A malicious ad running on BoingBoing.net is delivering visitors to a PDF exploit.
Given the complicated state of advertising arbitrage, it is unlikely that BoingBoing.net have much control over it. The ad appears to be loading in from ad.yieldmanager.com (which is Yahoo!) and/or ad.z5x.net (DSNR Media Group) both of which are hosted on the same multihomed IP addresses.
The ad itself (pictured) appears to be some sort of get-rich-quick scheme or other.
This ad then directs through ads.bootcampmedia.com/servlet/ajrotator/790744/0/vh?z=BootCamp&dim=335848 to traffic.firedogred.com/content?campaign=1219131&sz=2 (this combination of bootcampmedia.com and firedogred.com has been noted before)
The ad then hops to deliver.amerchibchapowered.com/rotate?m=5;b=2;c=1;z=243826 then content.baalcootymalachi.com/track/3388182/S_SE?[snip] loading an image from img.amerchibchapowered.com along the way.
Finally, the visitor is directed to chohivyb.info/cgi-bin/aer/[snip] which contains an exploit detected as Troj/PDFJs-GI by Sophos.
"Boot Camp Media" is run by a guy called Jamie Dalgetty of Guelph, Ontario in Canada. It's unlikely that he's a bad guy, more likely that his ad network is being exploited by a malcious third party.
traffic.firedogred.com is rather more interesting, multihomed on 69.164.215.204, 69.164.215.205, 69.164.215.207, 69.164.215.208 and 69.164.215.210 at Linode, New Jersey. The domain firedogred.com is slightly interesting:
Registrant:trafficbuyer@gmail.com has been used for these malicious domains for some months and is well known.
Domain Owner
15156 SW 5th
Scottsdale, Arizona 85260
United States
Registered through: GoDaddy.com, Inc. (http://www.godaddy.com)
Domain Name: FIREDOGRED.COM
Created on: 15-Sep-09
Expires on: 15-Sep-10
Last Updated on: 15-Sep-09
Administrative Contact:
Owner, Domain trafficbuyer@gmail.com
15156 SW 5th
Scottsdale, Arizona 85260
United States
(800) 555-1212 Fax --
Technical Contact:
Owner, Domain trafficbuyer@gmail.com
15156 SW 5th
Scottsdale, Arizona 85260
United States
(800) 555-1212 Fax --
Domain servers in listed order:
NS57.DOMAINCONTROL.COM
NS58.DOMAINCONTROL.COM
deliver.amerchibchapowered.com is also multihomed at Linode on 74.207.232.250, 74.207.232.25, 74.207.232.30, 74.207.232.31, 74.207.232.35, 74.207.232.39, 74.207.232.202, 74.207.232.203, 74.207.232.205, 74.207.232.206, 74.207.232.248 and 74.207.232.249. The domain was registered on 7th January 2010 and is hidden by DomainsByProxy.
content.baalcootymalachi.com is hosted on 69.164.196.55 at Linode again, again registered on 7th January via DomainsByProxy.
img.amerchibchapowered.com is hosted on a large number of servers at 174.143.243.90, 174.143.243.162, 174.143.243.220, 174.143.245.236, 98.129.236.154, 98.129.236.239, 98.129.236.254, 98.129.237.14, 98.129.238.99, 98.129.238.101, 98.129.238.102, 98.129.238.103, 98.129.238.105, 98.129.238.106, 98.129.238.112, 174.143.241.174, 174.143.242.58, 174.143.242.109 - these are all hosted at Slicehost.com which is a customer of Rackspace.
Finally, chohivyb.info is hosted on 216.150.79.74 which is some outfit called ezzi.net of New York owned by another outfit called AccessIT. No prizes for guessing that chohivyb.info has been registered only very recently with anonymous details.
216.150.79.74 is a well-known malware server, and that hosts the following domains which you can assume are malicious:
- Ablxsr.info
- Ajgdrt.info
- Alevfq.info
- Alfwqr.info
- Alrpsl.info
- Ameronada.info
- Bnzbfz.info
- Bodxmt.info
- Bplimo.info
- Briliantio.info
- Bvqlag.info
- Bzjsqk.info
- Ccwarj.info
- Cityopicos.info
- Clthth.info
- Ctksji.info
- Dasyxe.info
- Dbivoh.info
- Dgltup.info
- Dpuefh.info
- Dtjblp.info
- Enhmqq.info
- Enqpqk.info
- Euespj.info
- Exmxfd.info
- Fblooe.info
- Fdwghs.info
- Fopqde.info
- Fprvsu.info
- Frgbat.info
- Fymjjz.info
- Gelvmf.info
- Gnautw.info
- Gnysgg.info
- Gredotcom.info
- Grupodanot.info
- Grxqog.info
- Gukuny.info
- Gyckjq.info
- Hagijd.info
- Haqdsc.info
- Hgtbng.info
- Hjdnps.info
- Hyiyyi.info
- Iakecg.info
- Iaoaxz.info
- Iewwpn.info
- Ijaflj.info
- Iohbvo.info
- Jhrubd.info
- Jokirator.info
- Kbwstb.info
- Kibfsz.info
- Klamniton.info
- Ktebkx.info
- Kxlglw.info
- Leeloe.info
- Lgcezx.info
- Lkraat.info
- Lktcaj.info
- Llchqs.info
- Lnmrjz.info
- Lokitoreni.info
- Lqhczk.info
- Lywavy.info
- Lyzocu.info
- Mallstern.info
- Manaratora.info
- Megafrontan.info
- Mesxql.info
- Mngmjc.info
- Monsatrik.info
- Montrealt.info
- Mruvienno.info
- Mrvsnq.info
- Nalszu.info
- Ncnzfh.info
- Neiaea.info
- Nigrandara.info
- Njcmug.info
- Npmkrr.info
- Ntaxkj.info
- Obzdkn.info
- Ocftfa.info
- Optugj.info
- Otfcco.info
- Owpwhi.info
- Pbrugb.info
- Plxxii.info
- Pncgfd.info
- Ppusmb.info
- Prbakn.info
- Qdinql.info
- Qgxelo.info
- Qqtwft.info
- Realuqitor.info
- Refrentora.info
- Retuvarot.info
- Rfouce.info
- Rljysj.info
- Rocqdn.info
- Roeaaj.info
- Semqef.info
- Snosrz.info
- Spgsgh.info
- Stqvqw.info
- Swrapz.info
- Tcoqgo.info
- Tehfnn.info
- Top-lister1.info
- Transforltd.info
- Tsfxzg.info
- Tyenxv.info
- Ugrdzf.info
- Uliganoinc.info
- Urupnk.info
- Utpxno.info
- Uyguau.info
- Vbqfdm.info
- Veqibp.info
- Vkfaao.info
- Vwwtlp.info
- Wddifv.info
- Wdhcvv.info
- Wdokxd.info
- Wevoratora.info
- Wtstds.info
- Wvkjxx.info
- Wvlsam.info
- Xbhmws.info
- Xbxynl.info
- Xcisup.info
- Xxiyrv.info
- Ybeaxd.info
- Yfntrg.info
- Yqjxkj.info
- Ywbxen.info
- Zdkaki.info
- Zhwtqz.info
- Zlpbha.info
- Znkwjc.info
- Zqpwco.info
Obviously block or null-route these destinations as you feel fit, and do not purchase any ads from firedogred.com!
Added: You probably want to block these too..
216.150.79.76
- Cacorq.info
- Clxhbz.info
- Dgrxqh.info
- Diwiowano.info
- Dmdurz.info
- Funkol.info
- Geetol.info
- Gitoer.info
- Gondiroda.info
- Gutrandin.info
- Hizfek.info
- Hopore.info
- Ivgzda.info
- Jopqae.info
- Kolpao.info
- Nadotraza.info
- Niraynome.info
- Ofahitino.info
- Oirjsa.info
- Ornotivec.info
- Pirtaf.info
- Popsto.info
- Rellok.info
- Ruhcsy.info
- Sacmtf.info
- Sdoras.info
- Tapiroten.info
- Tiizwb.info
- Traxemere.info
- Ulmqmq.info
- Vivibt.info
- Xsxydj.info
- Yuncdjbiw.info
- Yyoqny.info
216.150.79.77
- Bnodas.info
- Brasilianstoree.info
- Byzypub.info
- Depahugu.info
- Gionasodor.info
- Giratunes.info
- Gyreal.info
- Hlopki.info
- Huerin.info
- Igerinsar.info
- Jcafuzixa.info
- Joketarona.info
- Koevoru.info
- L-iza.info
- Laryju.info
- Manocoraz.info
- Nbuuf.info
- Npefu.info
- Nvihobepo.info
- Pe-aqemop.info
- Pyneh.info
- Retiof.info
- Rzajexu.info
- Tolkienad.info
- Tymane.info
- Typolazu.info
- Vfoxoe.info
- Wanitale.info
- Yawibyve.info
- Ydiuvy.info
- Zoimie.info
4 comments:
Hey - Jamie here,
Saw your article - this has been pulled out of rotation.
We see a lot of third party ad tags run through our network and being in Canada we miss some of the bad ones due to IP targeting/bait and switch tactics from the advertisers.
I appreciate you bringing this to light but note that I am very much on the same page as you in terms of keeping stuff like this off the internet.
We've lost publishers (and as a result business) from similar situations in the past and we are always appreciative of outside help in terms of new guys to block from our network.
Please contact me directly if you'd like to talk about this further.
Thanks,
Jamie
bootcampmedia.com was also likely hosting a malicious campaign yesterday afternoon, and perhaps still ongoing. I'd contact you Jamie, but I don't have contact info for you. This all is clearly closely related to Dynamoo's post...
traffic.worldseescolor.com is an obvious bad actor. The other related domains:
deliver.bailagequinismregrow.com
img.bailagequinismregrow.com
content.cabullacoexertstephen.com
as well as:
aanserver88.com
bonnapet.com
afkenai.com
bfskul.com
Yep - saw traffic.worldseescolor.com via bootcamp again less than 30 minutes ago.
Related sites, accessed immediately after traffic.worldseescolor.com:
deliver.boaterdunnagechicot.com
img.boaterdunnagechicot.com
Cerdo, can you drop a line to jamie -at- bootcampmedia dot com with a note of where you found it?
Post a Comment