http://elenatyr3s.com/in.cgi?20¶meter=jonn4b&ur=1&HTTP_REFERER=nnned1
Redirects to fake scanner page
http://kiamagentoss.net/evo/
Fake scanner page
http://whykersspt.com/aa/index.php
http://whykersspt.com/aa/tmp/libtiff.pdf
http://whykersspt.com/aa/l.php?i=8
http://whykersspt.com/aa/exe.exe
Exploit kit fake AV downloader as payload
http://1eb6499c0d3856f5220e282fec1592.co.cc/preinst.php?id=02909
Fake AV