Web Security And Awareness towards Cybercriminals

4/12/2014

Let US Welcome:
lunpandubishengfa.zhuolingxiu.com as a MALICIOUS VISITOR
(to this Blogspot)
FROM Beijing, CHINA & Walnut, UNITED STATES
IP: 110.173.196.1

MALICIOUS BLOGVISITOR FROM Beijing, CHINA
& Walnut, UNITED STATES

DOMAIN:

http://zhuolingxiu.com/

https://www.virustotal.com/de/url/b7d7f19c52b69e6721a7b9073741e7c6dc01f7bd4f3e04d9a95e150abb4ecb29/analysis/1397322523/

HTML:

https://www.virustotal.com/de/file/70624e295994c8b58995ea206a9d203bb56fad709b05ac972f053307a3399911/analysis/1397322837/

http://sitecheck2.sucuri.net/results/zhuolingxiu.com

IP:

http://110.173.196.1/

https://www.virustotal.com/de/url/ab6314d04650288df2d4054571208375f4606cdf8b09266e3427a91d2a6f8e62/analysis/1397323537/

https://www.virustotal.com/de/ip-address/110.173.196.1/information/

BHA: 3

https://www.projecthoneypot.org/ip_110.173.196.1

Fwd/Rev DNS Match: NO

http://www.senderbase.org/lookup/?search_string=110.173.196.1

MALICIOUS SUBDOMAIN:

http://lunpandubishengfa.zhuolingxiu.com/

https://www.virustotal.com/de/url/7481662efef095e53073ccc590585966f6b5c3f3c21d2364dc550ee577836b1f/analysis/

http://sitecheck2.sucuri.net/results/lunpandubishengfa.zhuolingxiu.com

http://www.urlvoid.com/scan/lunpandubishengfa.zhuolingxiu.com/

VISITING LINK:

http://lunpandubishengfa.zhuolingxiu.com/16024/

https://www.virustotal.com/de/url/df9f8d71cd3e8c7a80affdc3a9addb0964b0cae6355eddfabc316dbb74ef5e85/analysis/1397321793/

IP:

http://107.160.11.209/

https://www.virustotal.com/de/url/ab6314d04650288df2d4054571208375f4606cdf8b09266e3427a91d2a6f8e62/analysis/1397323537/

Network Owner: Psychz Networks

http://www.psychz.net/

https://www.virustotal.com/de/url/d1aaf5879110e18c64671ba2386ec1e8cb1e8c9144adb6dc9e1003003f67e814/analysis/1397325169/

COMMENT SPAMMER FROM BLOGGER TO BLOGGER:
Mr. Ams Patil Subject: AMS India from Bangalore
"I would like to recommend your article .. you can also refer PLC Repairs"
OR
"You for me and i for you..."

POTENTIALLY SUSPICIOUS/(MALICIOUS ?)
COMMENT SPAMMER TO THIS BLOG:

Ams Patil - AMS India - Bangalore

COMMENT: I would like to recommend your article .. you can also refer PLC Repairs

SCREENSHOT COMMENT

The Related Post where the Comment has been made, can be found here:

http://stayaway2.blogspot.com/2013/12/it-works-spa-christopher-tierney-of.html

PROFILE LINK:

http://www.blogger.com/profile/09937088204105970127

https://www.virustotal.com/de/url/4f98b161a5a79f4148538919dcdbc87664d9041df3094edc5d81b3ab1612d648/analysis/1397236254/

HTML

https://www.virustotal.com/de/file/f62eff5f017a92631ff39e8100874d1689b185fd096c5669427d46624968b1de/analysis/1397236179/

REDIRECTS TO:

https://plus.google.com/110974622069636956786

https://www.virustotal.com/de/url/8531cbb1b6af2c6970bd60b52f6743675ebad460b5e273a5d7c53a6cdfad1140/analysis/

HTML

https://www.virustotal.com/de/file/d4fc3dd86dfcbc77b810d9d3a4a38e220614f2da7ca2ff0dc8f805c12c9e1923/analysis/1397234501/

about:blank

----> THEN

http://plus.google.com/_/scs/apps-static/_/js/k%3Doz.home.en_US.QOoKRaOs7Pc.O/m%3Db%2Cprc/am%3DAMAwAAAMhEEAAAAKFICQAFITAwAACg/rt%3Dj/d%3D1/z%3Dzcms/rs%3DAItRSTPetjrOyteDRh4NktQaFVRe9zAjug

https://www.virustotal.com/de/url/bfd1e5160e4365a55b606d76d7a4a33de780bf93219d77014ca1684e9183283e/analysis/1397236576/

SEE AS WELL:

http://wepawet.iseclab.org/view.php?hash=fb5bb51b955f9532e7935ffe16a76969&t=1397234005&type=js

OTHER MALICIOUS CONNECTIONS (LINKS) FOUND:

1.0

http://jntukukatpally.blogspot.in/

https://www.virustotal.com/de/url/9349507e2076ab173d1ee3edbd50ec32d042f3373b6960bf3481a9d8de742b35/analysis/

http://jntukukatpally.blogspot.com/

https://www.virustotal.com/de/url/4c8dbd6ec2caf73b58643c14e2f5cbcc9673613d9293edcd99388332950b8b30/analysis/1397238392/

jntukukatpally links (directly OR indirectly) to:

1.1

http://resources.infolinks.com/js/infolinks_main.js

https://www.virustotal.com/de/url/30af8cab0ff04044433949f965963f0d0773bedb554811a276512b174ef219cd/analysis/

https://www.virustotal.com/de/file/58b308392779bb9868090be24ba4c3e6880efcdc7df43d2e90547ce0b9e9b957/analysis/1397238583/

2.0

http://driver-lap.blogspot.com/

https://www.virustotal.com/de/url/8b47e821ad5a463f2bcfa83228b7df55b0d2e7b860923bddc7158f7b30c4cf3a/analysis/1397238344/

driver-lap links (directly OR indirectly) to:

2.1

http://resources.infolinks.com/js/infolinks_main.js

https://www.virustotal.com/de/url/30af8cab0ff04044433949f965963f0d0773bedb554811a276512b174ef219cd/analysis/

https://www.virustotal.com/de/file/58b308392779bb9868090be24ba4c3e6880efcdc7df43d2e90547ce0b9e9b957/analysis/1397238583/

UPDATE 3/05/2014:

Ams Patil Made the same Comment on: Comment Spammer From BLOGGER TO BLOGGER:
RRRRRROOOOOOOOOFFFFFFLLLLLLL:

SEE SCREENSHOT: LLLLLLLLLLLLOOOOOOOOOOLLLLLLLL

4/11/2014

NEW POTENTIALLY RISKWARE DETECTED:
Not-a-virus:PSWTool.Win32.PasswordCracker.wa
from securityxploded.com
(GooglePasswordKracker - PASSWORDSTEALER)

NEW POTENTIALLY RISKWARE DETECTED:
Google Password Kracker - PASSWORDSTEALER

not-a-virus:PSWTool.Win32.PasswordCracker.wa

http://securityxploded.com/download-file.php?id=1111

https://www.virustotal.com/de/url/d864fcc6532516ad11184ef1da7b9b213d425f73e2dc491cdc867d8f81a4cdd2/analysis/1397222761/

http://securityxploded.com/getfile_plus.php?id=1111

https://www.virustotal.com/de/url/fb11af6a71cfc251ce28311cb2ce4a9cd1b9d250466b43d8b69b40a6ec98f300/analysis/1397223150/

(GooglePasswordKracker.zip) PSWTool.Win32.PasswordCracker.wa

https://www.virustotal.com/de/file/ebdd3d63628348b6f1ff0dfcb48370197ce00fcbb085f1eb5741bb8ff9052be9/analysis/1397125092/

(Setup_GooglePasswordKracker.exe) PSWTool.Win32.PasswordCracker.wa

https://www.virustotal.com/de/file/64ecac6ab2468141e09c9c9be4eec68d4f7ed2ea0dd659ecc6d386846d82c5fa/analysis/1397222739/

WEPAWET: SUSPICIOUS

http://wepawet.iseclab.org/view.php?hash=38ed429cd0bfe567ae411d465eed1a1d&t=1397222866&type=js

http://zulu.zscaler.com/submission/show/b1d8169ade268f06de667c0595f507e6-1397223014

IP:

http://64.150.191.172/

https://www.virustotal.com/de/url/774ec0fe019369938cf734a511ae4334b74f31e5c0202710934e0997df8a6e7f/analysis/

NEW POTENTIALLY RISKWARE DETECTED:
Not-a-virus:PSWTool.Win32.PasswordCracker.ah
from securityxploded.com
(RouterPasswordKracker - PASSWORDSTEALER)

NEW POTENTIALLY RISKWARE DETECTED:
Router Password Kracker - PASSWORDSTEALER

not-a-virus:PSWTool.Win32.PasswordCracker.ah

http://securityxploded.com/download-file.php?id=1051

https://www.virustotal.com/de/url/50de12846436464e15f375b94cd40a4ada8548175ad0c62b3e8c60e3a45ae088/analysis/1397221413/

http://securityxploded.com/getfile_plus.php?id=1051

https://www.virustotal.com/de/url/ba45120dcf7b88f21e1d5a7033d71ead3434b682a0094a78f622590f6fee352d/analysis/1397221456/

(RouterPasswordKracker.zip) PSWTool.Win32.PasswordCracker.ah

https://www.virustotal.com/de/file/ba3437b5a48fd5427fb2275af78617a2ef90f6279d11dfc89959f5dd63ef09a9/analysis/

(Setup_RouterPasswordKracker.exe) PSWTool.Win32.PasswordCracker.an

https://www.virustotal.com/de/file/7471baaaa951f9539b6099e9a41025a30ae3004da3b2374187796fec236afa2c/analysis/1397221327/

WEPAWET: SUSPICIOUS

http://wepawet.iseclab.org/view.php?hash=ba09ba2dabd6b8d643c96c39377be0ce&t=1397221623&type=js

http://zulu.zscaler.com/submission/show/649a46f0bc29a0e9a0b0200883870201-1397221649

IP:

http://64.150.191.172/

https://www.virustotal.com/de/url/774ec0fe019369938cf734a511ae4334b74f31e5c0202710934e0997df8a6e7f/analysis/

PHISHING MAIL FROM:
safeukemailer.com & planosdesaudeagora.com
IP: 174.140.167.243 - DICTIONARY ATTACKER & SPAMSERVER
Heuristic.BehavesLike.JS.BufferOverflow.J

PHISHING MAIL FROM:

http://safeukemailer.com/

https://www.virustotal.com/de/url/7e6568720e2f0e44bfcb9d974823fc0d6bed744157a9e9b655c4f0ac5be96841/analysis/1397215692/

http://wepawet.iseclab.org/view.php?hash=99533e29222be52ac0aecd2104ced6ec&t=1397215185&type=js

REDIRECTS TO:

http://planosdesaudeagora.com/admin/index.php

https://www.virustotal.com/de/url/85b7433bf813cd4884a22a8f5f66a8481935be109e6e12066fad3f3ade37fe2f/analysis/1397215746/

HTML

https://www.virustotal.com/de/file/6ea7c43f2a8f0bc4b6d11931e3eaeb5fe8f085a5db9accf605424390a9e00e21/analysis/1394810790/

ALSO

http://planosdesaudeagora.com/admin/includes/js/javascript.js

https://www.virustotal.com/de/url/f8369cd305da7c812550ca69ecf82f857f4a2506bbd119b5217c57699ce19eac/analysis/1397216635/

Heuristic.BehavesLike.JS.BufferOverflow.J

https://www.virustotal.com/de/file/d8c5447067ec6b33acaa3701a50d1d75b985d4e933490b0d0ef81bfd4c7c606d/analysis/1378020397/

DOMAIN LISTED AT SURBL & JOEWEIN

http://www.urlvoid.com/scan/planosdesaudeagora.com/

https://www.mywot.com/en/scorecard/planosdesaudeagora.com

IP:

http://174.140.167.243/

https://www.virustotal.com/de/url/206033db51f7886c907adb9afc607982fbfab8d362ea78ec6e323a5d45cf167d/analysis/1397215940/

https://www.virustotal.com/de/ip-address/174.140.167.243/information/

DICTIONARY ATTACKER & SPAMSERVER:

https://www.projecthoneypot.org/ip_174.140.167.243

http://www.senderbase.org/lookup/?search_string=174.140.167.243

IP: 184.168.221.18 merchantcentric.com
German SPAM & PHISHING Domain
"Blacksher Hall: See what your competitors are doing right now"
(Through b2b-mail.net)

SPAM DOMAIN FROM GERMANY:

http://merchantcentric.com/

https://www.virustotal.com/de/url/2655175568ddab160a5f3a07cb4f6bb08eb47b5970460bd619de5d3dc1ad195e/analysis/1397212380/

THROUGH:

http://b2b-mail.net/

https://www.virustotal.com/de/url/a0bf735206b0ae297b5fc69b8bbc14d42c1449cf671e3f04db456c138c372871/analysis/1397212963/

https://www.mywot.com/en/scorecard/b2b-mail.net

Related Post:
http://stayaway2.blogspot.com/2014/04/blacksher-hall-learn-secrets-of-top.html

4/10/2014

Potentially MALICIOUS ADs:
bellroy.com (IP: 54.236.92.225)
risking with
HIDDEN Iframes (W32.HfsIframe)
and Microsoft Internet Explorer remote code execution via option element

FOR WEBMASTERS & BLOGGERS

If you own a Website or a Blog and are affiliated with Google AdSense, in order to your own Reputation, should block the Domain bellroy.com in your AdSense Dashboard. See the following Report why:

MALICIOUS ADVERTISER:
HIDDEN IFRAME(s) &
Microsoft Internet Explorer remote code execution via option element

DOMAIN:

http://bellroy.com/

https://www.virustotal.com/de/url/c98b0274361f078ffe11c672882a44deea265179edb5c6fa0602d63080855968/analysis/

W32.HfsIframe

https://www.virustotal.com/de/file/67b5a8555f0660f5cea968abbbe32c48a92b6c0cb1782c682a0bb7d35f2439cd/analysis/1397146549/

<--- iframe src="//www.googletagmanager.com/ns.html?id=GTM-MF9C"height="0" width="0" style="display:none;visibility:hidden" --->

AD-LINK:

http://www.googleadservices.com/pagead/aclk?sa=L&ai=CGfswyL9GU6j-NIuoiga4sYDQCouup8sGi_S0sYgBo5WpvzgQASCOwJQjUJeJzE5guwOgAd3f68sDyAECqQI_TRhS36CvPqgDAcgDwQSqBIsBT9BrjS7o2Hx01Y0JFiIuwvJ1xe9IjZ3AaQviQnug8Np1m1Lub00UCac2hzu_KqEdA3aCF6v0DESTEaRR-1SjYlNxE2mKIljXjfcmAgj4IJnE_mEbmdov7A_Top1ov2PE0Cm3JltzAOkli0GYOFPDLlmdDDZfXT2fFSIbEi-AgySr64NOLCIbYqODF4gGAaAGAoAHi6CUNA&num=1&cid=5GjrqWA5Hr9KASVQwZCWupTr&sig=AOD64_1_pgpU0nS6Jm4kbl0tCan3rcz2HA&client=ca-pub-5585202032329389&adurl=http://bellroy.com/wallets/note-sleeve-wallet&nm=2&mb=2&bg=!A0RJckn2eYHUnAIAAABGUgAAACcqAPHBZ1R_GZZ-qskVhAC1RCaSH8E7P1WWZC0O5x_RfOeSlUkxeJvIMszsmy3sXPqRsDlNy8wF68FONASqnu6VRxJ-s-NpHWsQ1GS7blV93HhI3unMwwLWf3jO_ggQ1uDpL5_XK5lofwEA5P2icYwOYX-diVH7uhcjdcVDH0WnnUDwsfalxoHuio6rkHLlVZEw0K_n8FBECRILAC_D7YNm3YixQnPoAup1vg7QEcYLoGraugw_6A2qJro2Z8bmpX0mbatP_HXSBMdhAiO9S4pffic21NrkmjGVx-d_c9TBhi1Tj4BMHIOEuAFJr7PX2F7yuuWu

https://www.virustotal.com/de/url/95f54e683c7aa90bcff2516c4203b1eab34ab0773398e57f1df39494d6bfa9da/analysis/1397146003/

W32.HfsIframe

https://www.virustotal.com/de/file/5a84faf5f6aca07d4390a9b5cfccc29512b29edb295113d7a6f81dd8c85e0028/analysis/1397146289/

<--- iframe src="//www.googletagmanager.com/ns.html?id=GTM-MF9C"height="0" width="0" style="display:none;visibility:hidden" --->
Microsoft Internet Explorer remote code execution via option element

https://urlquery.net/report.php?id=1397146071040

https://urlquery.net/report.php?id=1397146084651

--->

http://bellroy.com/wallets/note-sleeve-wallet?gclid=CJGghbqm1r0CFbFFMgodI1QA3w

https://www.virustotal.com/de/url/415b1b40a688e6db53001d576b04991a469967e8b17f5327f591942b0ec5b423/analysis/

W32.HfsIframe

https://www.virustotal.com/de/file/fbf1f3b0f36895ff64f2ed8270a6058d912395b6fe94a596b7f0e04381422a90/analysis/1397147003/

https://urlquery.net/report.php?id=1397146245634

https://urlquery.net/report.php?id=1397146261020

https://urlquery.net/report.php?id=1397146282006

IP:

http://54.236.92.225/

https://www.virustotal.com/de/url/17c875d298cbb4a685465b5dfbd5f3ae5097b78a8fa58184f224a872eec7d4f3/analysis/1397147591/

https://www.virustotal.com/de/ip-address/54.236.92.225/information/

HIDDEN LINK TO:

http://carryology.com/

https://www.virustotal.com/de/url/85e70248597bc714f3eac0644ff669c2680af8b6a50b23d34420e54e0f9bd902/analysis/1397147301/

NEW POTENTIALLY RISKWARE DETECTED:
Not-a-virus:PSWTool.Win32.PasswordCracker.an
from securityxploded.com
(WindowsPasswordKracker - PASSWORDSTEALER)

NEW POTENTIALLY RISKWARE DETECTED:
Windows Password Kracker - PASSWORDSTEALER

not-a-virus:PSWTool.Win32.PasswordCracker.an

http://securityxploded.com/download-file.php?id=1021

https://www.virustotal.com/de/url/cc5a4c406543221d1d71c5d0df18550fd5e09f8fef9800b7c28af880590a8d47/analysis/1397141402/

http://securityxploded.com/getfile_plus.php?id=1021

https://www.virustotal.com/de/url/426ea5d9ff85f30ab9d48664ab0e90b477d24bb39fc8fda483879057f3380fa1/analysis/1397141585/

(WindowsPasswordKracker.zip) PSWTool.Win32.PasswordCracker.an

https://www.virustotal.com/de/file/9dec4dc449b7f4fbc1d77419d202b22bc21c388d55d70a049af58f7938527b49/analysis/1397141499/

(Setup_WindowsPasswordKracker.exe) PSWTool.Win32.PasswordCracker.an

https://www.virustotal.com/de/file/6ca5b0c04a96caf1df32be15a26401773d6573f377c84efce1e16e23e13ee0e7/analysis/1397141534/

WEPAWET: SUSPICIOUS

http://wepawet.iseclab.org/view.php?hash=b951e8893d7019d984a89ab57e9300dc&t=1397141634&type=js

http://zulu.zscaler.com/submission/show/fa35f7d3fc94d4dd91cbee227bced416-1397141683

IP:

http://64.150.191.172/

https://www.virustotal.com/de/url/774ec0fe019369938cf734a511ae4334b74f31e5c0202710934e0997df8a6e7f/analysis/

4/09/2014

apps.michaelpriest.com.au
Potentially Suspicious/Malicious BLOGVISITOR with
Manipulated Executable Application on TOUR (A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider)

DOMAIN:

http://apps.michaelpriest.com.au/

https://www.virustotal.com/de/url/6ed7612be01bb6857f4c58180d754ce179543c18ee158c5da13721da9fc41993/analysis/1397077102/

VISITING URL:

http://apps.michaelpriest.com.au/MPPluginInstaller/setup.exe

https://www.virustotal.com/de/url/7383065de37bccf2367981da8b9925d60ca5e64872483b152392890e32dd2816/analysis/1397074594/

Manipulated Executable Application (POSSIBLY from MS):
A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider

https://www.virustotal.com/de/file/200dc3ffc7fed9f5151a4195f4bf2cbda14414b4afacea90f0d3098d80bb5547/analysis/

SEE ALSO:

https://urlquery.net/report.php?id=1397074602869

http://www.urlvoid.com/ip/103.247.224.141/

http://sitecheck2.sucuri.net/results/www.ashburtonfamilydental.com.au

https://www.virustotal.com/de/url/3a502336930e5ec0f405d5fbc929d68a8ea74cb979591113885cbdf881e7083e/analysis/1397077282/

http://www.senderbase.org/lookup/?search_string=103.247.224.141

NEW POTENTIALLY RISKWARE & PHISHING DETECTED:
Not-a-virus:PSWTool.Win32.Agent.vx
from securityxploded.com
(WindowsDriveHider - Passwordstealer)

NEW POTENTIALLY RISKWARE DETECTED:
Windows Drive Hider - Passwordstealer

not-a-virus:PSWTool.Win32.Agent.vx

http://securityxploded.com/download-file.php?id=1011

https://www.virustotal.com/de/url/f20fbbaa6dc5d1c58e9824b445cf35f506512dc5e1ed7ebbe8eea41ed498780c/analysis/1397069288/

http://securityxploded.com/getfile_plus.php?id=1011

https://www.virustotal.com/de/url/dca829bc0b33249a056eb8b6489e84e90e1b5fb8a40f608992141254658f2f6b/analysis/1397069330/

(WindowsDriveHider.zip) PSWTool.Win32.Agent.vx

https://www.virustotal.com/de/file/0ca33d4ebaef889b5b35e1f55dd4bb245930b4846bb125fd2755fb65369269ba/analysis/1397069354/

(SetupWindowsDriveHider.exe) PSWTool.Win32.Agent.vx

https://www.virustotal.com/de/file/ca65cde81006fda4c3f90ca0f2b8fbe0c5f8d5f06052f652ff33e68d07f06a07/analysis/1397069576/

(WindowsDriveHider.exe) PSWTool.Win32.Agent.vx

https://www.virustotal.com/de/file/df7d22e0a4bc4f2674c8be7ba8b7b9c415851dc120dd421508d8a3191f473177/analysis/1397069541/

WEPAWET: Suspicious

http://wepawet.iseclab.org/view.php?hash=75ae03c5152f116b12977a062e146979&t=1397069846&type=js

http://zulu.zscaler.com/submission/show/22a63c3e6ed00b1be52a58ba2d0a8d70-1397069633

IP:

http://64.150.191.172/

https://www.virustotal.com/de/url/774ec0fe019369938cf734a511ae4334b74f31e5c0202710934e0997df8a6e7f/analysis/

SUPPLEMENTARY OTHER LINK FOUND ON PAGE (PUA.PHISHING.BANK):

http://nagareshwar.securityxploded.com/2013/09/16/seh-exploitation-to-get-shell-access/index.html

https://www.virustotal.com/de/url/b8e3193f581b32f9c3ef4af6c58ae4a94d0783162f8cf49774d3111d3e1581a7/analysis/1397070689/

HTML-PUA.PHISHING.BANK

https://www.virustotal.com/de/file/c8e6a6d9ef6c9178db84fc7614f2d168856d36e44c78f5b68284f5874e8b7176/analysis/1397070794/

http://virusscan.jotti.org/de/scanresult/d50831e4520e9bd7863cd71fabe24462a193fe6e

NEW POTENTIALLY RISKWARE DETECTED:
Not-a-virus:PSWTool.Win32.Agent.vs
from securityxploded.com
(SecurePasswordGenerator.exe - Passwordstealer)

NEW POTENTIALLY RISKWARE DETECTED:
Secure Password Generator.exe - Passwordstealer

not-a-virus:PSWTool.Win32.Agent.vs

http://securityxploded.com/download-file.php?id=1001

https://www.virustotal.com/de/url/7324056a65a45256f21a3a2ee7f726744fd633a16f5652cedf1207bcf247cf20/analysis/

http://securityxploded.com/getfile_plus.php?id=1001

https://www.virustotal.com/de/url/1856e6f51ffc018dc74e5dc7a79a945c6d2309eecedd4ebe49dae7fec42ad735/analysis/

(ZIP) PSWTool.Win32.Agent.vs

https://www.virustotal.com/de/file/0d18d235271859bff3dff8356b4570dcbb9933b94d6c6dd57715b8602675f4aa/analysis/1396777216/

(EXE SETUP) PSWTool.Win32.Agent.vs

https://www.virustotal.com/de/file/b9224e67ff7c69df803e132298174fdec88e0bd44f6c758fc6e3aef985f91002/analysis/1396777476/

(EXE FILE) PSWTool.Win32.Agent.vs

https://www.virustotal.com/de/file/db2f38542a5c0526cbf4906974aadfd2c20d658ea031d19031b17e14a31ed03b/analysis/1396777454/

WEPAWET: SUSPICIOUS

http://wepawet.iseclab.org/view.php?hash=c8b48449e807664acd6562d5c9d92b6f&t=1397066560&type=js

IP:

http://64.150.191.172/

https://www.virustotal.com/de/url/774ec0fe019369938cf734a511ae4334b74f31e5c0202710934e0997df8a6e7f/analysis/

NEW POTENTIALLY RISKWARE DETECTED:
Not-a-virus:RiskTool.Win32.Agent.dbq
from securityxploded.com
(SetupPasswordSnifferConsole.exe)

NEW POTENTIALLY RISKWARE DETECTED: Setup Password Sniffer Console

not-a-virus:RiskTool.Win32.Agent.dbq

http://securityxploded.com/getfile_plus.php?id=1155

https://www.virustotal.com/de/url/ca5cce1c0eadc8893c81f1fcacee8938dc0734cfb89485ade0bba02597848795/analysis/1397053044/

(ZIP) RiskTool.Win32.Agent.dbq

https://www.virustotal.com/de/file/7694d475fbca9d827bdbe8e5075e6fb5258c07cf82b07ec8b16c9f13fd91029b/analysis/1397052774/

(EXE) RiskTool.Win32.Agent.dbq

https://www.virustotal.com/de/file/4806ab9294ff991d07156374a85c1153ce319c9c7312f649213ecd685c4f571b/analysis/1397052734/

IP:

http://64.150.191.172/

https://www.virustotal.com/de/url/774ec0fe019369938cf734a511ae4334b74f31e5c0202710934e0997df8a6e7f/analysis/1397059586/

4/08/2014

Potentially MALICIOUS ADVERTISER:
Heuristic.LooksLike.HTML.Suspicious-URL.K @
gaastraproshop.com (m.gaastraproshop.com)
IP: 65.52.130.250 UNITED STATES

FOR WEBMASTERS & BLOGGERS

If you own a Website or a Blog and are affiliated with Google AdSense, in order to your own Reputation, should block the Domain gaastraproshop.com (m.gaastraproshop.com) in your AdSense Dashboard. The Site is potentially Blacklisted. See the following Report:

POTENTIALLY MALICIOUS ADVERTISING DOMAIN:
Heuristic.LooksLike.HTML.Suspicious-URL.K & HIDDEN IFRAMES

DOMAIN:

http://www.gaastraproshop.com/

https://www.virustotal.com/de/url/8fe4129403e2f8a3329f8e8c2c030a8e071aa0ca416e83db22bbf2647a9b9354/analysis/1396956156/

HTML (before REDIRECTION) Heuristic.LooksLike.HTML.Suspicious-URL.K

https://www.virustotal.com/de/file/bd2bbbc521c2ef59397a0d0094451a2f1c978c88ee3f408a796071a58a733476/analysis/1396956097/

HTML (after REDIRECTION TO: http://m.gaastraproshop.com/ )

https://www.virustotal.com/de/url/9b672b89952372844701c6eaee854ac53baed519cf854c2d76f7027e8509ac46/analysis/1396956311/

https://www.virustotal.com/de/file/5a7ac6c9a4573c03f9d3b78278854f8eeb77300b41013769849f9593b61cdc10/analysis/

AD-LINK:

http://www.googleadservices.com/pagead/aclk?sa=L&ai=C9_qImM1DU5zaMMyR7ga_pIGgD-7TzuYDzuLHuJsBwI23ARABII7AlCNQuuWsjQNguwOgAczZxPUDyAECqQJouv3HAA-3PqgDAcgDwQSqBK0BT9BVRjDmVncwPOaYlYqDgq5ewlrE62ZKg0EI3bGzSTS2RY4AcjI1uPQNsHaT4rugdrGcIj5NrDkcP7WvV3x2WuALeS2pfl45Vy5x8WsjjQJyAGpQLLToRLzbxcQM41r1VIRWE8sXrd471wq5qDA1D1yV2v7JUSCrkTyQapMs3-HduhxiXs_1faUi_uZDXGoSpta2LFNFHiVzbqL7spmvDb14LM8BdBc3Ht1CYHmIBgGgBgKAB5ymuwo&num=1&cid=5Ghek0AXvKdmiT_PaZgyrXhR&sig=AOD64_1HNWVDpsJ2tiouym8BUaG8D7D4nw&client=ca-pub-5585202032329389&adurl=http://www.gaastraproshop.com/com-en/&nm=3&mb=2&bg=!A0QdcMC5dYUeWQIAAAA5UgAAACwqAOEto0uFWoyzbF9BgLpTZd0j0HlH_C56hY4NLvc3NtowaaH-Z-csGgTuThLZ2700ImAxJCtXBWy07lw2lhyW729LbQpRbKOUhBOCgNPTzNU7gGGfUbNk7f1Es-R1OT2rxWGFmICxmADsYZbJkCp3x90QW9x_krZl8PbIDV5TojB9Z4tmta85i7Np_800PxgiPJJfwWvSEdIldac4iEnohF9kF7b9tuMjUDC-jxzvmThXXObWG5HuPVidMyu5kw1D6sjILopgRn4ifnP6aV0gn8heXTWUH6sXVSlhTfbA-94Jv2Y

https://www.virustotal.com/de/url/62eb0a95606957e05b738baee9c886cb70a5e34c5e23659bbf4d96dc14ca3df1/analysis/1396955224/

(HTML-SRC) Heuristic.LooksLike.HTML.Suspicious-URL.K

https://www.virustotal.com/de/file/567b8090d9678ab59051c8039a8ee4db6219e30ddc833fc417e74ce75d051dd1/analysis/1396955699/

URL AFTER REDIRECT:

http://www.gaastraproshop.com/com-en/?gclid=COiest_f0L0CFeY-MgodzxsAfw

https://www.virustotal.com/de/url/8e9706ee82cfd4bafcde4bb245ce1dd2798c2e1bb7d35e914015246b70eb1f1c/analysis/

(HTML-SRC) Heuristic.LooksLike.HTML.Suspicious-URL.K

https://www.virustotal.com/de/file/476be34d21b40a8ebc9eedf9bfd0b59a671735cac2517af1e007cdabf9860d80/analysis/1396955811/

IP:

http://65.52.130.250/

https://www.virustotal.com/de/url/153ecf2fa49f6cfa49c849cdadf0abea1ca0d4ea9d299e1ce04c837d83c498ad/analysis/1396957138/

Category MALICIOUS IP:
5.135.188.193 (kimsufi.com)
COMMENT SPAMMER from (Roubaix, FRANCE)

CATEGORY MALICIOUS IP:
COMMENT SPAMMER
LISTED AT TORNEVALL

FOUND ON EXPLOIT KIT STATISTIC ROUNDUP:
Host - Pages - Hits - Bandwidth - Last visit date - [Start date of last visit] - [Last page of last visit] 5.135.188.193 - 16 - 16 - 5839847 20140115134221

HOST:

http://5.135.188.193/ (Roubaix, FRANCE)

https://www.virustotal.com/de/url/ad6cf5b5cc0ac88abe48f641f12ebb0bad4d7bf1d40e15af5f0383471eede4de/analysis/1396905319/

HOSTNAME: (Registered February 15th 2001)

http://ks3294570.kimsufi.com/

https://www.virustotal.com/de/url/9e0bfb2602bc25eb416989ffd0cb78bb0e35108f06b6dd5fe4acc5604718cf3e/analysis/1396907424/

WEPAWET: NON-EXISTING DOMAIN

http://wepawet.iseclab.org/view.php?hash=fb0cdf5e77cfec395b4db8bf802df86d&t=1396905343&type=js

DOMAIN: (IP: CANADA)

http://kimsufi.com/

https://www.virustotal.com/de/url/b2957ee6fe072c26c66415b45c22062fa9319dcd11a935ccc6808ddf8d88c4f1/analysis/

IP: 213.186.33.80 (FRANCE)

https://www.virustotal.com/de/url/bf71c3ee663f088661ee99420e310491c614b03b26557c771d040669e9cfe8e8/analysis/

https://www.virustotal.com/de/ip-address/213.186.33.80/information/

http://toolbar.netcraft.com/site_report?url=213.186.33.80

REDIRECTS TO:

http://www.kimsufi.com/

https://www.virustotal.com/de/url/70a198d280f8e42e13903be64df4dbebf292ed8f3ff5d58360ee0af9f1ea9ae3/analysis/1396908942/

IP (CHANGE): 198.27.92.3 (Montréal, CANADA)

https://www.virustotal.com/de/url/9e2487ef003597430ea9b8bf016675f1fb4501d516ab468212099b57ad707c87/analysis/1396909634/

REDIRECTS TO:

http://www.kimsufi.com/fr/index.xml

https://www.virustotal.com/de/url/69f5933404d7b76ef3e0d002add1516e622d015ddacf4cfeda5803f73673424d/analysis/1396909006/

REDIRECTS TO:

http://www.kimsufi.com/fr/

https://www.virustotal.com/de/url/30f30cae7dc114a98734d84bf5eb806a0932e6767c17e05b5f767ef4a5e3cbb3/analysis/1396909110/

https://www.virustotal.com/de/file/11114b722dd11cc71086f1d47fcb36ca7b2b5fce27413ecb8d3da00a70fc336d/analysis/1396909603/

https://www.virustotal.com/de/url/9e2487ef003597430ea9b8bf016675f1fb4501d516ab468212099b57ad707c87/analysis/1396909634/

--------------------------------------------------------------------------------------------------------------------------------------------

LISTED AT TORNEVALL:

http://dnsbl.tornevall.org/ (http://www.ipvoid.com/scan/5.135.188.193)

User-Agents: 30
Web post submissions: 52

https://www.projecthoneypot.org/ip_5.135.188.193

Netcraft Risk Rating: 9/10

http://toolbar.netcraft.com/site_report?url=5.135.188.193

ALSO:

http://www.stopforumspam.com/ipcheck/5.135.188.193

4/07/2014

POTENTIALLY SUSPICIOUS Advertiser:
Several HIDDEN IFRAME(s) @ www.studyinteractive.org
(IP: 94.236.98.164) W32.HfsIframe
London, UNITED KINGDOM

FOR WEBMASTERS & BLOGGERS

If you own a Website or a Blog and are affiliated with Google AdSense, in order to your own Reputation, should block the Domain www.studyinteractive.org in your AdSense Dashboard as the Site has several hidden Iframes (See Screenshots below). See the following Report:

SUSPICIOUS ADvertiser:
HIDDEN IFRAMES & LINK TO MW DOMAIN

DOMAIN:

http://www.studyinteractive.org/

https://www.virustotal.com/de/url/f3d49c88f67e594a5e2790d6b04c04386bba772e06b5bdcd610274e6dec7ad78/analysis/1396890659/

W32.HfsIframe

https://www.virustotal.com/de/file/b3057590ae1f538dae28ef2eddd5b949129640e22e8c7c84afa40e1c552a5fe0/analysis/1396890736/

<--- iframe src="//www.googletagmanager.com/ns.html?id=GTM-5BZNPB"height="0" width="0" style="display:none;visibility:hidden" --->

IP:

http://94.236.98.164/

https://www.virustotal.com/de/url/ddf767ca33c02f03d89c48d06d684ebfc9fd7b70d8a44a6bad3660bba2f84648/analysis/1396892016/

SPECIFIC AD-LINK:

http://www.googleadservices.com/pagead/aclk?sa=L&ai=C1Ka8_MxCU_6pOsvr7QapvoCYCJX4hcsEndDjp4QBwI23ARABII7AlCNQ6eatif______AWC7A6AB8_Da0wPIAQGpAsaE3dbr1Ls-qAMByAPDBKoEsQFP0HE28GLR59i93_uQP7nr9q4E30h6pDFBgQJbzqpCJJQQ0aDe7YvxTlGaY9pzRs8vyF1nEHdo1tEAxFx16XC4-Lgl4-fxn3hJKR0igEeXfXlRVNkv56ddmN1ZG2RsPQg-YbbQmHKkGucDnGRdtwT4iKZTWEojzb85nYybniV-WkEGRp3JQBIRR-2hTseS9CIQGQrcwP7Cz99h34GT4pyQhlUfpQWsZ4rjvxjYqb7COXOIBgGAB_WOpSw&num=1&cid=5Gj_mwym0n6HSEiehmL18tKY&sig=AOD64_3BPMMDRbXyPW9Agp98BUEmTc_g0g&client=ca-pub-5585202032329389&adurl=http://www.studyinteractive.org/online-msc-degree2/%3Futm_source%3Dgoogle%26utm_medium%3Dcpc%26utm_campaign%3Dmsc-marketing-luxembourg-display-text&nm=10&mb=2&bg=!A0SiEbXxXfeE9QIAAABCUgAAABgqAOHJi1VYTcVszlW_XQUl16Q6RwLTV7-FnDAWCTMg7ixb-JsMj7_eP2TWBvsEjUNKn4TAMGA73MqGBwJ-w_73TLtBVo1E34m53HRZVDIFE0NQxJMKmmppdH6t3vG98-ot5NeBXD8SYUWjnS2VBK-zrqrmBfuwIxkIZvx0tvJddgQvoUdsHU6vdaRpgM7loHmZ70FOefIOOYqyz91P4jYaNIZ0otKMJdBbH1YsWRa3FQVuV3i-wQm6wp4RTQdW--qo2tCemW5HIh8nQ-TFOMZSe9RB4WL1uT4_vGbX3zhqpvnBjiM

https://www.virustotal.com/de/url/1d73c6f82f71c6f97a917a117f66581a541f0465632350adf6c0b8327ec6baeb/analysis/1396889946/

W32.HfsIframe

https://www.virustotal.com/de/file/93003317e07e1338c35800a3c63ef637fa64acb8786e3f5e5d2bdb062a8f5129/analysis/1396890437/

<--- iframe src="//www.googletagmanager.com/ns.html?id=GTM-5BZNPB"height="0" width="0" style="display:none;visibility:hidden" --->

URL AFTER REDIRECT:

http://www.studyinteractive.org/online-msc-degree2/?utm_source=google&utm_medium=cpc&utm_campaign=msc-marketing-luxembourg-display-text&gclid=CMGByMjszr0CFfFFMgodcxsAeQ

https://www.virustotal.com/de/url/1ab400460a40eb42b654e42f30b0173a413331e158774d4746cbddb6c1205d53/analysis/

W32.HfsIframe

https://www.virustotal.com/de/file/93003317e07e1338c35800a3c63ef637fa64acb8786e3f5e5d2bdb062a8f5129/analysis/

<--- iframe src="//www.googletagmanager.com/ns.html?id=GTM-5BZNPB"height="0" width="0" style="display:none;visibility:hidden" --->

SEVERAL MORE HIDDEN IFRAMES DETECTED:

Screenshot 1

Screenshot 2

Screenshot 3

Screenshot 4

OTHER SUSPICIOUS LINK FOUND:

DOMAIN:

http://lsbfafg.com/

https://www.virustotal.com/de/url/b6f887a3a71940ddb1be80e110d2a44974e1140a009baaf392e745afba19a61a/analysis/1396891366/

http://lsbfafg.com/getform.js

https://www.virustotal.com/de/url/b6f887a3a71940ddb1be80e110d2a44974e1140a009baaf392e745afba19a61a/analysis/

http://lsbfafg.com/getform.js?id=12600

https://www.virustotal.com/de/url/9455bddead54d9bb28c3deba78ec01923cec20ad9172b6628a38592cea3a4d33/analysis/1396891806/

Translate

4/12/2014

4/11/2014

4/10/2014

4/09/2014

4/08/2014

4/07/2014