91.212.65.19

[MarcusB]

hdtvxvid.org (174.132.114.98)
This site claims to play HDTV.

If you click the download button you are taken to (91.212.65.19)

http ://tourdo.net/download/654a635066413d3df111c253/HDTVPlayerv3.5.dmg
http ://tourdo.net/download/654a635066413d3df111c253/HDTVPlayerv3.5.exe

If you have an OSX user agent then you will be served an OSX version of DNSChanger. Windows user agent will give you Windows version.

Malware calls home to 91.212.65.20 for OSX version to download a shell script.
(http://www.malwaredomainlist.com/forums/index.php?topic=2838.0)

[MarcusB]

Another one, same md5 hash though

http ://shotdro.com/download/3776694945673d3d03635c6c/play-video.exe
http ://shotdro.com/download/3776694945673d3d03635c6c/play-video.dmg

[MarcusB]

http ://amoretour.net/download/654a635066413d3df111c253/HDTVPlayerv3.5.exe
http ://amoretour.net/download/654a635066413d3df111c253/HDTVPlayerv3.5.dmg

NS

ns1.amoretour.net

[MarcusB]

http ://kauitour.com/download/654a635066413d3df111c253/HDTVPlayerv3.5.dmg
http ://kauitour.com/download/654a635066413d3df111c253/HDTVPlayerv3.5.exe

NS

ns1.kauitour.com