Sunday, April 27, 2008 6:32 PM
sandi
p-mediaonline.com - exercise caution if dealing with them....
Earlier I posted an alert that ReachWe (reachwe.com) has been caught distributing malvertizements.
Kimberley has written about another advertising service that shares IP with reachwe.com - P-mediaonline.com - discussed here:
http://www.bluetack.co.uk/forums/index.php?showtopic=18064&pid=87048&mode=threaded&show=&st=30&#entry87048
reachwe.com and p-mediaonline.com have the same Flash navigation on the opening pages.
P-mediaonline.com was created on 4 April 2008; reachwe.com was created on 6 December 2007.
And, to add to the "yuck" factor, Kimberly uncovers another domain that uses the same contact email address in its WHOIS details as ReachWe - the domain has the charming name of ***-juice.net and yes, it too has a sample of the SWF used by reachwe.com and P-mediaonline.com, albeit with a lot of placeholder text, at ***-juice.net/base.swf:
http://www.bluetack.co.uk/forums/index.php?showtopic=18064&pid=87056&mode=threaded&show=&st=30&#entry87056
reachwe.com;s "Administrative Contact": Martin, Sten smith.realty@yahoo.com
***-juice.net uses: Rudenkov, Pavel smith.realty@yahoo.com
Screenshots of ***-juice.net/base.swf - note the details in the Contact Us pane and the URL in the address bar:
Filed under: Security, safety and privacy on the Internet, Vulnerabilities, viruses and exploits