dimanche 20 août 2017

A third look at JSDropper/ursnif campaign - Proxy Statistics

Hey

I've already talk a lot about the Ursnif campaigns against EU and mainly Italy spreaded by a JScript (you know, the jscript that contacts /r6.php?cmd=p&id= / /l2.php?cmd=p&id= / /re.php?cmd=p&id= etc) but 6 months after my last blogpost, crooks are still working and I have enough data for some cool statistics.
For the last 6 months I've collected access.log logs of one proxy used by this botnet. I'll try to details that here.
There is no magic, I've just use Splunk :D


As reminding, this campaign is used to spread Ursnif like that:

In the same "Proxy server", you can found further "proxy scripts" (usually 1 script / campaign) and those scripts looks like :

So, I've retrieve access.log of one of these proxies and I've extract traffic relative to our case.

Global

Some global statistics for 1 proxy:
From February 2017 to August 2017
  • Total number of hits on all the proxy scripts: 924 021
  • From 108 367 unique IPs
  • on 16 different PHP proxy scripts
Filename Hits First seen url Malware
/3E2s4R.php 610787 June http://194.247.13.196/asus/ Onliner
/re.php 137352 June http://94.177.196.246/loadere/gate.php JSDropper
term.php 121669 February http://94.177.196.246/loader/gate.php JSDropper
l2.php 52288 February http://109.120.142.156/loader2/gate.php JSDropper
r4.php 1848 February http://109.120.142.156/loader4/gate.php JSDropper
/0iSP0c.php 7 June http://194.247.13.222/tess/ Onliner
/130D0G.php 7 June http://194.247.13.222/tess/ Onliner
/1AtJai.php 7 June http://194.247.13.222/tess/ Onliner
/HTsGeg.php 7 June http://194.247.13.222/tess/ Onliner
/J65oH1.php 7 June http://194.247.13.222/tess/ Onliner
/PaD8qo.php 7 June http://194.247.13.222/tess/ Onliner
/XI2jHR.php 7 June http://194.247.13.222/tess/ Onliner
/8QE2UX.php 6 June http://194.247.13.222/tess/ Onliner
/Xou0HC.php 6 June http://194.247.13.222/tess/ Onliner
/19pYvo.php 5 June http://194.247.13.222/tess/ Onliner
/LPQQLc.php 5 June http://194.247.13.222/tess/ Onliner
We can see 2 different cases:
  • Some PHP proxies are used in production
  • Some PHP proxies seems used for tests only.

Tests proxies

I'll start with the "tests proxies". I call them like that because they have only a few hits (~5) and all the hits on those pages are done by the same IP :]
66.180.197.197
This IP is not new in this game :), do you remember the white listing feature set in the spam bot panel ?
This IP was in list of allowed IP in the Spambot panel:


Proxy scripts are configured to forward traffic to hxxp://194.247.13.222/tess/, it's Onliner Spambot, proably the testing instance.

Production proxies

Some details about each proxy scripts:

3E2s4R.php

This one is my favourite.
The proxy records 610 787 hits on this file, from ~ 100 000 unique IPs and I'm unable to find any sample on public sandox.
This is a lot of hits if we think that these statistics concern only 1 proxy! It was used to forward the Spambot traffic to 194.247.13.196

re.php

This one was hit 137 352 times by 1335 uniques IPs. It is used to forward JSDropper traffic to 94.177.196.246.
This Proxy was used for the JSDropper campaign "NEWIT" (Ursnif)
Interesting fact of this one: 51.28% of hits are done by the IP 2.228.128.141 (Italy).
Some IOCs:
urls:
samples:
  • d5291865ff80cd7cc9f425a145351bb7234383f1
  • 67e1c342f6b41d163a6208b3ccebb991c0650473

term.php

Used to forward JSDropper traffic to 94.177.196.246
121 669 hits from 2259 unique IPs.
It was used for campaigns "WASP","iphone","summer","old", "u1", "NEWIT" and "404" (Ursnif)

Some IOCs:
urls:
  • hxxp://www.volf.de/term.php?cmd=e
  • hxxp://pajaje.borec.cz/term.php?cmd=e
  • hxxp://hotelsantantonio.com/term.php?cmd=e
  • hxxp://46.163.110.45/css/term.php?cmd=e
  • hxxp://fb-arredamenti.it/term.php?cmd=e
  • hxxp://psymaster.wz.cz/term.php?cmd=e
  • hxxp://getting-reconnected.de/term.php?cmd=e
  • hxxp://ebkk.nl/term.php?cmd=e
  • hxxp://supercondmat.org/term.php?cmd=e
samples:
  • 2016dfb44f452adcdd96b7781fdfb581ac72b0f7392404805f08d57210d16ad9
  • a1bd385b59efe1be13da9e8a008e06a6fb6cc07acd2727be22d076c7a2b27155
  • 01853d1552ca4032e5fdc251cc92d57dffd5912411666c7842106d730ada09f4

l2.php

Used to forward JSDropper traffic to 109.120.142.156 52 288 hits from 716 unique IPs.
This one is very old. I've logs from November 2016 for this scripts.
At this time they was not using campaign or group name, and they was using ... Ursnif.

Some IOCs:
urls:
  • http://151.236.13.49/l2.php
  • http://191860.webhosting63.1blu.de/l2.php
  • http://454391.webx04.mmc.at/l2.php
  • http://46.163.110.45/css/l2.php
  • http://ballettschule-nottuln.de/l2.php
  • http://edle-steine.at/l2.php
  • http://enmoto.com/l2.php
  • http://evastrutzmann.at/l2.php
  • http://evi-verein.at/l2.php
  • http://fioravanti-production.org/l2.php
  • http://friesl-keramik.at/l2.php
  • http://ftp.dimensionevideo.it/l2.php
  • http://ftp.italiabrowsergame.com/l2.php
  • http://getting-reconnected.de/l2.php
  • http://gunnebo.eniac.it/l2.php
  • http://hobbygartenteich.at/l2.php
  • http://hotelsantantonio.com/l2.php
  • http://humanitas-gbr.de/l2.php
  • http://jambasket.com.hk/l2.php
  • http://juwelier-hohenberger.de/l2.php
  • http://katstones.de/l2.php
  • http://lklv.wz.cz/l2.php
  • http://mauriz.at/l2.php
  • http://meindl-edv.eu/l2.php
  • http://nr11303.vhost-enzo.sil.at/l2.php
  • http://pajaje.borec.cz/l2.php
  • http://patrickhess.de/l2.php
  • http://pferdemedizin-stanek.at/l2.php
  • http://portoverde.it/l2.php
  • http://positivemindstates.com/l2.php
  • http://psymaster.wz.cz/l2.php
  • http://reimer-wulf.de/l2.php
  • http://sca.homelinux.com/l2.php
  • http://spatialpourtous.com/l2.php
  • http://supercondmat.org/l2.php
  • http://tennis-arnfels.at/l2.php
  • http://tischlerei-kreiner.at/l2.php
  • http://umzuegeberlin.com/l2.php
  • http://www.diamondfitness.hu/l2.php
  • http://www.drogenhilfezentrum.de/l2.php
  • http://www.dtk-brandenburg.de/l2.php
  • http://www.elektro-morjan.de/l2.php
  • http://www.kurzhaarteckel-trakehner.de/l2.php
  • http://www.midnightlady2006.de/l2.php
  • http://www.msinformatica.it/l2.php
  • http://www.seelackenmuseum-sbg.at/l2.php
  • http://www.skyways-ragdolls-zwergspitze.de/l2.php
  • http://www.teeversand24.net/l2.php
  • http://www.valentinavalsania.it/mdb-databases/cgi-bin/l2.php
  • http://www.webstream.at/l2.php
samples:
  • a10cd296e3f58fe329bbff6edaf0bdbb1f9099a088b7a5cede583dda09dd7cf2
  • 5add967a8dc9d7669e7d8da9882329600874b3a35d2a8f087820438ae112cecd
  • fbfe6048514c7fc944c0f56a480d8c4963fce9018b5d3ae8cf39c5840979930c
  • 9a44ff53471012328a3b167c149ed71c2e82b117de8f9463f5773b5b4f5cc7b6
  • 0bf1c1b457818bf7acb6eda33b0f8eb6e9ce026aee620707f6b4e4b58a2e77d0

r4.php

And the last one: r4.php.
1884 hits by 302 IPs. Used during the campaigns "mk1" "mk2" "bomber" and one with no name ""
Some IOCs:
urls:
  • hxxp://191860.webhosting63.1blu.de/r4.php?cmd=e
  • hxxp://werbekalender-werbenotebooks.de/r4.php?cmd=e
  • http://positivemindstates.com/r4.php?cmd=e
  • di000240.host.inode.at/r4.php?cmd=e
  • http://patrickhess.de/r4.php?cmd=e
samples:
  • c827511b425cbc91faf947f1c3d309db3dde7419fe8c892380a03c71b5196e0e

Résumé


This threat start to be very noisy, they continue to spread malware always in the same way.
If somebody who's reading this works on the Ursnif part, don't hesitate to ping me I'll share my data :]

I hope that this example can help you to better understand cybercrime threats. Happy hunting \o/

79 commentaires:

  1. Problem solving is used when products or processes fail, so corrective action can be taken to prevent further failures. App Developer In Dubai this is the right time for businesses in Abu Dhabi to grab this opportunity.

    RépondreSupprimer
  2. A third look at JSDropper.It is superb blog and i really appreciate your blog. It is because i always like the informative blogs. You did a great job and thanks for sharing.Nicely presented information in this post.The Commercial Cleaning Services in Dubai provides good cleaning service you visit here site for more details.

    RépondreSupprimer
  3. There are academic nursing writing help companies whose ultimate goal is to provide Help with Nursing Writing Services since they are aware most nursing essay writing service part-time students lack enough time to complete their college custom nursing assignments.

    RépondreSupprimer
  4. Today we are sharing with you all the Romania tv shows which you will be watch online daily. Seriale turcesti online

    RépondreSupprimer
  5. Accounting paper writing services are essential and they have become very popular for those seeking accounting coursework writing services since most of them seek Accounting Writing Services.

    RépondreSupprimer
  6. Professional History Research Paper Services is very popular for students in search for history essay writing help services and history assignment writing services.

    RépondreSupprimer
  7. Nobody tests printers as we do. Get appraisals, estimating, and execution on the Canon Pixma iX6820 printer dependent on the highlights you care about Pixma iX6820 Setup.

    RépondreSupprimer
  8. If you are searching for the assistance for Kindle issues, reach to our experts for Kindle Support. Use our top-notch services for better results.

    RépondreSupprimer
  9. Florida Pest Control offers lawn treatment services, pest management and outdoor and indoor pest control services. So when in need contact the experts.

    RépondreSupprimer
  10. You can also talk to Kindle Support Number for any Kindle Login issues. In case any of your Kindle products encounter errors or problems, you can trust blindfold, talented experts at Kindle Support Phone Number .

    RépondreSupprimer
  11. Bug Control from Fox Pest Control provides you peace of mind by protecting your home or office from unwanted pests. Call today to schedule an appointment.

    RépondreSupprimer
  12. We have a panel of highly qualified academic writers from Australia, UK, Canada and US who have been helping students of all subjects and all levels with their university assignments, college essays, case studies and many other research projects, providing the most effective online assignment writing services.

    RépondreSupprimer
  13. We have a panel of highly qualified academic writers from Australia, UK, Canada and US who have been helping students of all subjects and all levels with their university assignments, college essays, case studies and many other research projects, providing the most effective online assignment writing services.

    RépondreSupprimer
  14. Buy crack Cocaine online UK | Cocaine for sale UK

    buycrystalmethonline.us comes first in the market of delivering and distribution of high-quality medications throughout the world.

    purchase Drugs online with bitcoin, CashApp and PayPal payment. We offer delivery right to your home in Canada, USA, UK worldwide of the same products.

    Buy drugs online from Drugs-Center, the biggest Dealer in US and EU for cocaine, cannabis, heroin, xtc and more drugs by paying anonymous.

    Buy, crack, Cocaine, online, |, Cocaine, for, sale, uk, |, buy, Cocaine, pawder, uk, |, order, crack, Cocaine, online, uk, |, buy, crack, Cocaine, online, australia, |, Cocaine, for, sale, online, australia, |, Heroin, for, sale, online, uk, |, buy, Heroin, online, uk, |, order, Heroin, in, uk, |, MDMA, Methylone, for, sale, online, |, Order, Methylone, bk-MDMA, |, Buy, Molly, MDMA, |, MDMA, for, sale, uk, |, buy, MDMA, pills, |, order, MDMA, online, without, prescription, |, Buy, DMT, Dimethyltryptamine, Online, |, Ecstasy, (MDMA), 100mg, pills, |, buy, Ecstasy, MDMA, for, sale, uk, |, order, MDMA, Ecstasy, online, |, Buy, LSD, online, uk, |, LSD, online, for, sale, uk, |, oderLSD, online, |, buy, safe, MDMA, (ectasy), online, in, the, UK, |

    Website: http://buycrystalmethonline.us/

    Call / Text / WhatsApp: +1(209) 854-4227

    EMAIL: buycristalmethonline@gmail.com

    RépondreSupprimer
  15. purchase Drugs online with bitcoin, CashApp and PayPal payment. We offer delivery right to your home in Canada, USA, UK worldwide of the same products.

    Buy drugs online from Drugs-Center, the biggest Dealer in US and EU for cocaine, cannabis, heroin, xtc and more drugs by paying anonymous.

    https://www.clubpillsonline.com/

    cocaine for sale
    buy dmt
    heroin for sale
    buy mdma
    amphetamine for sale
    order crack
    buy coke
    ecstasy for sale
    cocaine
    heroin
    clubpillsonline


    buy all your pills here, cocaine for sale online, buy ecstasy, amphetamine pills, crack, cocaine, research chemicals, MDMA pills, powder cocaine for sale, painkillers on sale, pure heroin for sale, buy dmt powder, brown heroin for sale, buy cocaine with bitcoin, buy LSD with paypal, buy LSD with cashapp


    Buy Powder Cocaine in united kingdom

    buy 79% Pure White Heroin Powder in Denmark

    buy 61% Pure Brown Heroin in Belgium

    order Black Tar Heroin in Poland

    buy 80% Pure Rolls Royce Heroin in Switzerland

    buy Skype XTC MDMA Pills in Dubai

    buy Molly Green Hulk Pills in Ireland

    buy Yellow Illuminati 160mg in south Africa

    buy MDMA 100mg Pills in Portugal

    buy DMT online in Bangladesh

    buy Tesla Ecstasy Pills in Siri lanka

    buy Crack Cocaine in Australia

    buy Freebase Cocaine in Sweden

    buy Xanax Alprazolam 1mg & 2mg in Yemen

    buy Hydrocodone online in Saudi Araba

    buy Tramadol 100mg in Brazil

    buy Methadone Hydrochloride 10mg online in Spain

    buy Celebrex 100 & 200mg online in asia

    buy Oxycodone Hydrochloride online in Yemen

    buy Alprazolam (Xanax) powder online in usa

    buy Amphetamine powder online in Bangladesh

    buy Dextroamphetamine powder online in Ireland

    buy 2C-E (4-ethyl-2,5-dimethoxy) in Norway

    buy Mephedrone Crystal in Saudi Araba

    buy A-PVP Crystal online in Australia

    buy Ketamine online in Germany

    buy Ephedrine Crystal in usa

    buy Crystal Meth in Poland

    MAM-2201 for sale online in france

    Amphetamine Pills for sale online in Turkey

    buy Adderall Amphetamine 30mg for sale online in Spain

    buy Molly (MDMA) 150mg Capsules online in Italy

    Buy Cocaine Online,MDMA Pills For Sale,Order Pure Heroin

    Order pure cocaine online – Pure cocaine for sale

    Order MDMA Pills Online Cheap – MDMA pills for sale

    Buy pure heroin online, Heroin for sale cheap

    Buy powders & research chemicals,research chemicals for sale

    Buy powders online,order pure research chemicals

    DMT for sale – Buy DMT online

    Cheap stores to shop online

    Buy Xanax bar online – Anxiety Painkiller for sale

    Club Pills Online is a legit drug and powder supplier that offers you the best out of the best drugs available in the streets and dark market. All the products we sell have been tested and approved by the best consumers. we understand the customer's needs for the medications in demand and take full responsibility to deliver them at your doorstep no matter where you are.

    cocaine for sale,buy dmt,heroin for sale,buy mdma,amphetamine for sale,order crack,buy coke,ecstasy for sale,cocaine,heroin

    Website: www.clubpillsonline.com

    WhatsApp/Text/Call: +1(585)653-0813

    Email: clubpillsonline@gmail.com

    RépondreSupprimer
  16. Accounting software helps to manage payroll accounting, bookkeeping (keep data, paychecks, vendor/customer record, taxes, payroll services, automated pay and many more ). We are help you to accounting software setup, installation, update, upgrade or fix any QuickBooks Error and Sage Error/Issue.
    Sage 50 Not Opening
    Sage 50 Not Connected to Database
    Sage File System Error
    Sage Error 1628
    Sage Error 1335

    RépondreSupprimer
  17. A well written Content provided by you. Your writing skills are perfect delta airlines reservations. i hope so you will write more content like this but if you are searching for flights then contact us or visit our website.

    RépondreSupprimer
  18. To be honest I found very helpful information your blog thanks for providing us such blog IPL Betting tips

    RépondreSupprimer
  19. To be honest I found very helpful information your blog thanks for providing us such blog ENG vs AUS

    RépondreSupprimer
  20. I appericiate your comments i want to share that Get all data about the flight booking at the brisk and proficient helpline helping a large number of travelers.

    allegiant airlines reservations
    spirit airlines reservations

    delta airlines reservations
    united airlines reservations.

    RépondreSupprimer
  21. Mostly, I am looking for cheap flights deals because I never want to book the higher airfare based flights tickets. Therefore, the use of this flight booking site for the SAS Airlines Official Site  was a great choice for me just because of the cheapest airfare tickets.

    RépondreSupprimer
  22. Never waste your money on the expensive air tickets because the affordable Southwest Airlines Reservations are the lowest airfare opportunity for the passengers for both domestic and international journeys.

    RépondreSupprimer
  23. My Mexico Flight Booking is never expensive for me just because of the Delta Airlines Reservations Deals and Offers. I use this website for the flights reservations because they are offering cheapest airfare deals for domestic and international flight booking too.

    RépondreSupprimer
  24. I appericiate your comments i want to share that Get all data about the flight booking at the brisk and proficient helpline helping a large number of travelers.


    delta airlines reservations
    united airlines reservations

    RépondreSupprimer
  25. Are you thinking to travel with the SAS Airlines? If yes then you must know about the Business Class Review of the SAs Airlines. On this page we are come with the major points about the review of SAS Flights that you must know before going to confirm your tickets.

    RépondreSupprimer
  26. A well written Content provided by you. Your writing skills are perfect. i hope so you will
    write more content like this but if you are searching for flights then contact us or visit our website
    KLM Reservations..

    RépondreSupprimer
  27. WoW!!! Great post. Thanks for posting such great content.
    By the way, here is an offer going on cheap flight tickets. You can Grab best deals on
    Sun Country Reservations.

    RépondreSupprimer
  28. Thanks for sharing such an informative article.
    https://premiumcrack.com/foxit-phantompdf-crack/

    RépondreSupprimer
  29. You're so cool! I don't think I've read anything like this before. So good to find somebody with some original thoughts on this subject. Thanks for starting this and please keep on sharing with us great information.What a wonderful post is it, i am very happy and i appreciate your effort.Main Social Media Marketing Dubai

    RépondreSupprimer
  30. Hi! Nice blog. We are also offering you QuickBooks Customer Service Phone Number. If you need any help regarding QuickBooks issues, dial +1-855-756-1077 for instant help.

    RépondreSupprimer
  31. Greetings to everyone who, like me, turned to this service for help. In fact, I know a huge number of similar services where they will write an essay or an essay for a fee, but essaypro service is the best and now I will be able to prove to you why. The site of this service is well designed, in terms of functionality of all the sites on the market this is the best. Registration is fast, you just need to leave your mail and some of your data for communication. Order is fulfilled from an hour to two, it all depends on the complexity of the order and the nuances in it.

    RépondreSupprimer
  32. Thank You for sharing this kind of amazing post.
    Towards the end, we believe that the steps above might help in setting up email services in QuickBooks desktop.
    Re-sort Lists in QuickBooks Desktop | Duplicate Merchant Service Deposits into QuickBooks | Setup and Configure Email Services in QuickBooks Desktop?

    RépondreSupprimer
  33. A well written Content provided by you. Your writing skills are perfect . i hope so you will write more content like this but if you are searching for flights then contact us or visit our website.

    allegiant airlines booking
    allegiant airlines tickets
    allegiant airlines reservations
    allegiant airlines booking

    RépondreSupprimer
  34. While working on QuickBooks accounting software user can face some errors which obstructs users from working smoothly. You can read our articles to solve all your errors through our blog QB Tool Hub.

    RépondreSupprimer
  35. I appericiate your substance intriguing, like an educative article I read in contents101.if you want to book flight tickets cisit us at:

    flights to auckland

    RépondreSupprimer
  36. I appericiate your comments i want to share that cheap flights to new orleans Get all data about the flight booking of at the brisk and proficient helpline helping a large number of travelers.

    RépondreSupprimer
  37. singapore Airlines Manage Booking 1-844-414-9223. Get lowest fares on Domestic and
    International Singapore Airlines flight Booking with best discount & offers. Book your
    Singapore Airlines Manage Booking Number manage booking Number 1-844-414-9223
    Singapore Airlines Manage Booking
    Singapore Airlines Phone Number

    RépondreSupprimer
  38. Thanks a lot for sharing your knowledge via the post.
    You can also take expert’s help from our QuickBooks support team by dialing toll-free +1-844-405-0906.
    how to fix quickbooks error 3371 | qbo.login | how to update quickbooks desktop | quickbooks won t open

    RépondreSupprimer
  39. I amazed by the way you explained things in this article. I really appreciate your work. If you are facing any issue while using the Quickbooks software you can contact us any time or you can visit our website.
    Error 3371 status code 11118 quickbooks

    RépondreSupprimer
  40. This post is very informative for everyone, thanks for sharing.
    Quickbooks Customer Service as the name suggests helps you to diagnose issues while installing quickbooks desktop accounting software, With the help of Our tech support team, you can fix Quickbooks Desktop Installation Errors in 2 or 3 minutes. For know more call us or visit our website by clickable link.

    RépondreSupprimer
  41. Programming Assignment Experts provides you with programming assignment help. Your online programming assignment will be of the best quality completed within the provided time period with 100% plagiarism-free programming assignment help.

    RépondreSupprimer
  42. This is a great blog. I like the way you express the information to us. Thanks for such a post and please keep it up.
    How to Fix McAfee Error Code 5

    RépondreSupprimer
  43. sites that provide the updates you want, please visit now. live sydney

    RépondreSupprimer
  44. Looking for the best software for accounting and financing, you might have heard the names of Quicken and QuickBooks. If you want to move further, then you can see the detailed comparison between them so as to take the best route as possible. Just see Quicken vs QuickBooks comparison by clicking the link.

    RépondreSupprimer
  45. Menthol crystal is obtained by freezing peppermint oil. The resultant crystals of menthol are later separated by filtration. In appearance, menthol crystals are very clear with a cool minty fresh odour.

    Menthol Crystal Production

    RépondreSupprimer
  46. Acrylonitrile butadiene styrene or ABS is an example of a common thermoplastic polymer. Its glass transition temperature is approximately 105C. Since ABS is amorphous, it does not really have any true melting point.

    acrylonitrile butadiene styrene prices

    RépondreSupprimer
  47. This is a nice post. Keep posting.
    Having QuickBooks error 15106 and not able to resolve it? Know this error can be resolve without any sophistications, and in few simple steps. Give us a chance to serve. Visit the link above.

    RépondreSupprimer
  48. Oxygen is a chemical element having the symbol O with atomic number 8. It is known as a member of the chalcogen group in the periodic table.

    oxygen production cost

    RépondreSupprimer
  49. Hi dear, if you are looking to meet a wonderful and highly flammable call girl tonight, come to me and you will not be disappointed. Connect with me in an unexpected way and live extreme pleasure in my very capable hands. Have divine sex and allow our bodies to become one while you are inside me and feeling splendid.
    Female call girls service
    Female
    Escort service
    Erotic massage
    Dating
    Call girls WhatsApp
    Call girls number
    Call girls for party
    Call girls
    Call girl WhatsApp
    Call girl number
    Call girl
    Relationship
    personal service
    Outcall girls
    Model
    Incall girls
    Hotel call girls
    Female call girls service
    Female

    RépondreSupprimer
  50. Nagaqq Yang Merupakan Agen Bandarq terbaik , Domino 99, Dan Bandar Poker Online Terpercaya di asia hadir untuk anda semua dengan permainan permainan menarik dan bonus menarik untuk anda semua

    Bonus yang diberikan NagaQQ :
    * Bonus rollingan 0.5%,setiap senin di bagikannya
    * Bonus Refferal 10% + 10%,seumur hidup
    * Bonus Jackpot, yang dapat anda dapatkan dengan mudah
    * Minimal Depo 15.000
    * Minimal WD 20.000
    * Deposit via Pulsa TELKOMSEL
    * 6 JENIS BANK ( BCA , BNI, BRI , MANDIRI , CIMB , DANAMON )

    Memegang Gelar atau title sebagai AGEN POKER ONLINE Terbaik di masanya

    11 Games Yang di Hadirkan NagaQQ :
    * Poker Online
    * BandarQ
    * Domino99
    * Bandar Poker
    * Bandar66
    * Sakong
    * Capsa Susun
    * AduQ
    * Perang Bacarrat
    * Perang Dadu
    * BD QQ (New Game)


    Info Lebih lanjut Kunjungi :
    Website : NAGAQQ
    Facebook : NagaQQ official
    WHATSAPP : +855977509035
    Line : Cs_nagaQQ
    TELEGRAM :+855967014811

    RépondreSupprimer
  51. Hi there, my name is Jasmine Shetty and I am a 21-year-old independent call girl in Goa and college student. I will always do my best to satisfy you and you will not regret spending these moments with me. We will enjoy everything you can imagine and many other things you would not. I am looking for serious, educated people who are determined to meet me and enjoy sex to the fullest.
    Goa Escorts &
    Goa Escort &
    Goa Escorts Service &
    Goa Escort Service &
    Escort Goa &
    Escorts Goa &
    Escorts in Goa &
    Escort in Goa &
    Escort Service in Goa &
    Escorts Service in Goa &
    Goa Independent Escorts &
    Independent Escorts Goa &
    Escort Service Goa &
    Escorts Service Goa &
    Call Girls Goa &
    Call Girls in Goa &
    Call Girl Goa &
    Call Girl in Goa &
    Goa Call Girls &
    Goa Call Girl &

    RépondreSupprimer