Black hole

[boston]

xttp://kawaiiexchange.com -> xttp://sturtupgeografyc.in/gabon/index.php
+
xttp://graphictutorial.com -> xttp://sturtup-geografyc.in/tandir/index.php
-> xttp://alarm-news.in/www.php?page=b5af6db59003531d -> xttp://alarm-news.in/w.php?f=153&e=8

xttp://news-alarm.in/www.php?page=b5af6db59003531d -> xttp://news-alarm.in/w.php?f=153&e=8

http://wepawet.cs.ucsb.edu/view.php?hash=634abb778c1601a92dc94b468c04ed08&t=1322248525&type=js
http://www.virustotal.com/file-scan/report.html?id=7e10988a856e519a608ae50eccc0b663f59ac4e8da9315305668e2b14c76fdd4-1322243093

[boston]

xttp://news-grammatic.in/www.php?page=b5af6db59003531d -> xttp://news-grammatic.in/w.php?f=153&e=8
http://wepawet.cs.ucsb.edu/view.php?hash=408ae9eca7e6a949858ff57dac3f2f6e&t=1322256563&type=js
http://www.virustotal.com/file-scan/report.html?id=d97107adf1263a4c56ce7af3ca4abfad1757c44122137a26e00dcda26a2a2037-1322256152

[boston]

xttp://settingstat.in/ribai/index.php -> xttp://anadirion.in/www.php?page=b5af6db59003531d -> xttp://anadirion.in/w.php?f=153&e=8
http://www.virustotal.com/file-scan/report.html?id=9904a3128187fd98b58aa4dd25757b320a3cffb409928bd3556796b77cfeb8e0-1322332542
http://wepawet.cs.ucsb.edu/view.php?hash=0653d2563fd61d8b58bd14639416eee8&t=1322332982&type=js

[boston]

xttp://cc-agri.com leads to fake av and black hole, payload is zbot.
http://wepawet.cs.ucsb.edu/view.php?hash=cdb8ce34827ad98edff878e092b6925f&t=1322601346&type=js
xttp://95.168.187.22/files/42bfc0e082c9371cded75e6c42e9f156e0d6225af111bb91.exe
http://www.virustotal.com/file-scan/report.html?id=1d3ff00825bafa48241944c0ae28a078bbc139f2b79a6a2037d985bf9b7398bd-1322601775
xttp://makerstok.com/main.php?page=a8b7c278bc226865 -> xttp://makerstok.com/w.php?f=21&e=8
http://www.virustotal.com/file-scan/report.html?id=e4048696376646f9fbe28ae0f3a94aeb3f5401b3a9edfaae7cf7af136d99e861-1322601486

[boston]

xttp://pimpol672304.co.cc/main.php?page=257ef5eed2a723e8 -> xttp://pimpol672304.co.cc/w.php?f=53&e=8
http://wepawet.cs.ucsb.edu/view.php?hash=1ccd081c840bcaca0f3c716d05cda4d4&t=1323032256&type=js
http://www.virustotal.com/file-scan/report.html?id=adf23a5131cf878dc2c74fe704f164b9a7e01e162e517928bc79657c5838140a-1323031874

[boston]

xttp://theenergycenter.org/ -> xttp://fgdgdfgttr.twilightparadox.com/  -> xttp://z180502.infobox.ru/index.php 
-> xttp://pimpol672337.co.cc/main.php?page=257ef5eed2a723e8  -> xttp://pimpol672337.co.cc/w.php?f=53&e=8
http://wepawet.cs.ucsb.edu/view.php?hash=24232b61b8aff6d45f154afa458de4b8&t=1323110669&type=js
http://www.virustotal.com/file-scan/report.html?id=319693684ae9f0fba937861a2a4c8b80cb6a0535c2a07a94d4274b7f693f5776-1323110443

[boston]

iframe from xttp://ilmondodidany.it/ leads to
xttp://jghkeqjroucggqetg.nl.ai/main.php?page=8487b19ab9bbce03 -> xttp://jghkeqjroucggqetg.nl.ai/w.php?f=16&e=6
http://wepawet.cs.ucsb.edu/view.php?hash=8a95b5031af7aae37af95b1f52a1c304&t=1323209856&type=js
http://www.virustotal.com/file-scan/report.html?id=74cf9d60f2fa62aa2c8a8bc5dc24d0edb81a7df12167feeaad3f5e80ebdf144c-1323209567

[boston]

xttp://azondsondex.ru/adsong/index.php -> xttp://egnom-omitec.ru/main.php?page=64756d1c9639eb25
-> xttp://egnom-omitec.ru/w.php?f=25&e=6
http://wepawet.cs.ucsb.edu/view.php?hash=fcc9b528659b4a11d1db5dbb2c102892&t=1323287220&type=js
http://www.virustotal.com/file-scan/report.html?id=e12b654409e89cc7ba90b7fa611c6d2598911830a715b212847523c0917c6373-1323286854

[boston]

xttp://collection-paradise.ru/acorp/index.php -> xttp://updatelast.ru/main.php?page=64756d1c9639eb25
-> xttp://updatelast.ru/w.php?f=25&e=6
http://wepawet.cs.ucsb.edu/view.php?hash=f8464a2ec83b20be2fc7f2f7dd69a3bb&t=1323458285&type=js

[boston]

xttp://sitemoved.bij.pl/main.php?page=e71ba5a840b27af9 -> xttp://sitemoved.bij.pl/w.php?f=28&e=6
http://wepawet.cs.ucsb.edu/view.php?hash=7cdd003f9a193779682674ea27d5ea67&t=1323638868&type=js
http://www.virustotal.com/file-scan/report.html?id=a68a1aaea65d3569752892a79f760c1cd8e707631ec5284758f75d524c4207f5-1323639114

[boston]

xttp://arcoconstalling.ru/original/index.php -> xttp://send-spark.ru/main.php?page=1016f363104dcd01
-> xttp://send-spark.ru/w.php?f=25&e=6
http://wepawet.cs.ucsb.edu/view.php?hash=1f1d7a80a099a04cd34e50c06648a29d&t=1323885180&type=js
http://www.virustotal.com/file-scan/report.html?id=d06ebb257e14b6e1c58e9649435d94e019996d7266672d472b8967f12bde1b4a-1323884948

[boston]

xttp://spark-send.ru/main.php?page=1016f363104dcd01 -> xttp://spark-send.ru/w.php?f=25&e=6
http://wepawet.cs.ucsb.edu/view.php?hash=574856ac6ee50d97dc7c885c51b15882&t=1323897991&type=js
http://www.virustotal.com/file-scan/report.html?id=3fa7d5bf1c8af0f1b5c32e2752220176140f9f2c4149ef1bc3e2f9e7f8d130d7-1323897723

[boston]

xttp://bedthese.com/main.php?page=899f002ea96106b0 -> xttp://bedthese.com/w.php?f=53&e=6
xttp://loaddocsfast.servehttp.com/main.php?page=899f002ea96106b0 -> xttp://loaddocsfast.servehttp.com/w.php?f=53&e=6
http://wepawet.cs.ucsb.edu/view.php?hash=b4aee2e0efc6a5bb43765baf202072a9&t=1323981219&type=js
http://www.virustotal.com/file-scan/report.html?id=b375097717ab7832342347f873b929b9ecc5fe51b23c05ee805008b563fd1f4e-1323980844
http://www.threatexpert.com/report.aspx?md5=019bf818eec90b5bc428c329a4ee3b36

[boston]

xttp://ragsmog.com/main.php?page=899f002ea96106b0 -> xttp://ragsmog.com/w.php?f=53&e=6
http://wepawet.cs.ucsb.edu/view.php?hash=013c2b2079a537c9d78059ad601e2385&t=1323986819&type=js
http://www.virustotal.com/file-scan/report.html?id=37be24b7b0c4213dc27ac9b5dcdcd8786e3e37673a35885be7ba6f1276382209-1323986690

[boston]

xttp://bedwill.com/main.php?page=899f002ea96106b0 -> xttp://bedwill.com/w.php?f=95&e=6
http://wepawet.cs.ucsb.edu/view.php?hash=7ff9a005aae63105943fc9c1f835c595&t=1324115200&type=js   
http://www.virustotal.com/file-scan/report.html?id=bf552de81a14c5f8128b358afee53d22c06769f17f2cf1f6c57218a5067f2077-1324114921