi[.]it/phpmyadmin/ http://assiteca[.]it/phpmyadmin/ http://audioquality[.]it/phpmyadmin/ http://bancamacerata[.]it/phpmyadmin/ http://bellaradio[.]it/phpmyadmin/ http://beppo[.]it/phpmyadmin/ http://bestandcheap[.]it/phpmyadmin/ http://bigmama[.]it/phpmyadmin/ http://bigmat[.]it/phpmyadmin/ http://bonificafriulana[.]it/phpmyadmin/ http://bufalocoltelli[.]it/phpmyadmin/ http://cairoma[.]it/phpmyadmin/ http://calciostyle[.]it/phpmyadmin/ http://canoniani[.]it/phpmyadmin/ http://canzoneitaliana[.]it/phpmyadmin/ http://carnevale.venezia[.]it/phpmyadmin/ http://cartierasanmartino[.]it/phpmyadmin/ http://castellodivezio[.]it/phpmyadmin/ http://cepiengineering[.]it/phpmyadmin/ http://ceramicacielo[.]it/phpmyadmin/ http://cesariverona[.]it/phpmyadmin/ http://chebagno[.]it/phpmyadmin/ http://chicstudio[.]it/phpmyadmin/ http://cialdemania[.]it/phpmyadmin/ http://cifo[.]it/phpmyadmin/ http://cimomedici[.]it/phpmyadmin/ http://cinemapaolillo[.]it/phpmyadmin/ http://cinquantamila[.]it/phpmyadmin/ http://classiccargambino[.]it/phpmyadmin/ http://claudiobiasia[.]it/phpmyadmin/ http://clicktoclick[.]it/phpmyadmin/ http://cloud.cittametropolitanaroma.gov[.]it/phpmyadmin/ http://cloud.istruzioneer[.]it/phpmyadmin/ http://cloud.protec[.]it/phpmyadmin/ http://cloud.shop.corsi-formazione-professionale[.]it/phpmyadmin/ http://cloud.sine[.]it/phpmyadmin/ http://cni-working[.]it/phpmyadmin/ http://coiba[.]it/phpmyadmin/ http://comitatogenitoricapriolo[.]it/phpmyadmin/ http://comprooro-usato[.]it/phpmyadmin/

http://contagiorni[.]it/phpmyadmin/ http://copriscopri[.]it/phpmyadmin/ http://corriereincontri[.]it/phpmyadmin/ http://corsidanzaperbambini[.]it/phpmyadmin/ http://cortelezzi[.]it/phpmyadmin/ http://cosepermaschi[.]it/phpmyadmin/ http://covermark[.]it/phpmyadmin/ http://cpia11latina.gov[.]it/phpmyadmin/ http://creative-cables[.]it/phpmyadmin/ http://criverbania[.]it/phpmyadmin/ http://csvnapoli[.]it/phpmyadmin/ http://cybertek[.]it/phpmyadmin/ http://dalbello[.]it/phpmyadmin/ http://dammidesign[.]it/phpmyadmin/ http://datasport[.]it/phpmyadmin/ http://dirittopratico[.]it/phpmyadmin/ http://disys[.]it/phpmyadmin/ http://diventarebarman[.]it/phpmyadmin/ http://dottorbike[.]it/phpmyadmin/ http://dqm[.]it/phpmyadmin/ http://dreamsiteradioplayer[.]it/phpmyadmin/ http://drupal-expert[.]it/phpmyadmin/ http://ecoambienterovigo[.]it/phpmyadmin/ http://ediscom[.]it/phpmyadmin/ http://egcommunity[.]it/phpmyadmin/ http://egyp[.]it/phpmyadmin/ http://elvislives[.]it/phpmyadmin/ http://enegan[.]it/phpmyadmin/ http://entermed[.]it/phpmyadmin/ http://e-pharmaville[.]it/phpmyadmin/ http://epict[.]it/phpmyadmin/ http://episcopia-italiei[.]it/phpmyadmin/ http://equasoft[.]it/phpmyadmin/ http://e-recensioni[.]it/phpmyadmin/ http://errepistrumenti[.]it/phpmyadmin/ http://ersucatania[.]it/phpmyadmin/ http://ersumessina[.]it/phpmyadmin/ http://esafad[.]it/phpmyadmin/ http://esigarettaportal[.]it/phpmyadmin/ http://etabetawheels[.]it/phpmyadmin/ http://eurekadance[.]it/phpmyadmin/ http://eurekakids[.]it/phpmyadmin/ http://eurocampingpacengo[.]it/phpmyadmin/ http://europacalcio[.]it/phpmyadmin/ http://euroswitch[.]it/phpmyadmin/ http://eurotrol[.]it/phpmyadmin/ http://expertbath[.]it/phpmyadmin/ http://falegnameria900[.]it/phpmyadmin/ http://fantinicosmi[.]it/phpmyadmin/ http://federfarma.brescia[.]it/phpmyadmin/ http://femaleworld[.]it/phpmyadmin/ http://ferramentacostamagna[.]it/phpmyadmin/ http://fiab-onlus[.]it/phpmyadmin/ http://filovent[.]it/phpmyadmin/ http://fioriabergamo[.]it/phpmyadmin/ http://foglioserramenti[.]it/phpmyadmin/ http://fondazionefenice[.]it/phpmyadmin/ http://fondazionegolinelli[.]it/phpmyadmin/ http://fontanadeisogni[.]it/phpmyadmin/ http://fratellimazzoleni[.]it/phpmyadmin/ http://fruitviaggi[.]it/phpmyadmin/ http://fruscio[.]it/phpmyadmin/ http://gabrielerizzi[.]it/phpmyadmin/ http://gardaincisioni[.]it/phpmyadmin/ http://gespan[.]it/phpmyadmin/

http://gioianet[.]it/phpmyadmin/ http://giornalelavoce[.]it/phpmyadmin/ http://giovannipaoloprimo[.]it/phpmyadmin/ http://goldenprice[.]it/phpmyadmin/ http://graphimedia[.]it/phpmyadmin/ http://gruppoverrua[.]it/phpmyadmin/ http://gta-expert[.]it/phpmyadmin/ http://gustiamodena[.]it/phpmyadmin/ http://herningsholm[.]it/phpmyadmin/ http://herno[.]it/phpmyadmin/ http://horecaatelier[.]it/phpmyadmin/ http://hotelsandomenico[.]it/phpmyadmin/ http://hotelzodiacoski[.]it/phpmyadmin/ http://humanitas[.]it/phpmyadmin/ http://icmichelonilammari.gov[.]it/phpmyadmin/ http://ilblogdellestelle[.]it/phpmyadmin/ http://ilmartino[.]it/phpmyadmin/ http://ilnord[.]it/phpmyadmin/ http://indors[.]it/phpmyadmin/ http://informagiovanibiella[.]it/phpmyadmin/ http://insindacabili[.]it/phpmyadmin/ http://i-pressnews[.]it/phpmyadmin/ http://irobotaspirapolvere[.]it/phpmyadmin/ http://irpiniaoggi[.]it/phpmyadmin/ http://issgroup[.]it/phpmyadmin/ http://istitutoavio[.]it/phpmyadmin/ http://italianexclusivevillas[.]it/phpmyadmin/ http://italiappalti[.]it/phpmyadmin/ http://italvideo[.]it/phpmyadmin/ http://its-aerospaziopiemonte[.]it/phpmyadmin/ http://jpgtopdf[.]it/phpmyadmin/ http://key4biz[.]it/phpmyadmin/ http://klover[.]it/phpmyadmin/ http://lamiapartitaiva[.]it/phpmyadmin/ http://lanemondial[.]it/phpmyadmin/ http://larassegna[.]it/phpmyadmin/ http://laselvottadiariccia[.]it/phpmyadmin/ http://laziochannel[.]it/phpmyadmin/ http://legab[.]it/phpmyadmin/ http://letteraturaitalia[.]it/phpmyadmin/ http://libreriatuttoscuola[.]it/phpmyadmin/ http://libroaid[.]it/phpmyadmin/ http://liceomazzatinti.gov[.]it/phpmyadmin/ http://ligurianotizie[.]it/phpmyadmin/ http://locandaitalia[.]it/phpmyadmin/ http://lovelyitalia[.]it/phpmyadmin/ http://lucianopignataro[.]it/phpmyadmin/ http://lucon[.]it/phpmyadmin/ http://luinonotizie[.]it/phpmyadmin/ http://lumberjack[.]it/phpmyadmin/ http://lundici[.]it/phpmyadmin/ http://macinator[.]it/phpmyadmin/ http://maestraemamma[.]it/phpmyadmin/ http://mammemagazine[.]it/phpmyadmin/ http://manageyourlife[.]it/phpmyadmin/ http://marioriccardi[.]it/phpmyadmin/ http://marketinsight[.]it/phpmyadmin/ http://marsicalive[.]it/phpmyadmin/ http://mattiamiraglio[.]it/phpmyadmin/ http://mcz[.]it/phpmyadmin/ http://mdwebstore[.]it/phpmyadmin/ http://mect[.]it/phpmyadmin/ http://mediacritica[.]it/phpmyadmin/ http://meminformatica[.]it/phpmyadmin/ http://messaggeromarittimo[.]it/phpmyadmin/

http://midifendo[.]it/phpmyadmin/ http://milanocard[.]it/phpmyadmin/ http://mio-ip[.]it/phpmyadmin/ http://mirabilandia[.]it/phpmyadmin/ http://mobimesh[.]it/phpmyadmin/ http://mondoduster[.]it/phpmyadmin/ http://morelato[.]it/phpmyadmin/ http://motorimagazine[.]it/phpmyadmin/ http://multipress[.]it/phpmyadmin/ http://myqualitystore[.]it/phpmyadmin/ http://mysql.ais-sociologia[.]it/phpmyadmin/ http://mysql.arcipiemonte[.]it/phpmyadmin/ http://mysql.associazionilacorte[.]it/phpmyadmin/ http://mysql.gruppoterra[.]it/phpmyadmin/ http://mysql.icasting[.]it/phpmyadmin/ http://mysql.importforme[.]it/phpmyadmin/ http://mysql.magius[.]it/phpmyadmin/ http://mysql.museodellegrigne[.]it/phpmyadmin/ http://mysql.pensareweb[.]it/phpmyadmin/ http://mysql.tomasomontanari[.]it/phpmyadmin/ http://mysql-1.shop.annuncilapiazza[.]it/phpmyadmin/ http://naturalleva[.]it/phpmyadmin/ http://nbts[.]it/phpmyadmin/ http://nexusedizioni[.]it/phpmyadmin/ http://nostalgia[.]it/phpmyadmin/ http://notizie[.]it/phpmyadmin/ http://nottisacrebari[.]it/phpmyadmin/ http://ns1.guidasicilia[.]it/phpmyadmin/ http://ns1[.]italianivolanti[.]it/phpmyadmin/ http://ns2.andrealeti[.]it/phpmyadmin/ http://ns2.icpiossasco1.gov[.]it/phpmyadmin/ http://ns2.lampy[.]it/phpmyadmin/ http://ns2.romeing[.]it/phpmyadmin/ http://ns3.jocando[.]it/phpmyadmin/ http://ns3.thirdeye[.]it/phpmyadmin/ http://nuovocentromobilitorre[.]it/phpmyadmin/ http://occhiodinapoli[.]it/phpmyadmin/ http://ofba[.]it/phpmyadmin/ http://offcapelletti[.]it/phpmyadmin/ http://omeganews[.]it/phpmyadmin/ http://omnitekstore[.]it/phpmyadmin/ http://onicedesign[.]it/phpmyadmin/ http://onlinemagazine[.]it/phpmyadmin/ http://operadifirenze[.]it/phpmyadmin/ http://orchideabomboniere[.]it/phpmyadmin/ http://panel.asedis[.]it/phpmyadmin/ http://panel.shooos[.]it/phpmyadmin/ http://paramentisacri-caliciargento[.]it/phpmyadmin/ http://parrocchialagaccio[.]it/phpmyadmin/ http://pdfjpg[.]it/phpmyadmin/ http://pellegrini.bz[.]it/phpmyadmin/ http://penalecontemporaneo[.]it/phpmyadmin/ http://pennabluedizioni[.]it/phpmyadmin/ http://peopledesign[.]it/phpmyadmin/ http://peticare[.]it/phpmyadmin/ http://peugeot5008[.]it/phpmyadmin/ http://pfbroni93[.]it/phpmyadmin/ http://phpmyadmin.almagaming[.]it/phpmyadmin/ http://phpmyadmin.aqua[.]it/phpmyadmin/ http://phpmyadmin.avvocatogratis[.]it/phpmyadmin/ http://phpmyadmin.cantinamariocosta[.]it/phpmyadmin/ http://phpmyadmin.castellosansebastiano[.]it/phpmyadmin/ http://phpmyadmin.crabion[.]it/phpmyadmin/ http://phpmyadmin.csibologna[.]it/phpmyadmin/ http://phpmyadmin.digimax[.]it/phpmyadmin/

http://phpmyadmin.dottorsartori[.]it/phpmyadmin/ http://phpmyadmin.entreamis[.]it/phpmyadmin/ http://phpmyadmin.fisar-livorno[.]it/phpmyadmin/ http://phpmyadmin.gruppoeventi[.]it/phpmyadmin/ http://phpmyadmin.ic-torpe.gov[.]it/phpmyadmin/ http://phpmyadmin.ilcalcionapoli[.]it/phpmyadmin/ http://phpmyadmin.installo[.]it/phpmyadmin/ http://phpmyadmin.istitutocomprensivolesmo.gov[.]it/phpmyadmin/ http://phpmyadmin[.]italiatopgames[.]it/phpmyadmin/ http://phpmyadmin.livemeteo[.]it/phpmyadmin/ http://phpmyadmin.marmipasqualotto[.]it/phpmyadmin/ http://phpmyadmin.mondoirrigazione[.]it/phpmyadmin/ http://phpmyadmin.mylifemarco[.]it/phpmyadmin/ http://phpmyadmin.naturopatiaonlineunipsi[.]it/phpmyadmin/ http://phpmyadmin.nosytour[.]it/phpmyadmin/ http://phpmyadmin.notedipastoralegiovanile[.]it/phpmyadmin/ http://phpmyadmin.patatu[.]it/phpmyadmin/ http://phpmyadmin.prontostufe[.]it/phpmyadmin/ http://phpmyadmin.quelchenonsapevi[.]it/phpmyadmin/ http://phpmyadmin.shop.cilug[.]it/phpmyadmin/ http://phpmyadmin.shop.comolakeboats[.]it/phpmyadmin/ http://phpmyadmin.shop.freedomina[.]it/phpmyadmin/ http://phpmyadmin.shop.navdanyainternational[.]it/phpmyadmin/ http://phpmyadmin.shop.swissflex[.]it/phpmyadmin/ http://phpmyadmin.shop.thebikestore[.]it/phpmyadmin/ http://phpmyadmin.shop.trionfihonorati[.]it/phpmyadmin/ http://phpmyadmin.stelmi[.]it/phpmyadmin/ http://phpmyadmin.stilemilan[.]it/phpmyadmin/ http://phpmyadmin.studionapoleoni[.]it/phpmyadmin/ http://phpmyadmin.torinofree[.]it/phpmyadmin/ http://phpmyadmin.xn--cristianit-q4a[.]it/phpmyadmin/ http://pianetasalutebari[.]it/phpmyadmin/ http://planetel[.]it/phpmyadmin/ http://pompecasali[.]it/phpmyadmin/ http://portalebigone[.]it/phpmyadmin/ http://pradelletorri[.]it/phpmyadmin/ http://premiumpartner[.]it/phpmyadmin/ http://prosveta[.]it/phpmyadmin/ http://pruamarina[.]it/phpmyadmin/ http://puntosnaisalento[.]it/phpmyadmin/ http://quattrocalici[.]it/phpmyadmin/ http://quimammeshop[.]it/phpmyadmin/ http://quotidianodelcondominio[.]it/phpmyadmin/ http://radionbc[.]it/phpmyadmin/ http://recsando[.]it/phpmyadmin/ http://redazionevirtuale[.]it/phpmyadmin/ http://regalisfiziosi[.]it/phpmyadmin/ http://remocontro[.]it/phpmyadmin/ http://residenceilgabbiano[.]it/phpmyadmin/ http://rhibo[.]it/phpmyadmin/ http://rivistagirotondo[.]it/phpmyadmin/ http://robadadonne[.]it/phpmyadmin/ http://roda[.]it/phpmyadmin/ http://romamobilita[.]it/phpmyadmin/ http://romanamunizioni[.]it/phpmyadmin/ http://sardegnaeventi24[.]it/phpmyadmin/ http://sciax2[.]it/phpmyadmin/ http://scopata[.]it/phpmyadmin/ http://scottieco[.]it/phpmyadmin/ http://scuolafenaroli[.]it/phpmyadmin/ http://segretidelbenessere[.]it/phpmyadmin/ http://seniorlife[.]it/phpmyadmin/ http://server.avvocati[.]it/phpmyadmin/ http://shop.adivor[.]it/phpmyadmin/ http://shop.anspc[.]it/phpmyadmin/

http://shop.casetto[.]it/phpmyadmin/ http://shop.coalvi[.]it/phpmyadmin/ http://shop.coolarts[.]it/phpmyadmin/ http://shop.corsilinguacinese[.]it/phpmyadmin/ http://shop.daviol[.]it/phpmyadmin/ http://shop.dog-beach[.]it/phpmyadmin/ http://shop.energyexpert[.]it/phpmyadmin/ http://shop.e-r-a[.]it/phpmyadmin/ http://shop.go-paint[.]it/phpmyadmin/ http://shop.groeden[.]it/phpmyadmin/ http://shop.hoteltofana[.]it/phpmyadmin/ http://shop.ledame[.]it/phpmyadmin/ http://shop.mitika[.]it/phpmyadmin/ http://shop.nicosrl[.]it/phpmyadmin/ http://shop.ospedalizzazione[.]it/phpmyadmin/ http://shop.paolofrediani[.]it/phpmyadmin/ http://shop.radogna[.]it/phpmyadmin/ http://shop.remdevice[.]it/phpmyadmin/ http://shop.shop.creasol[.]it/phpmyadmin/ http://shop.sljco[.]it/phpmyadmin/ http://shop.sunmoon[.]it/phpmyadmin/ http://shop.sysconn[.]it/phpmyadmin/ http://shop.trattoriazaza[.]it/phpmyadmin/ http://shop.villadimaser[.]it/phpmyadmin/ http://siitscpa[.]it/phpmyadmin/ http://sikkensdecor[.]it/phpmyadmin/ http://smartsistemi[.]it/phpmyadmin/ http://sos-office[.]it/phpmyadmin/ http://sprayleggero[.]it/phpmyadmin/ http://sql.carponline[.]it/phpmyadmin/ http://sql.cliens[.]it/phpmyadmin/ http://sql.ibarbari[.]it/phpmyadmin/ http://sql.royalqueenseeds[.]it/phpmyadmin/ http://sql1[.]itctspugliatti[.]it/phpmyadmin/ http://sql3.qapla[.]it/phpmyadmin/ http://sssrome[.]it/phpmyadmin/ http://stellafilm[.]it/phpmyadmin/ http://stilluce-store[.]it/phpmyadmin/ http://targetsas[.]it/phpmyadmin/ http://teatridipistoia[.]it/phpmyadmin/ http://tecniwell[.]it/phpmyadmin/ http://tecnocartuccia[.]it/phpmyadmin/ http://tecnotradeshop[.]it/phpmyadmin/ http://tempi[.]it/phpmyadmin/ http://teranet[.]it/phpmyadmin/ http://terzocircoloangri.gov[.]it/phpmyadmin/ http://tiraccontounafiaba[.]it/phpmyadmin/ http://topipittori[.]it/phpmyadmin/ http://toscanalibri[.]it/phpmyadmin/ http://trattoriagilberto[.]it/phpmyadmin/ http://trevisini[.]it/phpmyadmin/ http://trexonshop[.]it/phpmyadmin/ http://ttreinformatica[.]it/phpmyadmin/ http://tuttafica[.]it/phpmyadmin/ http://tuttocalcionews[.]it/phpmyadmin/ http://tuttoindirizzi[.]it/phpmyadmin/ http://tuttoingegnere[.]it/phpmyadmin/ http://tuttomed[.]it/phpmyadmin/ http://txtspa[.]it/phpmyadmin/ http://ugi-torino[.]it/phpmyadmin/ http://uniclub[.]it/phpmyadmin/ http://urbanpromo[.]it/phpmyadmin/ http://usl7.toscana[.]it/phpmyadmin/ http://uslsudest.toscana[.]it/phpmyadmin/ http://vegapark[.]it/phpmyadmin/

http://vegolosi[.]it/phpmyadmin/ http://veloweb[.]it/phpmyadmin/ http://verobiologico[.]it/phpmyadmin/ http://villaggiostuni[.]it/phpmyadmin/ http://virtweb.smorfianapoletanaweb[.]it/phpmyadmin/ http://virtweb3.shop.ideaecrea[.]it/phpmyadmin/ http://virtweb8.shop.gopaint[.]it/phpmyadmin/ http://vps.approdonews[.]it/phpmyadmin/ http://vps.mp3clan[.]it/phpmyadmin/ http://vps.necrologicalabria[.]it/phpmyadmin/ http://vps.raggioxraggio[.]it/phpmyadmin/ http://vps.senzasoste[.]it/phpmyadmin/ http://vps.shop.libreriafacile[.]it/phpmyadmin/ http://vps1.picenooggi[.]it/phpmyadmin/ http://vps1.shop.creasol[.]it/phpmyadmin/ http://vps1.teslari[.]it/phpmyadmin/ http://vps4.shop.consorziopiave[.]it/phpmyadmin/ http://wallpepper[.]it/phpmyadmin/ http://webcamcaorle[.]it/phpmyadmin/ http://weekend[.]it/phpmyadmin/ http://women[.]it/phpmyadmin/ https://dev.bestmovie[.]it/pma/