Concerned about recent PAN-OS and other firewall/VPN CVEs? Take advantage of Zscaler’s special offer today

Zscaler Blog

Get the latest Zscaler blog updates in your inbox

Security Research

Anatomy Of An On-going Malvertising Campaign

March 13, 2012 - 3 min read

ImageDuring the course of investigating an open incident ticket with a customer, we uncovered what is a common occurrence on the web - legitimate sites linking in third-party content (often advertisements or banners) that ultimately drives the victim browser to an exploit kit.

Here is the chain of events that we observed:
  1. User browsed to:
  2. The site included content from:
  3. Which included content from:
  4. Which linked in what appears to be an advertisement iframe:
  5. That loaded the "advertisement" rotator from:, which includes a number of pages, the main one being: /jsc/c1/ff2.html?n=1721;c=3;s=4;d=9;w=300;h=250. Some online references show as having a poor reputation, including involvement with adware.
  6. The site then loaded: and a number of other pages on this domain which are allegedly exploit kit driven.
  7. From the response size in the logs, we can see that the exploit kit payload page was:;1;10
At the time of the transactions, resolved to Doing some Google searching, we found that the site linked in content (probably in the same way) to an exploit kit hosted on ( - the same IP, reported March 12, 2012.
Looking up other domains that resolved to this same IP shows an interesting history of this recent, on-going campaign. These are some of the domains that resolved to this IP - most/all registered within the last few days, all have the same registrant info, but the emails vary (presumably to get around bulk registration checks):
DomainRegistrant Email

Registrant Information:
Registrant Name:Filippovskiy Aleksandr
Registrant Organization:DOM
Registrant Street1:ylica Baymana. dom 9.korpys A. kvartira 106
Registrant Street2:
Registrant Street3:
Registrant City:yoshkar ola
Registrant State/Province:yoshkar ola
Registrant Postal Code:42400
Registrant Country:RU
Registrant Phone:+7.79276827596
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:

DomainTools shows that there have been about 1200 domains registered with this whois information (e.g., search by phone number). We're now seeing used for resolution of the domain (part of a Black Lotus Communications /24 netblock). Clearly a decent-sized and dynamic malware campaign currently leveraging malvertising to redirect to exploit kit sites.

Unfortunately our replay attempts have been unsuccessful at pulling down the malware content- to include using forged headers (such as user-agent and referrer) as well as beginning from the initial transaction chain. This is a common problem when analyzing malvertising incidents - since the malware is injected as part of an advertisement rotator site, it is difficult to replay as the advertisements and key variables used to drive the advertisement (in this case malware) may change. We will update if there are additional details.
form submtited
Thank you for reading

Was this post useful?

dots pattern

Get the latest Zscaler blog updates in your inbox

By submitting the form, you are agreeing to our privacy policy.