ALERT: new malvertizement protocols, courtesy of Kimberley
As always, Kimberley's report makes for fascinating reading:
http://www.bluetack.co.uk/forums/index.php?s=&showtopic=18064&view=findpost&p=88026
What is especially interesting is that the advertisement in question that started the whole thing was NOT a SWF - it was a GIF - hosted by 247mediadirect.com. The end target, a malicious SWF, is hosted at the same IP.
Hosted (again) in Malaysia, a Robtex search reveals many connections between 247mediadirect.com and known malvertizement domains:
Hostnames sharing IP with A-Records
ns1.aboutstat.com | ns1.adlbrite.com | ns1.akamahi.net | ns1.entrerrenglonadura.com | ns1.googiesindication.com | ns1.newstat.net | ns1.officialstat.com | ns1.quinquecahue.com | ns1.stat-diagnostic-imaging.net | ns1.statetstr.com | ns1.stathisranch.net | ns1.stathome.net | ns1.staticglobalsources.com | ns1.staticglobalsources.net | ns1.station-appraisals.com | ns1.station-appraisals.net | ns1.statnation.net | ns1.statsla.net | ns1.statworld.net | ns1.thetechnorati.com | ns1.vozemiliogaranon.com
Domains using this as nameserver
aboutstat.com | adlbrite.com | akamahi.net | entrerrenglonadura.com | googiesindication.com | newstat.net | officialstat.com | quinquecahue.com | stat-diagnostic-imaging.net | statetstr.com | stathisranch.net | stathome.net | staticglobalsources.com | staticglobalsources.net | station-appraisals.com | station-appraisals.net | statnation.net | statsla.net | statworld.net | thetechnorati.com | vozemiliogaranon.com
WHOIS:
Registrant: Media Hosting Ltd. 32 Jacka Blvd St Kilda VIC, Melbourne 3182 AU +61-03-9534-52830
Domain Name: 247MEDIADIRECT.COM
Administrative Contact: Pearson, Ross rpearson79@yahoo.com 32 Jacka Blvd St Kilda VIC, Melbourne 3182 AU +61-03-9534-52830
Technical Contact: Pearson, Ross rpearson79@yahoo.com 32 Jacka Blvd St Kilda VIC, Melbourne 3182 AU +61-03-9534-52830
247mediadirect.com was created on 18 May 2008.
The WHOIS information looks legitimate, BUT, the phone number has one too many digits for Melbourne (or the whole of Australia for that matter), and as far as I can tell there is no such company as Media Hosting Ltd - and the address is a parking area close to the ocean.
The building that you see in the picture is "Donovans", a restaurant:
BTW, we have seen 247mediadirect.com before (back in January):
http://www.bluetack.co.uk/forums/lofiversion/index.php/t18306.html