honypot/trap of blackhats ?

[cleanmx]

I encounter many urls made with nonsense (but existing domain...) and a numerical part like this one.

Code: [Select]

http://wucucudizo.com/1006000112
response is only "ok"

example on threatexpert:
http://www.threatexpert.com/report.aspx?md5=3827b463edf321d3e673e90aea0a5a11

-- gerhard

[SysAdMini]

Is is typical for some fake av (trojan FakeRean). I don't know the purpose of this url,
but this malware requests this style of urls. I suspect that the malware reports a successful installation.