195.88.191.46

[SysAdMini]

Code: [Select]

wpupadop.cn/stat2/
referer

Code: [Select]

xguxerob.cn (61.42 %) 1893 149 7.87 % (4.83 %)
kzayopoq.cn (18.69 %) 576 108 18.75 % (3.5 %)
lhamedep.cn (6 %) 185 37 20 % (1.2 %)
qmesanic.cn (4.83 %) 149 17 11.41 % (0.55 %)
fhijafif.cn (3.5 %) 108 20 18.52 % (0.65 %)
khumemit.cn (3.05 %) 94 9 9.57 % (0.29 %)
Unknown (1.3 %) 40 4 10 % (0.13 %)
fteqimop.cn (0.58 %) 18 1 5.56 % (0.03 %)
kvumurij.cn (0.58 %) 18 4 22.22 % (0.13 %)
adverter11.info (0.03 %)

[cleanmx]

i will check these 612 domains...

Code: [Select]

http://007q-branch.com/
http://023led.com/
http://100watts.com/
http://174.36.148.230/
http://192.168.8.32/
http://195-88-191-46.ptrzonez.com/
http://1kinozal-tv.ru/
http://1sense.info/
http://202.143.164.43/
http://203.155.220.217/
http://203.158.224.6/
http://209.85.129.132/
http://33duraka.info/
http://33duraka.name/
http://5828178.com.tw/
http://61.7.145.106/
http://69indianmovies.com/
http://76.12.222.111/
http://943canyonroad.com/
http://988.com.my/
http://aaccord.com/
http://abass101.com/
http://abunayyanelectric.com/
http://accburo.ru/
http://aclagosstate.org/
http://adckits.com.my/
http://add-block-11.info/
http://admiraladmin.ie/
http://advanceshoppe.net/
http://adverter11.info/
http://agencjaprofit.eu/
http://aglama.net/
http://agrometal.com/
http://aklob.net/
http://alkhoei.org/
http://almdni.com/
http://amigosdatrilha.com.br/
http://and4568.narod.ru/
http://angelsanddemonsmovie.ru/
http://ankodiatraders.com/
http://antintl.com/
http://anubal-hc.ac.th/
http://area.obec.go.th/
http://arsplus.pt/
http://artnews.ucoz.ru/
http://asianschoolgirlblog.com/
http://asiantsblog.com/
http://asmash.ru/
http://ataturklisesi.k12.tr/
http://atco.ru/
http://auto-key.com/
http://auto-rubber.com/
http://autouver.com/
http://autozlom.net/
http://awarenes.narod.ru/
http://awfc.rtaf.mi.th/
http://ayranci.gov.tr/
http://ayutthaya.doae.go.th/
http://babki.do.am/
http://baby86.cn/
http://bangalorenewsnetwork.com/
http://bangkokdvd.com/
http://banhad.khonkaen.police.go.th/
http://barrasfc.com.br/
http://bestsoft.nxt.ru/
http://bet-bot.com/
http://bfnation.net/
http://bhindia.com/
http://bhinet.cz/
http://binarynetwork.com/
http://bizfin.com/
http://blogs.runningaventure.com/
http://bodin2.ac.th/
http://bposummit.com/
http://brains.edu.pk/
http://brasflower.com.br/
http://brother.co.th/
http://bsbteng.frih.org/
http://bum.ba/
http://cams.iporn.com/
http://carbon.tu2.ru/
http://caribbeantrading.com/
http://cascadasdechocolate.com/
http://catalog.snacorp.ru/
http://cazkafuq.cn/
http://cbss.ac.th/
http://cccima.com/
http://ccounter.net/
http://cdacm.bpi.ac.th/
http://cddweb.cdd.go.th/
http://celular2000.net/
http://cent.wm-elite.com/
http://ceskysoftball.cz/
http://checkdomain.vn/
http://chiangrai.ect.go.th/
http://chiaoteng.com/
http://chkchkchk.net/
http://cidecsrt.com/
http://clicknamjai.com/
http://clicregistro.com/
http://codocul.com/
http://coj.go.th/
http://commentblast.com/
http://comunadetortugas.com.ar/
http://coolio.com/
http://cotmes.org/
http://cpao.go.th/
http://cpram.co.th/
http://cpucalc.com/
http://crazyboy2008.com/
http://cuttingsarchive.org.uk/
http://cvsoftech.com/
http://cystersi.wagrowiec.pl/
http://daccordpropiedades.com.ar/
http://dailly.info/
http://danniiharwood.net/
http://dct.edu.vn/
http://defactoinfotech.com/
http://democracy2007.net/
http://deniky.unas.cz/
http://derekosbornebuilders.com/
http://detektorgold.cz/
http://digivoice.net/
http://dilekceler.com/
http://divohouse.ru/
http://download-adult-dvds.com/
http://dusithost.dusit.ac.th/
http://dzinehub.com/
http://easternthailand.com/
http://ecam-lekremlinbicetre.com/
http://e-cmgt.com/
http://ecomuse.go.kr/
http://edupac.cl/
http://egroo.by.ru/
http://ekonomik-kielce.edu.pl/
http://eladancaeudanco.com.br/
http://elearning-poppy.com/
http://embeded-adds-11.info/
http://e-muhasebe.org/
http://enforcementagent.net/
http://erschultz.com/
http://escolhaclaro.com.br/
http://estoeschile.com/
http://estoesespana.com/
http://estoesmexico.net/
http://ethertouch.com/
http://europafilmes.com.br/
http://ewha.an4u.com/
http://expedice.org/
http://feriaelvinoyelmar.com.ar/
http://fhijafif.cn/
http://financial.obec.go.th/
http://fincentrum.sk/
http://finesi.it/
http://fisheries.go.th/
http://fjellknausen.no/
http://fkdolnipoustevna.cz/
http://fnjnepal.org/
http://folux.hu/
http://forensic.police.go.th/
http://fortunepet.com/
http://forum.988.com.my/
http://forums.pslan.kiev.ua/
http://fossli.no/
http://fotodeals.com/
http://fp.tibiscus.ro/
http://francuskapeciva.com/
http://frantsuzik.com/
http://freescape.com/
http://freewebtown.com/
http://fse.tibiscus.ro/
http://fteqimop.cn/
http://fundacaocdlrecife.org.br/
http://fuskerbytes.com/
http://gabone.com/
http://galsangalvano.com/
http://gamebazaar.in/
http://gamemanagersport.es/
http://gaskachel.be/
http://gasmash.ru/
http://gcfun.com/
http://gentalgroup.com/
http://getcurrent.net/
http://getgoogleadsforfree.org/
http://gilgo.es/
http://global.pfadfinder-lammersdorf.de/
http://golbasims.k12.tr/
http://golhisar.meb.gov.tr/
http://google-analistyc.net/
http://google-analystics.com/
http://google.com/
http://gostilna-murka.com/
http://gottoloveit.com/
http://gratisweb.com/
http://greek-seaguide.com/
http://groesbeckhospital.com/
http://grvo.com/
http://gsm.com.ar/
http://gstc.com.kh/
http://gtelcom.com/
http://gulenminikkalpler.com/
http://guntha.com/
http://guthy-renker.com.cn/
http://gxjiasijy.com/
http://h288racing.nl/
http://hackfarmer.ucoz.ru/
http://haco-hamburg.de/
http://hallytrading.com/
http://hamzali.net/
http://hanbeot.org/
http://happylittlefox.com/
http://harajcom.com/
http://hawthornsuitestoledo.com/
http://hctopolcany.sk/
http://health.best-host.ru/
http://hilason.com/
http://hitori.do.am/
http://hits.checkdomain.vn/
http://hlmadeira.com/
http://hlngx.net.cn/
http://hnifuzof.cn/
http://homedrive.erio.ws/
http://home.planet.nl/
http://hostum.net/
http://hotpartychicks.net/
http://hottabibn.ucoz.ru/
http://hpline.az/
http://huameihg.cn/
http://hugejuggs.com/
http://hurleysweb.com/
http://iaesterussia.ru/
http://idelight.org/
http://image-n-design.com/
http://imagessite.net/
http://imagevinui.com/
http://indiamyplaywin.com/
http://industriaseuropeas.com/
http://inetra.spblink.ru/
http://inno.obec.go.th/
http://interastro.or.th/
http://internetjugend.pytalhost.eu/
http://introht.com/
http://invivo-crd.com/
http://irricm.net/
http://isotsa.com/
http://istanbulsanat.net/
http://itjukebox.com/
http://ivy.com.vn/
http://jacksonhudhomes.com/
http://jagbibiv.cn/
http://jjsure.com/
http://jkgarments.com/
http://jocuri.idir.ro/
http://joelesperanza.com/
http://jokepost.ru/
http://jp-vids.net/
http://jurakorea.co.kr/
http://juxingyanchu.com/
http://kalematallah.com/
http://kalibrasyononline.com/
http://kamery.pay.pl/
http://kampanlanna.com/
http://khamoosh.com/
http://khramtsova.h1.ru/
http://khumemit.cn/
http://kigi.meb.gov.tr/
http://killmax.ucoz.ua/
http://kino-plaza.com/
http://kocicka.com/
http://konakmakifersoy.k12.tr/
http://koshelechek.ucoz.ru/
http://kpizuyuw.cn/
http://kralkartal.com/
http://krasorbita.ru/
http://kri1.obec.go.th/
http://ktntv.net/
http://kumc.holston.org/
http://kurdistannet.org/
http://kutbak.sakhonnakhon.police.go.th/
http://kwangdocable.co.kr/
http://lacaceleb.hu/
http://laitbox.ru/
http://lakeeffekt.com/
http://latvianholiday.se/
http://lazyjcampground.com/
http://learningfamily.com.cn/
http://lebnews.com/
http://leopardprinter.com/
http://lexabogados.info/
http://lhamedep.cn/
http://lidoarcobalenocatania.it/
http://likeweblogs.com/
http://lindaskulturskule.no/
http://liv4ik.at.ua/
http://livelnternet.com/
http://livelnternet.net/
http://liveroom.tv/
http://lo67.free.fr/
http://losinkasgolfclub.com/
http://loveshackfancy.com/
http://lovinshoes.com/
http://loyal.by/
http://ltxfy.cn/
http://lurkersdelight.com/
http://magcomp.com/
http://mahedubai.com/
http://makmuh.trakya.edu.tr/
http://manoranjanindia.com/
http://marinersinternational.com/
http://mastersanitaryware.com/
http://matecmedicion.com.ar/
http://maths-a-domicile.com/
http://mattioli-bags.com/
http://mdseminarios.com/
http://meble-polikar.com/
http://media-click.ru/
http://meenjam-station.com/
http://melli.ir/
http://melody-europe.com/
http://memealhajeri.com/
http://mercedes-samara.ru/
http://mgts.lpru.ac.th/
http://mikesfamoushd.com/
http://mikon.my.alkar.net/
http://mindswork.net/
http://ming-key.com/
http://minilabworld.net/
http://minimalart.ru/
http://mistressmim.com/
http://miz.ru/
http://modernmusclecars.net/
http://moe.go.th/
http://mojklc.com/
http://moneytrudy.com/
http://monteblancohotel.com/
http://morticom.com/
http://mrbages.com/
http://mrspc.org/
http://mtheatrebangkok.com/
http://mtjxcl.cn/
http://muang.phayao.police.go.th/
http://mub.ru/
http://multiluces.com/
http://muntaser.com/
http://musicodedosmundos.com.ar/
http://muzhit.net/
http://mykingsizedick.com/
http://myshiur.net/
http://myvideo.com.tw/
http://nakhonnayok.net/
http://naplesgastro.com/
http://narathiwat.nfe.go.th/
http://nata.cad.pl/
http://natade.net/
http://nauticapuricelli.it/
http://nbi1.obec.go.th/
http://ndirekoc.cn/
http://neelindustries.com/
http://nelsonservizi.com.cu/
http://nextwebstudio.net/
http://niazmiaz.com/
http://nicbar.chat.ru/
http://niis.stekloholding.ru/
http://niksaze.com/
http://niksaze.info/
http://niksaze.net/
http://nma5.obec.go.th/
http://nma7.obec.go.th/
http://nongnakam.khonkaen.police.go.th/
http://nozomi.wz.cz/
http://nsw2.obec.go.th/
http://nvujinaw.cn/
http://o2timesquare.co.kr/
http://officialtobin.com/
http://offroadcup.it/
http://oggosoft.com/
http://ohrada.cz/
http://ojc.coj.go.th/
http://ok-eg.com/
http://okna-plast.org.ua/
http://okulweb.meb.gov.tr/
http://omerozkan.com.tr/
http://omidvar-brothers.com/
http://oneangryman.com/
http://online-kinofilm.ru/
http://onlinevideo.org.ua/
http://onlyhomeclips.com/
http://opfitalia.net/
http://orbitmasterbatches.com/
http://osteogenesis.info/
http://oticon.co.kr/
http://pae.co.th/
http://palat.infoo.ru/
http://palpapercupmachine.com/
http://paradox.com.mx/
http://paraslab.com/
http://pareztour.cz/
http://patrocinio.org.ar/
http://paverst.ru/
http://paytraff.biz/
http://pct1.obec.go.th/
http://peaco-op.com/
http://pelle.com.br/
http://phdmbu.com/
http://photoeye.co.kr/
http://phusang.phayao.police.go.th/
http://pivnoe-delo.com/
http://pkchlorochem.com/
http://plasticgranules.com/
http://pmkcentral.com/
http://pniei.penza.ru/
http://poeticpartners.com/
http://ponyexpres.cz/
http://poolbikemc.com/
http://pornoexpress.ru/
http://porno-videos.at.ua/
http://pornxxx4all.net/
http://postcatsavings.com/
http://potenza.cc/
http://ppk.ac.th/
http://president.lru.ac.th/
http://prikolnoe.tv/
http://princehotel-bkk.com/
http://promueble.com.mx/
http://pronetguvenlik.com.tr/
http://protizer.ru/
http://province.mots.go.th/
http://prywatne.pl/
http://qmesanic.cn/
http://qnet.co.th/
http://quantumelektronik.com/
http://quemquerserummilionario.uol.com.br/
http://rabbitscooters.com/
http://racha1.ac.th/
http://rainbowfilmsociety.com/
http://rakdeerakdee.com/
http://raku4.pamo.org.uk/
http://ramajudicial.org/
http://reinopatagonia.com/
http://rekpuck.com/
http://remdekor.ru/
http://residencialitapoa.com.br/
http://ret3.obec.go.th/
http://retireinpanama.info/
http://rhymerchemical.com/
http://roadstar.pl/
http://roadtomoney.nm.ru/
http://roces.sk/
http://rockhardpowerspray.com/
http://rolki.masa.waw.pl/
http://roomiespage.com/
http://rotoltank.nl/
http://rouming.net/
http://rsdekatrina.com/
http://rsu.ac.th/
http://rus-alco.ru/
http://russad.com/
http://rvcgnivc.ru/
http://s216099855.onlinehome.us/
http://s238620704.online.de/
http://sacramentoproperty-management.com/
http://saddozai.com/
http://safe-service.ru/
http://sahachannel.com/
http://saliwon.com/
http://sambist.ru/
http://samtech.ac.th/
http://sangath.com/
http://sanma.com.ar/
http://santacruznoticias.com.ar/
http://saraburi.ect.go.th/
http://sbw.ac.th/
http://sch19.smhoster.net/
http://school.obec.go.th/
http://scottontherocks.com/
http://scppark.com/
http://scronk.com/
http://sculptbeauty.com/
http://sdent.snu.ac.kr/
http://seafresh.com/
http://sebastianisraelit.com.ar/
http://sebnembal.com/
http://secureftp.fr/
http://semasinternational.com/
http://semena.net/
http://send29931.cn/
http://servicedesk.delta.hu/
http://sesawech.ac.th/
http://set-test.org/
http://sezma.com/
http://shinawatradio.com/
http://shock.if.ua/
http://showmakers.com.sg/
http://shrisudarshanjimaharaj.org/
http://siamfootball.com/
http://siammed.com/
http://siamwebdesign.com/
http://siamweddings.com/
http://siamzab.com/
http://sibcom.ru/
http://sibir-90.ru/
http://sickideas.com/
http://siemensinfo.pl/
http://simplewebsitedesign.co.uk/
http://sims2.04gd.com/
http://sinchewalarm.com/
http://skj.co.th/
http://skunk14.narod.ru/
http://slubne.net.pl/
http://smilson.com/
http://s-mont.cz/
http://sm-plus.kz/
http://softball-in-nrw.de/
http://softwareprojects.in/
http://solarjobsinfo.com/
http://soneribank.com/
http://songs.njom.net/
http://sotwct.org/
http://soustami.edu.sk/
http://southfp.com/
http://sozialteam.de/
http://sp2.isanok.pl/
http://spivakov.ru/
http://srisun.com/
http://sro-smileyz.extra.hu/
http://standox.sk/
http://st-andrews.ac.th/
http://statisticslebanonltd.com/
http://stavryxa.ru/
http://stms.co.th/
http://ststhailand.com/
http://studio-fourus.ru/
http://sunnasys.com/
http://supercrooo.cz/
http://superfil.com.mx/
http://support.clean-mx.de/
http://supreme.rubinplus.net/
http://svefipuj.cn/
http://syukadig.cn/
http://takikulubu.com/
http://tamlinh.net/
http://tanzania.go.tz/
http://team2000vicenza.com/
http://telebos.com/
http://telephone-discount.com/
http://tempfa.com/
http://texdp.cn/
http://thaboschool.com/
http://thailanddogs.com/
http://thcmtm.org/
http://thenetsolinc.com/
http://tindra.erio.ws/
http://tip.ogu.edu.tr/
http://tomatoe.net/
http://trivias.com/
http://trvozgul.com/
http://tudungtoday.com/
http://tundrafilm.com/
http://turanioo.k12.tr/
http://turgutlurotaryio.k12.tr/
http://turzovka.fara.sk/
http://tv-zebra.net/
http://twelfth-ads.info/
http://uboyney.net/
http://udn1.obec.go.th/
http://udn2.obec.go.th/
http://umbeijoroubado.com.br/
http://umspcl.com/
http://users.otenet.gr/
http://utt2.obec.go.th/
http://uzaktanegitim.netcad.com.tr/
http://vakassociates.in/
http://valeo-marketing.com/
http://valuemag.net/
http://valuepartners.com.br/
http://vardhmandevelopers.com/
http://vdvbux.ru/
http://videoklipy-zdarma.net/
http://video.se.am/
http://vininternational.com/
http://vitay.org.ua/
http://vivana.ru/
http://vivaris.biz/
http://vms-mail.ru/
http://vsefoyou.ucoz.ru/
http://vtuyocew.cn/
http://vzrosloe.tv/
http://wannabrowser.com/
http://wawoo-temple.org/
http://webmail.prevx.com/
http://web-sniffer.net/
http://weddingkn.com/
http://welfarestate.net/
http://wm56.inbox.com/
http://xceleratedmarketing.com/
http://xsport-samara.ru/
http://yjnnz.com/
http://yoku.cn/
http://yth.com/
http://zespol_szkol_nr3.republika.pl/
http://zhuweipaper.com/
http://zip.webhost.ru/
http://zschgrob.edu.sk/
http://zsjanapavla.sk/
http://zsmu.info/
http://zsmu.zp.ua/
http://zsohajnowka.pl/
http://zsvrutky.edu.sk/
http://zwyagel.com.ua/

all are already in database...

[Malware-Web-Threats]

Attached wepawet results

[Malware-Web-Threats]

Exploits

Code: [Select]

ccikudor.cn/rur/
ccikudor.cn/rur/formLooksLooks.pdf
ccikudor.cn/dj/
ccikudor.cn/dj/formLeapFive.pdf
ccikudor.cn/dj/alwaysSome.swf


Code: [Select]

ccikudor.cn/stat1/
ccikudor.cn/stat1/overEverIsnt.pdf
ccikudor.cn/stat1/anComes.swf
http://wepawet.iseclab.org/view.php?hash=064ed75e2b7d4cb49bad933b1c550788&t=1253002410&type=js

Code: [Select]

ccikudor.cn/2cv/
ccikudor.cn/2cv/dontLayoutDont.pdf
ccikudor.cn/2cv/wordA.swf
http://wepawet.iseclab.org/view.php?hash=b407f0d5c99fb06bcd4b720aa147ef70&t=1253002421&type=js

Trojan

Code: [Select]

ccikudor.cn/rur/update.php
ccikudor.cn/rur/update.exe
ccikudor.cn/dj/update.php
ccikudor.cn/dj/update.exe
ccikudor.cn/stat1/update.php
ccikudor.cn/stat1/update.exe
ccikudor.cn/2cv/update.php
ccikudor.cn/2cv/update.exe

http://www.virustotal.com/analisis/9e8a441e174952f5656cdafa82c0113dd4346e0bc603d0569371314437e452aa-1253000065
http://www.virustotal.com/analisis/55102fcfbbe66b433ad481c3101ab83133e09f4c1dde6766d02dec788bf6b80d-1252737290
http://www.virustotal.com/analisis/1eac464c1a6b1b0aad0189894787ebaf2d60bd90fdaf497dc02d5459e1ebc903-1252951484
http://www.virustotal.com/analisis/c50546386b7bd52a1391a297c74e2fd4495245dd8e74bc71d2555cd5bd95b3f9-1252951511
http://www.virustotal.com/analisis/9e8a441e174952f5656cdafa82c0113dd4346e0bc603d0569371314437e452aa-1253000065
http://www.virustotal.com/analisis/55102fcfbbe66b433ad481c3101ab83133e09f4c1dde6766d02dec788bf6b80d-1252737290

http://www.threatexpert.com/report.aspx?md5=45cfd654ceedfeb15210c69d50fca924
http://www.threatexpert.com/report.aspx?md5=f2c18d0f01a08b4af70cd302ca2c3e9a

Control Panel

Code: [Select]

ccikudor.cn/rur/admin.php
ccikudor.cn/dj/admin.php
ccikudor.cn/stat1/admin.php
ccikudor.cn/2cv/admin.php


[Malware-Web-Threats]

same urls for

Code: [Select]

mvamelov.cn

[SysAdMini]

Code: [Select]

ccikudor.cn/qweqwe/
ccikudor.cn/qweqwe/theirYearsBook.pdf
ccikudor.cn/qweqwe/byEtExact.swf
ccikudor.cn/qweqwe/update.php?id=5
ccikudor.cn/qweqwe/admin.php

[Malware-Web-Threats]

Exploits / Trojan Tedroo:

Code: [Select]

rxumohas.cn/qweqwe/
rxumohas.cn/qweqwe/theirYearsBook.pdf
rxumohas.cn/qweqwe/byEtExact.swf
rxumohas.cn/qweqwe/update.php
rxumohas.cn/qweqwe/update.exe
rxumohas.cn/qweqwe/admin.php
http://wepawet.iseclab.org/view.php?hash=50ed99b8cc37673039b35de571c4a13a&t=1253222498&type=js
http://www.virustotal.com/analisis/9fa4d122bbbca5e89c905eb983eec63483e45c2149186bdf004ea5d6a6ed3a1e-1253172052

Code: [Select]

kpaxikey.cn/qweqwe/update.php
kpaxikey.cn/qweqwe/update.exe
kpaxikey.cn/qweqwe/admin.php
http://wepawet.iseclab.org/view.php?hash=920549173315af67077d05ac7e567873&t=1253223700&type=js
http://www.virustotal.com/analisis/9fa4d122bbbca5e89c905eb983eec63483e45c2149186bdf004ea5d6a6ed3a1e-1253172052

Code: [Select]

mvamelov.cn/qweqwe/update.php
mvamelov.cn/qweqwe/update.exe
mvamelov.cn/qweqwe/admin.php
http://wepawet.iseclab.org/view.php?hash=43508f58a4d5b407d00a205b4feee6e6&t=1253249159&type=js
http://www.virustotal.com/analisis/9fa4d122bbbca5e89c905eb983eec63483e45c2149186bdf004ea5d6a6ed3a1e-1253172052

[Malware-Web-Threats]

Iframe to exploits

Code: [Select]

bliyonoc.cn/s/in.cgi?3&ab_iframe=0&ab_badtraffic=0&ab_trash=1&antibot_hash=bot
nlequcic.cn/s/in.cgi?3&ab_iframe=0&ab_badtraffic=0&ab_trash=1&antibot_hash=bot


Code: [Select]

<html><frameset rows="100%"><frame src="hxxp://kpaxikey cn/fr/news.php"></frameset></html>


[Malware-Web-Threats]

other on this ip:

Code: [Select]

kpizuyuw.cn
kzayopoq.cn
vciqupoj.cn
sexygallets.com


[Malware-Web-Threats]

iframe to exploits

Code: [Select]

vsefurug.cn/s/in.cgi?13
hsovolih.cn/s/in.cgi?13
wrorupex.cn/s/in.cgi?13
fzegarox.cn/s/in.cgi?13
hyedafox.cn/s/in.cgi?13
xleyaguh.cn/s/in.cgi?13
sdifasip.cn/s/in.cgi?13

http://wepawet.iseclab.org/view.php?hash=de630fda00c63f16ce78109b52abbc7d&t=1255739365&type=js

<html><frameset rows="100%"><frame src="hxxp://jrizoxom.cn/a100/news.php"></frameset></html>

[Malware-Web-Threats]

Fragus exploit pack:

Code: [Select]

retuskf.cn/a100/news.php
nuzogbf.cn/a100/news.php
zivuzjp.cn/a100/news.php
http://wepawet.iseclab.org/view.php?hash=4d2361ac24e14aaaf210f15076a7873c&t=1255935261&type=js
http://wepawet.iseclab.org/view.php?hash=66a2634fa2f91157a449ada8169dfe84&t=1255935272&type=js
http://wepawet.iseclab.org/view.php?hash=0632cba1cbaeb137acbaf42a86aed4f5&t=1255935283&type=js

redirects to exploits:

Code: [Select]

ns1.qiyidgab.com/s/in.cgi?13
http://wepawet.iseclab.org/view.php?hash=ad0a27b98f25c42405575106c956204c&t=1255935105&type=js

[Malware-Web-Threats]

continues to evolved this IP

Fragus Exploit Pack:

Code: [Select]

suqiwyk.cn/a11/news.php


[Malware-Web-Threats]

Code: [Select]

tutablb.cn/ege/
diyasmw.cn/a12/news.php
falokmp.cn/a12/news.php
yufezzc.cn/1/news.php
yufezzc.cn/a12/news.php

[Malware-Web-Threats]

Trojan Tedroo

Code: [Select]

195.88.191.46/2.exe
http://www.virustotal.com/analisis/e34a1ecbebd6f92c817c425434f2ace566ddeb03630ec702cb4cf8fa5413aecd-1257515842 - 11/40 (27.5%)