91.212.65.140

[MysteryFCM]

winpc-antivirus09.com

[CkreM]

Code: [Select]

Win-pc-antivirus-2009.com
and the fake payment site:

Code: [Select]

securebillingpayment.com/pp/

[Malware-Web-Threats]

Code: [Select]

winpcantivirus2010.com/pp/id=
winpcantivirus2010.com/install.exe
VirusTotal - 22/40 (55.00%)
ThreatExpert

[Malware-Web-Threats]

Rogue AV:

Code: [Select]

hxxp://personaldeluxeguard.com

NS for malware domain:
ns1.wdnska.cn [91.212.65.139]
ns2.wdnska.cn [91.212.65.140]

[Malware-Web-Threats]

Fraudulent payment page for rogue:

Code: [Select]

xpdeluxeprotector.com/pp/