another Luckysploit IP

[DiFor]

this lucky is example of http://www.malwaredomainlist.com/forums/index.php?topic=2577.msg7948#msg7948

[SysAdMini]

Code: [Select]

bigmyfuck.com/prn/index.php?t=4

Code: [Select]

hello-to-you.net/love/?t=2

[GmG]

Code: [Select]

http://193.138.172.15/salo/?t=3
http://193.138.172.15/mark/


[SysAdMini]

Code: [Select]

clickcouner.cn
v-security.info/alla

[SysAdMini]

Code: [Select]

stats-analytics.cn/lera/

[SysAdMini]

Code: [Select]

splo2day.com/lera/?t=6

[SysAdMini]

Code: [Select]

84.244.138.55/ase/?t=4

[SysAdMini]

Code: [Select]

bestlotron.cn/in.cgi?cocacola
kotleto.com/main/?t=1

[SysAdMini]

Code: [Select]

78.41.207.196/vertu/?t=5

[SysAdMini]

Code: [Select]

78.41.207.196/vertu/?t=5

Today I found the way of infection.

Compromised sites like

Code: [Select]

www.my-harmony.org
contain IFrames

Code: [Select]

body><iframe src="hxxp://perfectnamestore.cn/in.cgi?income4" width=1 height=1 style="visibility: hidden"></iframe><iframe src="hxxp://namebuyline.cn/in.cgi?income2" width=1 height=1 style="visibility: hidden"></iframe>
<
to

Code: [Select]

hxxp://perfectnamestore.cn/in.cgi?income4
hxxp://namebuyline.cn/in.cgi?income2

which redirect to the Luckysploit url.

[SysAdMini]

Code: [Select]

r-security.info/alla

[GmG]

Code: [Select]

r-security.info/alla

and

Code: [Select]

http://l-security.info/alla
http://p-security.info/alla

 

[GmG]

Code: [Select]

http://72.233.79.18/tyrek/?t=2
http://wepawet.iseclab.org/view.php?hash=08708c81fd98614d7ffa6d03578c2842&t=1237404046&type=js

[SysAdMini]

Code: [Select]

58.65.237.2/?t=1

[SysAdMini]

Code: [Select]

niencos3432d.cn/bb/?t=7http://wepawet.cs.ucsb.edu/view.php?hash=57ad9efedc55e1516ad177868892e886&t=1237918022&type=js