Black hole

[boston]

xttp://www.posvecoo.toh.info/index.php?ref=945fdef1aab164d6 -> xttp://www.posvecoo.toh.info/w.php?f=4c27f&e=1

[boston]

xttp://kuletif.eu/main.php -> xttp://kuletif.eu/w.php?f=182b5&e=1
https://www.virustotal.com/file/fc8594df8f8f54dba5ab36ebccc831e098f7c953153bf226c875229b89620c0a/analysis/1333195005/

[boston]

xttp://qeryrhvcntrt.myfw.us/main.php?page=5d6a3721ddd20fb8 -> xttp://qeryrhvcntrt.myfw.us/w.php?f=97d19&e=1    
https://www.virustotal.com/file/b0cd25363036f519e46b61957613cdc5271ea31c233dafcaba43335fda294b0d/analysis/1333624199/

[boston]

xttp://zuberingiostaor.in/main.php?page=07246c29deb93759 -> xttp://zuberingiostaor.in/w.php?f=5e91c&e=1
https://www.virustotal.com/file/715900c5895fe9ad04f22f850f62c94fa305c0a6fc17b33fcf139305ea390b4f/analysis/1333813052/

[boston]

xttp://allanlacosse.com/main.php?page=5e0cdb0ca7f86ed0 -> xttp://allanlacosse.com/w.php?f=97d19&e=1
http://wepawet.cs.ucsb.edu/view.php?hash=690d812745b18574a39a55dab08ee79c&t=1335534057&type=js
https://www.virustotal.com/file/a16b6c2eb43b13c67e6b26711e58474a293c90020765f9498615dd05145f6147/analysis/

[boston]

xttp://designbyallison.com/main.php?page=5e0cdb0ca7f86ed0

[boston]

xttp://ynavqoayb.igg.biz/main.php?page=c69bd02e93e6957c

[EP_X0FF]

BH EK

hxxp://c336kl1.dyndns.biz/catalog.php?rio=f49988ac08b79415

http://wepawet.iseclab.org/view.php?hash=41254ebf21c46dcc95a34733153cba5d&t=1338773447&type=js

hxxp://c336kl1.dyndns.biz/files/fe0e4
hxxp://c336kl1.dyndns.biz/files/bb3e0
hxxp://c336kl1.dyndns.biz/files/86b3a

[boston]

xttp://ww2.taylorgram.com/main.php?page=3081100e9fdaf127
http://wepawet.cs.ucsb.edu/view.php?hash=f64a4694d96803fb7130075a2519a784&t=1339526920&type=js

[boston]

xttp://readyforweekend.net/l/src.php?case=6251f7551d037da2

[boston]

xttp://74.91.118.234/view.php?s=bba2ae32701df84b
http://www.threatexpert.com/report.aspx?md5=047e5231bc3166dc3dae828166d05960

[dlipman]

Have you noticed lately that when you try to analyze some BH EK sites such as;  http://adsnx.co.cc/main.php?page=5ddbacdb5beb3981

You'll get a result such as...
"No input file specified."

[boston]

xttp://50fd804e645bb.chicagoprivateparties.com/news/GENE.PHTML
http://urlquery.net/report.php?id=792358
payload:
xttp://50fd804e645bb.chicagoprivateparties.com/news/Mutter_Homecoming4.exe
https://www.virustotal.com/file/acfe69174327f7f8146c47f9174d937f6b6f2ba12e14d2d767d08d10747a1679/analysis/1358797039/

[michajp]

Confirmed active at 2013-04-11.11-30 (JST):

Code: [Select]

hxxp://avoer2012.unsri.ac.id/aleanto.htm
hxxp://bitas.timetest.ru/aleanto.htm
hxxp://bugs4u.info/aleanto.htm
hxxp://chekani.ru/aleanto.htm
hxxp://confederacy.zhilin.info/aleanto.htm
hxxp://creationbaymccom.ipage.com/serach.htm
hxxp://cs-vsi.myarena.ru/serach.htm
hxxp://dakar.by/aleanto.htm
hxxp://dalmis.net/aleanto.htm
hxxp://delta-mebel.by/gakmail.htm
hxxp://drupal.timetest.ru/aleanto.htm
hxxp://ergo.proxy.perso.neuf.fr/serach.htm
hxxp://flowpa.hu/aleanto.htm
hxxp://forum.in911.ru/aleanto.htm
hxxp://forums.gta-slim.ru/aleanto.htm
hxxp://goa.genealogie-bahn.de/aleanto.htm
hxxp://infoengr.net/aleanto.htm
hxxp://jan.krotky.free.fr/aleanto.htm
hxxp://just2play.ro/aleanto.htm
hxxp://kanasta.thebest.kao.pl/serach.htm
hxxp://kitti-kutyakozmetika.fh.rs/serach.htm
hxxp://minimonosdigital.tk/aleanto.htm
hxxp://netcat4full.timetest.ru/aleanto.htm
hxxp://netcat4.timetest.ru/aleanto.htm
hxxp://ohota-ural.com/aleanto.htm
hxxp://oldversion.samaraart.ru/aleanto.htm
hxxp://olimpprog.uupi.ru/serach.htm
hxxp://paytechsolutions.com/serach.htm
hxxp://pokrovhram.by/aleanto.htm
hxxp://possessionpointcharters.com/serach.htm
hxxp://privycouncil.hu/aleanto.htm
hxxp://rskshi5vida.ru/aleanto.htm
hxxp://shinndesign.com/aleanto.htm
hxxp://site.ruksadindan.com/aleanto.htm
hxxp://tank.timetest.ru/aleanto.htm
hxxp://tepekoydernegi.com/aleanto.htm
hxxp://time2life.ru/aleanto.htm
hxxp://tkbc.ru/aleanto.htm
hxxp://urfo-konkurs.uupi.ru/aleanto.htm
hxxp://vekilebe.com/aleanto.htm
hxxp://weissedrachen.de/aleanto.htm
hxxp://westie-be.com/gakmail.htm
hxxp://www.delta-mebel.by/gakmail.htm
hxxp://www.divorcecamp.com/gakmail.htm
hxxp://www.dravaszovetseg.hu/aleanto.htm
hxxp://www.globalac.by/gakmail.htm
hxxp://www.heidiscathouse.org/gakmail.htm
hxxp://www.ilcampodeigiochiblog.org/aleanto.htm
hxxp://www.koloniaostrowicka.boo.pl/aleanto.htm
hxxp://www.longbeachsurfshop.com/aleanto.htm
hxxp://www.lunchandlearn.ro/gakmail.htm
hxxp://www.medicinoserdve.lt/aleanto.htm
hxxp://www.melody-of-heart.de/aleanto.htm
hxxp://www.met-centr.ru/gakmail.htm
hxxp://www.nebesa.by/aleanto.htm
hxxp://www.nikonorisalo.com/aleanto.htm
hxxp://www.officiallifeent.com/gakmail.htm
hxxp://www.ourwatershed.ca/gakmail.htm
hxxp://www.polimt.ru/serach.htm
hxxp://www.pollena-astra.com.pl/gakmail.htm
hxxp://www.softaircenter.at/gakmail.htm
hxxp://www.tbgonline.biz/aleanto.htm
hxxp://www.tkbc.ru/aleanto.htm
hxxp://www.weissedrachen.de/aleanto.htm
hxxp://zagan.website.pl/aleanto.htm
hxxp://zkouska.net-fly.eu/aleanto.htm
hxxp://zsolti455.weboldala.net/aleanto.htm