During the course of investigating an open incident ticket with a customer, we uncovered what is a common occurrence on the web - legitimate sites linking in third-party content (often advertisements or banners) that ultimately drives the victim browser to an exploit kit.
- User browsed to: www.thenewsvault.com
- The site included content from: www.tvshark.com/read/?art=arc8755
- Which included content from: www.tvshark.com/abritebtm300.html
- Which linked in what appears to be an advertisement iframe: ads-svx.httpads.com/adserver/cached_iframe?guid=16ce4035-ded0-49c8-8515-8e234cbb2b8b
- That loaded the "advertisement" rotator from: c1.zxxds.net, which includes a number of pages, the main one being: /jsc/c1/ff2.html?n=1721;c=3;s=4;d=9;w=300;h=250. Some online references show c1.zxxds.net as having a poor reputation, including involvement with adware.
- The c1.zxxds.net site then loaded: chgdjk.info/nw87b6rh/counter.php?id=5 and a number of other pages on this domain which are allegedly exploit kit driven.
- From the response size in the logs, we can see that the exploit kit payload page was: chgdjk.info/nw87b6rh/?11ecfa793c76017554490058535a0301030355535d5555090a05035456510f0a00;1;10
Registrant Name:Filippovskiy Aleksandr
Registrant Street1:ylica Baymana. dom 9.korpys A. kvartira 106
Registrant City:yoshkar ola
Registrant State/Province:yoshkar ola
Registrant Postal Code:42400
Registrant Phone Ext.:
Registrant FAX Ext.:
DomainTools shows that there have been about 1200 domains registered with this whois information (e.g., search by phone number). We're now seeing 220.127.116.11 used for resolution of the chgdjk.info domain (part of a Black Lotus Communications /24 netblock). Clearly a decent-sized and dynamic malware campaign currently leveraging malvertising to redirect to exploit kit sites.