MalwareAlarm again.. this time it's www.ok-magazine.com
This afternoon, let's have a look at the hijack that is affecting www.ok-magazine.com, right on the front page.
The dangerous SWF is hosted by r2d2advertising:
From there we're dragged through to newbieadguide.com:
We then bound over to blessedads:
And end at, you guessed it, scanner2.malware-scan.com:
I am sure, gentle reader, that you will recognise blessedads and prevedmarketing from the incident that hit whitepages.com.au over the past 24 hours or so.
Screenshots follow of the malicious advertisement itself, a shot of the advertisement in-situ at www.ok-magazine.com and a screenshot of an unrefutable packet capture. Of course, the appropriate authorities are welcome to a copy of the data.
The advertisement in-situ at www.ok-magazine.com
The proof that the advertisement is malicious...