ALERT: new malvertizement protocols, courtesy of Kimberley
As always, Kimberley's report makes for fascinating reading:
What is especially interesting is that the advertisement in question that started the whole thing was NOT a SWF - it was a GIF - hosted by 247mediadirect.com. The end target, a malicious SWF, is hosted at the same IP.
Hosted (again) in Malaysia, a Robtex search reveals many connections between 247mediadirect.com and known malvertizement domains:
Hostnames sharing IP with A-Records
ns1.aboutstat.com | ns1.adlbrite.com | ns1.akamahi.net | ns1.entrerrenglonadura.com | ns1.googiesindication.com | ns1.newstat.net | ns1.officialstat.com | ns1.quinquecahue.com | ns1.stat-diagnostic-imaging.net | ns1.statetstr.com | ns1.stathisranch.net | ns1.stathome.net | ns1.staticglobalsources.com | ns1.staticglobalsources.net | ns1.station-appraisals.com | ns1.station-appraisals.net | ns1.statnation.net | ns1.statsla.net | ns1.statworld.net | ns1.thetechnorati.com | ns1.vozemiliogaranon.com
Domains using this as nameserver
aboutstat.com | adlbrite.com | akamahi.net | entrerrenglonadura.com | googiesindication.com | newstat.net | officialstat.com | quinquecahue.com | stat-diagnostic-imaging.net | statetstr.com | stathisranch.net | stathome.net | staticglobalsources.com | staticglobalsources.net | station-appraisals.com | station-appraisals.net | statnation.net | statsla.net | statworld.net | thetechnorati.com | vozemiliogaranon.com
Registrant: Media Hosting Ltd. 32 Jacka Blvd St Kilda VIC, Melbourne 3182 AU +61-03-9534-52830
Domain Name: 247MEDIADIRECT.COM
Administrative Contact: Pearson, Ross firstname.lastname@example.org 32 Jacka Blvd St Kilda VIC, Melbourne 3182 AU +61-03-9534-52830
Technical Contact: Pearson, Ross email@example.com 32 Jacka Blvd St Kilda VIC, Melbourne 3182 AU +61-03-9534-52830
247mediadirect.com was created on 18 May 2008.
The WHOIS information looks legitimate, BUT, the phone number has one too many digits for Melbourne (or the whole of Australia for that matter), and as far as I can tell there is no such company as Media Hosting Ltd - and the address is a parking area close to the ocean.
The building that you see in the picture is "Donovans", a restaurant:
BTW, we have seen 247mediadirect.com before (back in January):