本文接 上文 ，该团伙注册了大量的符合 [A-Z]{2}\d{2}.cc 规则的域名。

DNS解析

上述域名的cname记录解析均为：

; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.el7_9.9 <<>> xxxx.cc
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 65332
;; flags: qr rd ra; QUERY: 1, ANSWER: 10, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;xxxx.cc.			IN	A

;; ANSWER SECTION:
xxxx.cc.		60	IN	CNAME	v8c2qwks-u.funnullv26.com.
v8c2qwks-u.funnullv26.com. 1	IN	CNAME	va4bd9ms.n.funnullv27.com.
va4bd9ms.n.funnullv27.com. 600	IN	A	20.205.12.191
va4bd9ms.n.funnullv27.com. 600	IN	A	20.239.91.10
va4bd9ms.n.funnullv27.com. 600	IN	A	20.239.164.75
va4bd9ms.n.funnullv27.com. 600	IN	A	104.208.78.201
va4bd9ms.n.funnullv27.com. 600	IN	A	104.208.87.223
va4bd9ms.n.funnullv27.com. 600	IN	A	207.46.132.60
va4bd9ms.n.funnullv27.com. 600	IN	A	20.187.89.37
va4bd9ms.n.funnullv27.com. 600	IN	A	20.187.96.180

通过对这些IP进行域名指向反查可以得到一些符合规则的域名列表。

也许是为了批量管理，所有域名的NS地址均使用 ns1.funnulldns.com 又可以反查出一批域名 https://securitytrails.com/list/ns/ns1.funnulldns.com

funnulldns.com的主人疑似为 funnull.com，为一家CDN提供商。

网站内容

在25日晚上，这些域名开始跳转到腾讯云OSS

> GET / HTTP/1.1
> Host: wk01.cc
> Accept: */*
> 
< HTTP/1.1 301 Moved Permanently
< Content-Type: text/html; charset=UTF-8
< Transfer-Encoding: chunked
< Connection: keep-alive
< Location: https://aq545615-1-1310820385.cos.ap-nanjing.myqcloud.com/sda545adagf/index.html?channelCode=aq033

1310820385 是腾讯云COS用户的唯一id。此外在网页内容 历史存档 历史存档 中还包含：

<script type="text/javascript" src="//source-1310860841.cos.ap-guangzhou.myqcloud.com/download.js"></script>
<script>
var _hmt = _hmt || [];
(function() {
  var hm = document.createElement("script");
  hm.src = "https://hm.baidu.com/hm.js?4bfce7e2138b313a6cc13e4c3a7fc2ce";
  var s = document.getElementsByTagName("script")[0]; 
  s.parentNode.insertBefore(hm, s);
})();
</script>

腾讯云COS id 1310860841 和 百度统计id 4bfce7e2138b313a6cc13e4c3a7fc2ce

当网页打开 会从 https://sdk.szdaqi88.com/web/arnwyp/aq033/init?channelCode=aq033&av=1&cv=1&hash=&xxxxxx 进行加载软件的下载地址。

$ dig sdk.szdaqi88.com

;; QUESTION SECTION:
;sdk.szdaqi88.com.              IN      A

;; ANSWER SECTION:
sdk.szdaqi88.com.       600     IN      CNAME   gtm-cn-7pp2mt5ut06.gtm-a1b9.com.
gtm-cn-7pp2mt5ut06.gtm-a1b9.com. 60 IN  CNAME   dfjo3f.g.ngxfence.org.
dfjo3f.g.ngxfence.org.  60      IN      A       180.76.199.174

;; AUTHORITY SECTION:
ngxfence.org.           29570   IN      NS      ns2.wawadns.com.
ngxfence.org.           29570   IN      NS      ns1.wawadns.com.

sdk.szdaqi88.com cname 到 gtm-cn-7pp2mt5ut06.gtm-a1b9.com. gtm-a1b9.com 是阿里云的CDN域名。

未完待续。。。