During the course of investigating an open incident ticket with a customer, we uncovered what is a common occurrence on the web - legitimate sites linking in third-party content (often advertisements or banners) that ultimately drives the victim browser to an exploit kit.
- User browsed to: www.thenewsvault.com
- The site included content from: www.tvshark.com/read/?art=arc8755
- Which included content from: www.tvshark.com/abritebtm300.html
- Which linked in what appears to be an advertisement iframe: ads-svx.httpads.com/adserver/cached_iframe?guid=16ce4035-ded0-49c8-8515-8e234cbb2b8b
- That loaded the "advertisement" rotator from: c1.zxxds.net, which includes a number of pages, the main one being: /jsc/c1/ff2.html?n=1721;c=3;s=4;d=9;w=300;h=250. Some online references show c1.zxxds.net as having a poor reputation, including involvement with adware.
- The c1.zxxds.net site then loaded: chgdjk.info/nw87b6rh/counter.php?id=5 and a number of other pages on this domain which are allegedly exploit kit driven.
- From the response size in the logs, we can see that the exploit kit payload page was: chgdjk.info/nw87b6rh/?11ecfa793c76017554490058535a0301030355535d5555090a05035456510f0a00;1;10
| Domain | Registrant Email |
|---|---|
| behtyg.info | [email protected] |
| beokjr.info | [email protected] |
| bikegf.info | [email protected] |
| byjeik.info | [email protected] |
| cehrty.info | [email protected] |
| cekioj.info | [email protected] |
| cekuij.info | [email protected] |
| chertyu.info | [email protected] |
| chgdjk.info | [email protected] |
| chtygf.info | [email protected] |
| cmuijy.info | [email protected] |
| dgeryt.info | [email protected] |
| ggtyut.info | [email protected] |
| nehuikj.info | [email protected] |
| nuekhg.info | [email protected] |
| vejuyt.info | [email protected] |
| zehryu.info | [email protected] |
Registrant Information:
Registrant Name:Filippovskiy Aleksandr
Registrant Organization:DOM
Registrant Street1:ylica Baymana. dom 9.korpys A. kvartira 106
Registrant Street2:
Registrant Street3:
Registrant City:yoshkar ola
Registrant State/Province:yoshkar ola
Registrant Postal Code:42400
Registrant Country:RU
Registrant Phone:+7.79276827596
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
DomainTools shows that there have been about 1200 domains registered with this whois information (e.g., search by phone number). We're now seeing 199.59.166.86 used for resolution of the chgdjk.info domain (part of a Black Lotus Communications /24 netblock). Clearly a decent-sized and dynamic malware campaign currently leveraging malvertising to redirect to exploit kit sites.
