Thanks everyone.

Smitfraud:

www.aboutjohnniewalker.biz
aboutjohnniewalker.biz
www.malwarewipesupport.com
malwarewipesupport.com
www.antispydns.biz
antispydns.biz
www.spyfalconsupport.com
spyfalconsupport.com

Rouge anti-spyware:

www.bestguardplatinum.com
bestguardplatinum.com

Esthost:

www.login.esthost.com
login.esthost.com
www.estcertificates.com
estcertificates.com

Ads:

www.adserver.ilounge.com
adserver.ilounge.com

Thx Mak, added

Banner ads: cdn2.precisionclick.com

I don't know if there's a corresponding cdn1.precisionclick.com

Added.

There isn't a matching cdn1.precisionclick.com -- bad destination.

www.limewirepro.info
www.officialares.com



[ please dont post the live links , thanks - Moore ]

www.zeusp2p.com

aarchives.ifriends.net is serving ad photos for a dating service

prawn.exs.cx is not an adserver per se but it's the destination link for very annoying and misleading baner ads on imageshack.us (fake IM windows which take you to that link when you click the faked red-x to close).

Ads: publicis.adcentriconline.com

www.bustcash.com
www.xxx2cash.net

Information obtained from Sophos:

List of domains found in possible relation with W32/Zafi-B worm:

www.seznam.cz
axelero.hu
flashcard.de
postkaarten.nl/
zdnet.fr
cartolina.it
virt.voicemessage.com

ads: pubs.branchez-vous.com There are a few already blocked from that dot com, however not that one!

adsence.sogou.com
www.chanet.com.cn
chanet.com.cn
ad.51job.com
ads.china.com
union.db.kingsoft.com
sensor.suitesmart.com

s11.cnzz.com
4.1tong.com
cpro.baidu.com

ads.content-type.com

127.0.0.1 banner1.axelsfun.com
127.0.0.1 banner2.axelsfun.com
127.0.0.1 banner3.axelsfun.com
127.0.0.1 bannerus1.axelsfun.com
127.0.0.1 bannerus2.axelsfun.com
127.0.0.1 bannerus3.axelsfun.com

10 Malware E-Card sites to avoid (obtained from SiteAdvisors' Blog):

2000greetings.com
fun-e-cards.com
freewebcards.com
funsilly.com
funnyreign.com
fukkad.com
celebwelove.com
eforu.com
ecard4all.com
myfuncards.com

ads.premiereinteractive.com
cmhtml.hk.overture.com
b.casalemedia.com
banners.publipagos.com

ads: clicktorrent.info

Many many thanks to everyone for reporting bad websites.

Here's more:

ads.hexun.com
ads.mychat.to
banner.kiev.ua
banners.aftrk.com
benner.netpia.com
content.bannerconnect.net
creativeby1.unicast.com
eurobjafa.allyes.com
info-ad.de
mxmads.r-content.info
partners.webmasterplan.com
popunder.adsrevenue.net
textlinkad.myrice.com
tjbn.allyes.com
u4471.86.spylog.com
www.axill.com
www.sponsorads.de
s.clickability.com

v1.textclick.com
pp.cnxad.com
count10.51yes.com
ad.cnxad.com
x1.cnxad.com
union.yahoo.com.cn
www.valueshare.com.cn
union.narrowad.com
rm.narrowad.com
ad.netgoo.com
ad.85888.com
adshow.it168.com
adimg.163.com
ad.thinkmedia.cn
ads.997.cn

Thx ncee

code.qihoo.com
banners.sponsorfull.com
banners.paseilimitado.com
promos.sponsorfull.com
js.adsunion.com.cn
js.dahongli.com
image.link.ru
static.exaccess.ru
www.expoactive.com
ads.1687799.com
union.kisswin.com
content.clickhype.com
ad.clickhype.com
ad.displayadsmedia.com
ad.bannerconnect.net
banners.passion.com
ads.ethereal.com
www.cbadvance.com

Miscellaneous tracking cookies, banner ads, or malware sites:

127.0.0.1 valueclick.net
127.0.0.1 looksmartcollect.247realmedia.com
127.0.0.1 content.ifriends.net
127.0.0.1 www.sulfurishop.com
127.0.0.1 www.shaadi.com
127.0.0.1 site.fswshophosting.com
127.0.0.1 localhost.3322.org
127.0.0.1 scfzf.xicp.net
127.0.0.1 content.gametrust.com
127.0.0.1 www.sexyvip.biz
127.0.0.1 images.domainsponsor.com

Thx ncee & Samurai V, added.

adopt.euroclick.com/contents/6575/gad_multirazr_20hit_3ddiscoducks2_720x300.gif
adopt.euroclick.com
euroclick.com
www.gadgetcity.com
www.onlinegiftrewards.com
www.webrewardscentral.com
www.freepay.com
www.onlinerewardcenter.com
www.americanresearchpanel.com
www.freelaptop4u.com

Thx Anti_Spyware.

Banner ads:

127.0.0.1 promotions.newegg.com
127.0.0.1 projects.modillon.net

Thx Samurai V.

mysms.shengnet.com
union.114.com.cn
ads.packetnews.com
ads4.adultadworld.com
ema.spinbox.net

Thx ncee, will be in the next update.

Sunbelt security blog reports that pornmagpass.com downloads a trojan as well as fake spyware removers.

PornMagPass -- your pass to hell

adopt.euroclick.com
adserving.cpxinteractive.com

Thx everyone

Serves banner ads at Yahoo!: gfx.klipmart.com

Added, thx.

Browser hijacking / Malware via Myspace:

newvidscodec.net



AntiVir = TR/Dldr.Zlob.TZ.8
Authentium = W32/AdwareDropper.MCodec-based
Avast = no virus found
AVG = Downloader.Zlob.gen
BitDefender = no virus found
CAT-QuickHeal = (Suspicious) - DNAScan
ClamAV = no virus found
DrWeb = Trojan.Popuper
eTrust-InoculateIT = no virus found
eTrust-Vet = no virus found
Ewido = no virus found
Fortinet = suspicious
F-Prot = W32/AdwareDropper.MCodec-based
Ikarus = no virus found
Kaspersky = Trojan-Downloader.Win32.Zlob.tz
McAfee = Puper
Microsoft = no virus found
NOD32v2 = no virus found
Norman = no virus found
Panda = Suspicious file
Sophos = no virus found
Symantec = no virus found
TheHacker = Trojan/Downloader.Zlob.sw
UNA = no virus found
VBA32 = no virus found
VirusBuster = no virus found

Added, thx.

Thx gothix, added.

Reason why pacificpoker is listed : Adware

http://research.sunbelt-software.com/threa...p;threatid=3546
Tagged by many AV's as AdWare.Win32.Casino

http://sunbeltblog.blogspot.com/2006/01/on-cassava.html

ads.germanfriendfinder.com
ads.asiafriendfinder.com
w11.centralmediaserver.com
ads2.adultadworld.com

Added, thx.

img.shopping.com (banner ads)

gtb.etology.com
pthumbnails.alexa.com

Added.

ads.cams.com
ads.outpersonals.com
banners.unlimitedpass.com
banner.av104.tv
banner.hk82.com
www.cpays-bfarm.com

pic.hotadv.com
adserver.mybittorrent.com
44.ads8.com
cluster.adultadworld.com
hexusads.fluent.ltd.uk
banners.piesfetiche.com

Added