SPYWARE DOMAIN: terra.mastertop100.net TROJAN REDIRECTOR (Pagesinxt Malicious Redirect) USA-RUSSIA-CANADA-Virgin-IslandsNORWAY-NETHERLANDS-FRANCE-ITALY

MALICIOUS DOMAIN:
SPYWARE - TROJAN REDIRECTOR 

USA-RUSSIA-CANADA-Virgin-Islands-NORWAY-NETHERLANDS-FRANCE-ITALY

http://terra.mastertop100.net/

• https://www.virustotal.com/de/url/b99bc9716fa430c1e0417a758ddf03d3eaf1ca33f8619da37756c61e8469e559/analysis/1395328043/

Pagesinxt Malicious Redirect

• https://urlquery.net/report.php?id=1395328112708

FOR FULL REPORT .txt ICON:

wantedlist2.altervista.org (Trojan-Clicker.HTML.IFrame.aoe) ITALY, United States, Germany

MALWARE: Trojan-Clicker

http://wantedlist2.altervista.org/

• https://www.virustotal.com/de/url/013fce8ec9d84efe2b18db9a2552db694539fd9f056c27a938ae2d491845dd27/analysis/1392474534/

INFECTED:

Trojan-Clicker.HTML.IFrame.aoe

• https://www.virustotal.com/de/file/1ece9568d77b580a0b1d7be3c45aa11f09358fb71f2e0c821f3a98cc7cf3bf74/analysis/1392478038/

• https://www.virustotal.com/de/file/a2da95d0db2d871406b58090f481a3f402befc7a62f7e735c950d49def8e293e/analysis/1392476773/

JS/Pakes

• https://www.virustotal.com/de/file/8b6de8be678e4ac7d3b6a7496adfc086e7b2ab8a33d2b0b18f13f1576ee1ccce/analysis/1392476113/

• https://www.virustotal.com/de/file/baa343e98f59fc0ebe77aaf5e38ee31eae8feb39ac317df9f1708826af2fc0e2/analysis/1392475284/

• https://www.virustotal.com/de/file/1d49f50836faa0d5b057ea9faf4a8c82a9a2a41e3df7c490e8c7aeba7136183a/analysis/1392475833/

• http://jsunpack.jeek.org/?report=750d2ce7d372ce1a2f23cf4f180a065f878e356b

FULL REPORT:

DOMAIN www.al360.it Infected with HEUR:Trojan.Script.Generic (ITALY & GERMANY (mosens.de))

MALWARE: HEUR:Trojan.Script.Generic

http://www.al360.it/

• https://www.virustotal.com/de/url/1997dfdb219a58b84691e87b520bdd5298b65b2a41961869704b554167f49d78/analysis/1392394269/

INFECTION:

HEUR:Trojan.Script.Generic

• https://www.virustotal.com/de/file/a9a22599cbf102ed368db4a89351f91f35c98f32dbc3d846e15e7f9ebc6ce18d/analysis/1392394434/

FULL REPORT:

ABBA (S.O.S.) & New Malware Code: www.abba.it & IP 79.135.167.28 Trojan.JS.Iframe.ahh & Trojan.JS.Iframe.ahi (PUA) (ITALY & POLAND)

ABBA MALWARE AT LEAST SINCE 2012: HEUR:Trojan.Script.Iframer (PUA) (RBN 351, ITALY & POLAND)

http://www.abba.it/

• https://www.virustotal.com/de/url/84645d2eca6550ebd7c47540670934f2383b374162aac5210fe7b6be7e5704e9/analysis/1392389097/

INFECTION:

HEUR:Trojan.Script.Iframer (PUA)

•  https://www.virustotal.com/de/file/3f6d4bcd51b2a294897c1e76402fc2ec956a411ac92acbe7f89029748eae3522/analysis/1392389334/

The complete report (.txt) can be seen here:

SINCE 2009: www.cafi.it Infected with Malware: Malicious Iframe Injection At the Moment: HEUR:Trojan.Script.Iframer (ITALY & UKRAINE)

MALICIOUS DOMAIN ALREADY SINCE 2009: HEUR:Trojan.Script.Iframer (RBN 422) (UKRAINE)

http://www.cafi.it/

• https://www.virustotal.com/de/url/7bd6d2f5f61ade1dcfe6c3357fd48b812d1f40ef8d54b3feae0a71cb831dd2b1/analysis/1392383368/

INFECTION: 

HEUR:Trojan.Script.Iframer

• https://www.virustotal.com/de/file/3510b819f8d1d209bb267f3a721f9cb040fc2c609412e7ace7f2dcd75528e67d/analysis/1392384000/

Mal/Iframe-F

• https://www.virustotal.com/de/file/6eb573fba0944e608d57dc882860149f14bdb2368a295ac19e93f7e6a0072386/analysis/1392383703/

Malicious iframe injection
Javascript associated with malicious code

• https://urlquery.net/report.php?id=9433018

--->

http://91.207.61.32/.r/.fi/index.php

• https://www.virustotal.com/de/url/9d80e5be6628f7734d3fd816c391733b5c4e491c2f96818e22738b8a9c2ed5c7/analysis/1392384629/

• https://urlquery.net/report.php?id=9433214

NEWLY DETECTED: www.albertomanganaro.it Infected with HEUR:Trojan.Script.Generic (ITALY)

NEWLY DETECTED MALWARE SITE FROM ITALY: HEUR:Trojan.Script.Generic

Malicious iframe injection

• https://urlquery.net/report.php?id=9432480

http://www.albertomanganaro.it/

• https://www.virustotal.com/de/url/48d1ce8ef5d827edda2d76a7f190c37d64812b63c905739df28a28101a4732fd/analysis/1392334229/

HEUR:Trojan.Script.Generic

• https://www.virustotal.com/de/file/d246753919f66e3b34e54e24c34b4ec331e07afa0a695b4763c7637470a7dea6/analysis/1392335647/

The complete report can be found here:

NEW MALWARE CODE: Trojan-Downloader.JS.Iframe.dfm INFECTED DOMAIN castelgiorgio.com (ITALY - AUSTRALIA - UNITED STATES)

MALICIOUS VISITOR TO THIS BLOG: www.bema.it INFECTED: Trojan-Downloader.JS.Iframe.czo & HEUR:Trojan.Script.Generic (ITALY)

MALICIOUS SITE: EXPLOIT BLACKHOLE (MALICIOUS INJECTION) Trojan-Downloader.JS.Iframe.czo



DOMAIN:

www.bema.it

• https://www.virustotal.com/de/url/9c313118270d7060f6a88b8d02315e60f6fa366d1e640d01b0154f43f721ab7c/analysis/1391876292/

HTML

• https://www.virustotal.com/de/file/c48575a72b511e9fc0a7e9e601b33507d08296eadb6efebb18655dc1177de4c1/analysis/

SPECIFIC MALWARE (VISITING) LINK: 

www.bema.it/paesaggigeologici.htm

• https://www.virustotal.com/de/url/1a3e767c25cb71944b44bf81943c6d839273fdec1f176966f963d0875215e959/analysis/1391876591/

INFECTION:  

Trojan-Downloader.JS.Iframe.czo

• https://www.virustotal.com/de/file/483e183fedd9db8a7fd74fd979c235c2d0565933534898c55abbfa3e7801b5e7/analysis/1391875774/

HEUR:Trojan.Script.Generic

• https://www.virustotal.com/de/file/0e3b1abbec7f3d81910ab10ba644d5ba64a1075db3b9a85a7833642913871582/analysis/1391875789/

• http://jsunpack.jeek.org/?report=8ace5573ffdaf77d5ed6faf5dd6aface337b0387

• http://wepawet.iseclab.org/view.php?hash=a4bbe339803250d0b1a917575df82c92&t=1391875552&type=js

• https://urlquery.net/report.php?id=9316907

---> REMOTE

miamiheattickets.com/http.php

• https://www.virustotal.com/de/url/0bbe620806942d74fb1ede783f53c0f29151485340a3687deec3bdb8689900d8/analysis/1391877039/

--->

www.bema.it/bema_internet.css

• https://www.virustotal.com/de/url/28a06f8a729f620fc4fb8c3b3aa47c3f2a66b5b9e7fba3578075c5f187218d58/analysis/1391877125/

• https://www.virustotal.com/de/file/805730a9867637233a0e88034a7160ceebb1232bec363db7d057455dc4e8243c/analysis/1352190357/

OTHER MALWARE LINKS FROM THIS DOMAIN:

1) www.bema.it/opere/pg_1.htm

• https://www.virustotal.com/de/url/52200c7f623b60c44c2256c70bc3041a0f7efbf825c1e0067565fd8dfd3dfd37/analysis/1391877987/

INFECTION: 

HEUR:Trojan.Script.Generic

• https://www.virustotal.com/de/file/a4e9035cacdfbfcb1b28cfb2ebedccc0901dbc4c82173a388648d43a7d82b88f/analysis/1391877891/

--->

moreclosings.com

• https://www.virustotal.com/de/url/cb65fb78eb9f34870ab0c33b3fd7b48e9163f72d6d9b29ee9320e97dcb6d69f4/analysis/1391878110/

moreclosings.com/showthread.php?sid=193854

• https://www.virustotal.com/de/url/97d8c820291908356fa32a0b17c1d0eb4bc54e40e4ef64c9a2e72dfd8469a30b/analysis/

• https://urlquery.net/report.php?id=9317125

2) www.bema.it/artigrafiche.htm

• https://www.virustotal.com/de/url/d2fba275794bdef2a814e05cf08b9439daa40293e332fa100bde91327b470231/analysis/1391878663/

INFECTION:  

Trojan-Downloader.JS.Iframe.czo

• https://www.virustotal.com/de/file/3fa71c9f13947e2c60e52843932f59dddcc8e2d424a6f106717f5632e4533dcd/analysis/1391878603/

• https://urlquery.net/report.php?id=9317122

3) www.bema.it/impianti.htm

• https://www.virustotal.com/de/url/17a7d8f57f4c1f929637dea43d3cf7332442a484bb2f89ecca2afb9bf4a9dd1c/analysis/

INFECTION:  

Trojan-Downloader.JS.Iframe.czo

• https://www.virustotal.com/de/file/fc694a8433ca74015e3badf6ecd4d00b18f93ddfaa30121a21b6405658a97928/analysis/1391878854/

• https://urlquery.net/report.php?id=9317119

www.evensi.com PHISHING DOMAIN for Facebook data (ITALY)

PHISING DOMAIN:

www.evensi.com

• https://www.virustotal.com/de/url/7cf7ebcbf5bca37ad35d9e4a834aaececb7c63124cc899f41a452ca8b1aaa70f/analysis/1391182438/

IP:

149.3.145.97 

• https://www.virustotal.com/de/url/3eea87e1338e148f193adbe50f76cd36a0fbefea6fc8b7282055d7b5c3d2b992/analysis/1391183069/

• https://www.virustotal.com/de/ip-address/149.3.145.97/information/

Fwd/Rev DNS Match: NO

• http://www.senderbase.org/lookup/?search_string=149.3.145.97

NEW MALWARE: Trojan-Downloader.JS.Iframe.dfe found on icecube.it (ITALY)

MALICIOUS SITE:

icecube.it

• https://www.virustotal.com/de/url/b1e562e23de2c29cf5cb51b757d82edbdbd06edb3fc1da976db3cba00a046998/analysis/1390497005/

INFECTED WITH NEW MALWARE VARIANT: Trojan-Downloader.JS.Iframe.dfe

• https://www.virustotal.com/de/file/35f74daecafa6897e66b8e8fa5dfb8940f65b50b9a6fc4aae32f6665583b3f40/analysis/1390496903/

• http://urlquery.net/report.php?id=8948169

• http://www.google.com/safebrowsing/diagnostic?site=icecube.it

---> REMOTE


DOMAIN POSSIBLY INFECTED:

tanersarf.com

• https://www.virustotal.com/de/url/2db7836898435db551a3fbcd47db96c42551c4748788ea5facc6522e78bbb149/analysis/1390498334/

WITH: Script.Packed.IFrame.K@gen

• https://www.virustotal.com/de/file/2478011b919e778e0eb30ac74fbc69f81f7a70ec4c7d15bdff3ac8e5dd32d470/analysis/1390497912/

• http://jsunpack.jeek.org/dec/getfile?hash=84af/dca9f4cc27824fcb9650dbfd21dcdc2396c1

SPECIFIC GO:

tanersarf.com/counter.php

• https://www.virustotal.com/de/url/feaf2c7858276ef6f6db59c8eef5219f448c135f9081e85f83a8e637d14dc604/analysis/1390498323/

• https://www.virustotal.com/de/file/97865611a349e3922f252aa61369e2d82fa32598e8a416694c66986c758cf188/analysis/1390498052/

NEW MALWARE: Exploit.JS.Agent.bnu found on www.cretosocostruzioni.it (BLACKHOLE ITALY)

NEW MALWARE found on:

www.cretosocostruzioni.it

• https://www.virustotal.com/de/url/56d645fd54a3131e943fffc38c7d8d2b08708d7fea96a0359b706e41c10b40ed/analysis/

INFECTED: Exploit.JS.Agent.bnu

• https://www.virustotal.com/de/file/7fdbf0bce169b0e2ab441fda2d63ac7d7b114b85ec0dff12e509f074150d9f2d/analysis/1390128259/

www.cretosocostruzioni.it/online

• https://www.virustotal.com/de/url/f2c0777c24805a398d42e4b2fcee5ff98fbd375a42482aac2c019334536fc97b/analysis/1390129080/

INFECTED: Exploit.JS.Agent.bnu

• https://www.virustotal.com/de/file/742113b12396661ca1c2d2796834169e5543624111f75308b5ef1796d80634d1/analysis/1390128250/

81a338 (BLACKHOLE)

• https://urlquery.net/report.php?id=8882516

---> REMOTE(s)

DOMAIN:

lanotfo.com

• https://www.virustotal.com/de/url/6ff7f2d41dd24b4613f5c7f2ddf8045fb0cf966e530535a171dc971168a03bdb/analysis/1390129287/

lanotfo.com/exit.php

• https://www.virustotal.com/de/url/418aefb901fd9cef797a1419bd4c3b82f15eab2e5fac9688998f3ce1cee83775/analysis/1390129281/

DOMAIN:

gylaqim.com

• https://www.virustotal.com/de/url/fc04abfc736f83c76d968a82259c71d4382cbb895c2f50e15d345948c08541a9/analysis/1390128973/

gylaqim.com/exit.php

• https://www.virustotal.com/de/url/fa57933bb759bbb97a034a0ff3ecf1563a51474ad5795f06949b746e58bc6986/analysis/1390128981/

----------------------------------------------------------------------------------------------------------------------------------------------
OTHER RESULTS:

• http://app.webinspector.com/public/reports/19564893

• http://wepawet.iseclab.org/view.php?hash=334dfbfddf5c8dd2e23083b3665eb265&t=1390127730&type=js

• http://zulu.zscaler.com/submission/show/11e7b4c701fdd5cc9d49ceff4e6c058d-1390127849

Facebook User of the Day: Roberto Pargliola from Italy (Possible "Italian Style Flyfisher")

Say Hello to Roberto and Support her LIKEs @:
https://www.facebook.com/roberto.pargliola

Roberto Likes: Unknown. Maybe:

Flyfishing

Newly Detected Malicious Site: www.mamecab.it - HEUR:Trojan.Script.Generic (Italy)

NEWLY DETECTED MALWARE DOMAIN:

DOMAIN:
www.mamecab.it
https://www.virustotal.com/de/url/0ca0c11cecf88f62f124606a7c136269ed4d4ce9bf19239e2f6f7eb82357bc27/analysis/1386936138/

INFECTED:
HEUR:Trojan.Script.Generic
https://www.virustotal.com/de/file/c88c2179eecc7193f25b6d8ef8da2ce0ad7ec3fb57320441f4e9fb458a1c8d16/analysis/1386936823/
https://urlquery.net/report.php?id=8366216

---> PATTERN
69.10.33.245 (USED TO BE INFECTED AS WELL)
https://www.virustotal.com/de/url/c2854a2be9e8961fc9ccab6a4fd14e1a5b557dceee0b8916a85e1ccc7b81fb8f/analysis/1386937052/
https://urlquery.net/report.php?id=6408160
https://urlquery.net/report.php?id=8366318

http://69.10.33.245/FormTools1_5_1/clik.php
https://www.virustotal.com/de/url/bf4e857608efbee59e60c732daf7cceb5b7b1beebb1f5fd9a6c75046700e42d1/analysis/1386936333/

IP for www.mamecab.it: 93.93.200.150
https://www.virustotal.com/de/url/9f018e961c5080d70dedf16fcadcad91c8df4be4f454d4bad3a4541d12777aa5/analysis/1386937273/
https://www.virustotal.com/de/ip-address/93.93.200.150/information/