Dropnote 1 Sweet Orange EK rental "Dropnotes" are mainly an "online notebook" to share my notes as I go along So I was checking my honeypot logs and was noticing C2-traffic towards the domain doubleclick-ads.pw , being a .pw-domain and all, I started investigating the event. The traffic seen was POST requests directed to doubleclick-ads.pw/js/order.php , the sample itself was initially found on fatburrito.pw/GameHacks.exe [VT]. As with all C2-traffic, it would be interesting to identify the panel as well as any other artifacts hosted on the server. Resolving doubleclick-ads.pw (doubleclick-ads.pw)... 162.248.166.113 Connecting to doubleclick-ads.pw (doubleclick-ads.pw)|162.248.166.113|:80... connected. HTTP request sent, awaiting response... 302 Found Location: ./blah.php [following] --2014-02-16 12:21:03-- h00p://doubleclick-ads.pw/js/blah.php Connecting to doubleclick-ads.pw (doubleclick-ads.pw)|162.248.166.113|:80... connected. HTTP request sent, awaiting respo...