Tainted Network: "kfc.i.illuminationes.com/snitch" and VPS Hosting of Latvia (91.226.32.0/23)

I've been seeing some injection attacks since last week utilising hosting services of VPS Hosting in Latvia. These are continuing today, with attacks like this one [URLquery] which sends traffic to:

[donotclick]kfc.i.illuminationes.com/snitch

This is hosted on 91.226.33.54. The exploit is not clear at this point, but some sources say that this is some sort of TDS kit. The URLquery transaction flowchart shows the attack in action.

The injected script sends the keywords and referring site upstream, for example:

[donotcliick]kfc.i.illuminationes.com/snitch?default_keyword=Team%20Tyra%20%7C%20The%20most%20popular%20equestrian%20website%20in%20Sweden%2FEurope&referrer=&se_referrer=&source=www.teamtyra.se

Although the attacks in the past few days only seem to have utilised 91.226.33.54, an analysis of the netblock [pastebin] shows several bad or spammy sites in 91.226.32.0/23, so my recommendation is that you banish this range from your network.

UPDATE:
ZScaler are also tracking their infection, an analysis of what it does can be found here.

Malicious WordPress injection sending to 178.62.254.78 and 176.58.100.98

There is currently some sort of injection attack against WordPress sites that is injected code into the site's .js files. Not so unusual.. except that the payload site in the file changes every half hour or so.

A sample of the code can be seen here [pastebin], it looks similar to this (click to enlarge):

The site mentioned in the IFRAME is the one that keeps changing, so presumably there is either something running on the compromised WordPress site, or there is some other mechanism for the bad guys to update the details. The URLs I have seen recently are as follows:

[donotclick]sexyunanu.inthepress.org/bububiolasa16.html
[donotclick]binoduselda.vagfans.info/stickomanus16.html
[donotclick]binoduselda.finalmasterplugin.com/ditirakis16.html
[donotclick]binoduselda.ireleaseme.com/falcoruide16.html
[donotclick]binoduselda.hyakunime.net/bibkajuleman16.html
[donotclick]binoduselda.bateriafina.org/filimanuio16.html

All these subdomains are hijacked from legitimate domains using AFRAID.ORG nameservers, and are hosted on 178.62.254.78 (Digital Ocean, Netherlands). These then pass the victim onto another domain in the format

[donotclick]piplakoras.askhartleyauto.com/3674e375m87i/1/9ffbf35e4190fbba62f70c8477fa3964.html

which is hosted on 176.58.100.98 (Linode, UK). The URL structure indicates that this might be the Nuclear Exploit Kit, although it has been hardened against analysis.

I can't detect all the sites on 178.62.254.78, but a list of the ones I have observed so far can be found here [pastebin] and those on 176.58.100.98 can be found here. But blocking the following IPs may give you better protection:

176.58.100.98
178.62.254.78

Update 2014-09-12 0830 UTC: overnight a whole set of other malicious subdomains (hijacked again from AFRAID.ORG users) were active, using the same IPs to spread malware. The domains change every 30 to 60 minutes or so.

iflaroust.trainersclub.com.br/iflitegouler16.html
iflaroust.transtornomental.com.br/giditures16.html
iflaroust.transtornos.com.br/sukerkae16.html
iflaroust.ubertom.com/bubuerleras16.html
iflaroust.vaughnnugent.com/bubudejana16.html
biblaroita.lecnet.org/bubuidaheta16.html
biblaroita.ukies60.co.uk/nunigahulaala16.html
biblaroita.farahdzila.com/bubliorefusei16.html
biblaroita.buypurestevia.net/buidadusel16.html
biblaroita.loto-365.com/digigafus16.html
biblaroita.loto-777.com/ififuleradus16.html
biblaroita.g8r.ca/iglamiuser16.html
filmagrafy.qqm59.com/laperiuds16.html
filmagrafy.mda77.com/alsominora16.html
filmagrafy.fok96.com/ditroitosmiktajeras16.html
filmagrafy.hosting15.net/fiklakerasio16.html
filmagrafy.tab73.com/bibloruserna16.html
filmagrafy.uzz58.com/sigagulet16.html
filmagrafy.kts25.com/ifafloruseta16.html
guider.xmm85.com/fifakuitro16.html
guider.jam92.com/ifagugehaler16.html
guider.queensland-bedlinen.com/ifigahugera16.html

Something evil on 188.120.198.1 (IP4ISP / LuckyNet, Czech Republic)

Here another bunch of Cushion Redirect sites closely related to this attack a few weeks ago but this time hosted on 188.120.198.1 (IP4ISP / LuckyNet, Czech Republic). You can see the redirect in action in this URLquery report and VirusTotal has a clear indication of badness on this IP.

All the sites are hijacked subdomains of legitimate domains, a peculiar mix of pornography and Dora the Explorer. Domains in use are:

e-meskiesprawy24.com.pl
dora-explorer.co.uk
adultvideoz.net
alsancakescort.org
anadoluyakasiescort.asia

To give credit to the owners of dora-explorer.co.uk, they have spotted that something is wrong, although it looks like the nameservers of their webhost (eu1.downtownhost.com and eu2.downtownhost.com) are improperly secured.

A full list of all the subdomains I can find is here [pastebin] but I would recommend applying a temporary block to these domains until the webhost secures them, although the most effective way of securing your network is to permablock 188.120.198.1.

Recommended blocklist:
188.120.198.1
e-meskiesprawy24.com.pl
dora-explorer.co.uk
adultvideoz.net
alsancakescort.org
anadoluyakasiescort.asia

UPDATE: It definitely appears that downtownhost.com have not secured their nameservers as a few more customer sites are being abused in this way. It appears that the attackers are going through downtownhost.com's customers in alphabetical order. For example, the following subdomain are in use:

dfmgjne934eod8khquq1axg.elluse.com
280pfzhnb4usz3hajazvtlw.eaila.com
zefh96abfex1r32md0jdh7p.e-oman.me

Additional sites to block:
elluse.com
eaila.com
e-oman.me

UPDATE 2: it looks like downtownhost.com have fixed the problem. These recently-flagged domains can now be considered to be safe.

4-cheap.co.uk
aandelenblog.be
apteka-erekcja.pl
arcadehaven.co.uk
bewegwijzeringborden.nl
bitfrog.co.uk
carpediemcosmetics.de
cewh-cesf.ca
charlie-lola.co.uk
check-email.org
cialis25.pl
cialis25.pl
clashofclanshackdownload.com
deepfryershop.co.uk
designwonen.be
dora-explorer.co.uk
eaila.com
elluse.com
e-meskiesprawy24.com.pl
e-meskiesprawy24.pl
e-oman.me

Something evil on 5.135.211.52 and 195.154.69.123

This is some sort of malware using insecure OpenX ad servers to spread. Oh wait, insecure is pretty much the default configuration for OpenX servers..

..anyway, I don't know quite what it is, but it's running on a bunch of hijacked GoDaddy subdomains and is triggering a generic Javascript detection on my gateway. Domains spotted in this cluster are:

fart.somerspointnjinsurance.com
farms.somerspointnjinsurance.com
farming.somerspointnjinsurance.com
farma.risleyhouse.net
farmer.risleyhouse.net
farmers.risleyhouse.net
par.ecofloridian.info
papers.ecofloridian.com
papa.trustedelderlyhomecare.net
paper.trustedelderlyhomecare.org
pap.trustedelderlyhomecare.info
fas.theinboxexpert.com
fashion.theinboxexpert.com

The two IPs in use both belong to OVH France, but 5.135.211.52 is suballocated to QHoster Ltd (Bulgaria) [VT] and 195.154.69.123 is suballocated to Iliad Entreprises (France) [VT]. This second IP has also been used to host "one two three" malware sites back in May.

Recommended blocklist:
5.135.211.52
195.154.69.123
somerspointnjinsurance.com
risleyhouse.net
ecofloridian.info
ecofloridian.com
trustedelderlyhomecare.net
trustedelderlyhomecare.org
trustedelderlyhomecare.info
theinboxexpert.com

pcwelt.de hacked, serving EK on 91.121.51.237

The forum of popular German IT news site pcwelt.de has been hacked and is sending visitors to the Angler exploit kit.

Visitors to the forum are loading up a compromised script hxxp://www[.]pcwelt[.]de/forum/map/vbulletin_sitemap_forum_13.xml.js which contains some Base64 obfuscated malicious code (see Pastebin here) which uses a date-based DGA (domain generation algorithm) to direct visitors to a URL with the following format:

[7-or-8-digit-hex-string].pw/nbe.html?0.[random-number]

The .pw domain contains Base64 encoded data which points to the payload kit, in this case [donotclick]exburge-deinothe.type2consulting.net:2980/meuu5z7b3w.php (Pastebin) which is hosted on 91.121.51.237 (OVH, France). This appears to be the Angler EK.

It looks like the EK domains rotate regularly, but the following sites can be observed on this address:

ingetrekte.valueoptimizationfrontier.com
shellshellwillbomb.type2consulting.net
voorspannenzl.valueoptimizationfrontier.com
tourmenterai.afiduciaryfirst.com
kingyoku.typetwoconsulting.com
mittelbau.typetwoconsulting.com
yogeespith1.typetwoconsulting.com
rozrzewnienie.typetwoconsulting.com
geschaeftlichen.typetwoconsulting.com
kyhtyy-pimprinum.typetwoconsulting.com
jezuietendriesthe.typetwoconsulting.com
depolitsuperconfusion.typetwoconsulting.com
degivreraitdeorganization.typetwoconsulting.com
sknktekonzile-streelsters.typetwoconsulting.com
shogunalbeschenktet.viverebenealcaldo.com
subigi.valueoptimizationfrontier.com
totalize.valueoptimizationfrontier.com
puyaljoukou.valueoptimizationfrontier.com
weisungsgemaess.valueoptimizationfrontier.com
kezune-palpitera.valueoptimizationfrontier.com
remorquervltimme.valueoptimizationfrontier.com
clackdisfundamellemting.valueoptimizationfrontier.com
doscall.type2consulting.net
pehmoilla.type2consulting.net
moariesubigissem.type2consulting.net
unvigilant-straucht.type2consulting.net
mycetozoanreassesses.type2consulting.net

It is worth noting that these domains appear to have been hijacked from a GoDaddy customer:
type2consulting.net
valueoptimizationfrontier.com
typetwoconsulting.com
afiduciaryfirst.com

The following .pw sites are live right now, hiding behind Cloudflare:
7411447a.pw
31674ec.pw
e4ae59eb.pw
95bded0e.pw

Recommended blocklist:
91.121.51.237
type2consulting.net
valueoptimizationfrontier.com
typetwoconsulting.com
afiduciaryfirst.com
7411447a.pw
31674ec.pw
e4ae59eb.pw
95bded0e.pw
(and if you can block all .pw domains then it is probably worth doing that too)

Thanks to the #MalwareMustDie crew and Steven Burn for help with this analysis.

Something evil on 173.212.223.249

There's some sort of evil at work here, but I can't quite replicate it.. however I would recommend that you put a block in for 173.212.223.249 (Network Operations Center, US).

The infection chain I have spotted here starts with a typical compromised website, in this case:

[donotclick]onerecipedaily.com/prawn-patia-from-anjum-anands-i-love-curry/

A quick look at the URLquery report shows a general alert, but no smoking gun..

Is there some trickery at work here? Yes, there's a telltale sign in the HTTP Transactions graph:

Right at the end you can see a redirect to google.no..

This is a tell-tale sign that some malware is redirecting the URLquery probe to Google to protect itself. Usually it means that we don't have the right user agent, referrer string or perhaps the IP is blocked by the bad guys.

However, I can look at the log files of the incident and I see that the next step is a jump to another compromised site:

[donotclick]autoselectosperu.com/de11edf0bcf9b7ce8d3a128934acda75.php?q=d6f53936c38ddad58c5a69d1d36c4904

This then jumps to the presumed payload site at:

[donotclick]bkbr.beuqnyrtz.com/gikhqqkdjc

What is the payload... errr.. I don't know. The incident logs come up with a generic detection and my query-fu isn't working today. You'll just have to trust me that it's going to be malicious.

The following malicious subdomains are also active on 173.212.223.249:

bkbr.beuqnyrtz.com

syb.beuqnyrtz.com
sxxmxv.beuqnyrtz.info

The simplest thing to do to protect yourself against this particular threat is to use the following blocklist:

173.212.223.249

beuqnyrtz.com

beuqnyrtz.info

.js injection leads to Fake Flash update hosted on OneDrive

This kind of attack is nothing new, but there has been a sharp uptick recently in injection attacks that alter .js files on vulnerable systems. The payload is a fake Flash update with a surprisingly low detection rate, hosted on Microsoft OneDrive.

The first step in the attack is through a vulnerable site such as this one [urlquery]. In turn, the infected .js file leads to [donotclick]alientechdesigns.com/NLBFH8ZG.php?id=88473423 which in turn leads to a fake Flash popup hosted at [donotclick]alientechdesigns.com/NLBFH8ZG.php?html=27 which you can see an approximation of here [urlquery].

The link in the popup goes to a download loction at [donotclick]onedrive.live.com/download.aspx?cid=20e850f993bd56fd&resid=20E850F993BD56FD%21111 which downloads a file flashplayerinstaller.exe.

flashplayerinstaller.exe is the first stage in the infection, it has a VirusTotal detection rate of just 3/51. The Malwr report shows that this then downloads two additional components, from:
[donotclick]onedrive.live.com/download.aspx?cid=20e850f993bd56fd&resid=20E850F993BD56FD%21112
[donotclick]onedrive.live.com/download.aspx?cid=20e850f993bd56fd&resid=20E850F993BD56FD%21108

The first one of these is called flashplayer2.exe which has a VirusTotal detection rate of 4/51. Malwr, Anubis and Comodo CAMAS show some working of this malware.

The second file is called update2.exe with a VirusTotal detection rate of 5/49. This seems somewhat resistant to automated analysis tools [1] [2] [3].

This sort of attack is hard to block from a network point of view as it leverages legitimate sites. Perhaps the best way to protect yourself is a bit of user education about where it is appropriate to download updates from.

Injection attack in progress 17/3/14

A couple of injection attacks seem to be in progress, I haven't quite got to the bottom of them yet.. but you might want to block the following domains:

fsv-hoopte-winsen.de
grupocbi.com

These are hosted on 82.165.77.21 and 72.47.228.162 respectively.

The malware is resistant to automated tools and redirects improperly-formed attempt to analyse it to Bing [1] [2]. The malware is appended to hacked .js files on target sites and looks similar to this:

This sort of attack has been used to push fake software updates in the past. Even though I can't quite get to the bottom of this at the moment, you can be pretty sure that this is Nothing Good and I would recommend blocking these domains.

Malware sites to block 13/3/14

These IPs and domains seem to be involved in injection attacks today. I recommend you block them.

64.120.242.178
188.226.132.70
93.189.46.90
tzut.asifctuenefcioroxa.net
0dr5ah.edjadehegile.com
2ch.asifctuenefcioroxa.net
qwenty.lazarmihail.net
qwenty.onlystream.com.ar
aderfas.miltonsvideo.com.br
aderfas.porwisz.eu
traster.buddysoftware.com.au
qwenty.abundiaorganico.com.ar
qwenty.loishconsulting.com.au
qwenty.scottgotyourspot.com
qwenty.liveoakit.com
qwenty.pfsensefirewall.com
qwenty.tongfangtechnology.com
qwenty.sappa.com.au
aderfas.mypagecreator.com
needrast.dundemworld.com
soon.caelux.es
soon.wezel.info
asifctuenefcioroxa.com
asifctuenefcioroxa.info
asifctuenefcioroxa.net
edjadehegile.com
ekpmpb.asifctuenefcioroxa.net
j4qk.asifctuenefcioroxa.com
jgqke.asifctuenefcioroxa.com
np59s.asifctuenefcioroxa.info

The domains being abused are as follows.. many of them appear to be hijacked legitimate domains.
abundiaorganico.com.ar
asifctuenefcioroxa.com
asifctuenefcioroxa.info
asifctuenefcioroxa.net
buddysoftware.com.au
caelux.es
dundemworld.com
edjadehegile.com
lazarmihail.net
liveoakit.com
loishconsulting.com.au
miltonsvideo.com.br
mypagecreator.com
onlystream.com.ar
pfsensefirewall.com
porwisz.eu
sappa.com.au
scottgotyourspot.com
tongfangtechnology.com
wezel.info

Malware (Neutrino EK?) sites to block 12/2/14

The following IPs and domains appear to be in use for spreading exploit kits via injection attacks - 108.178.7.118 (Singlehop, US) [1] [2] and 212.83.164.87 (Online SAS, France) [3] [4]. The payload isn't clear, but some of the URLquery reports indicate Neutrino.

In the case I saw, the victim was directed to the EK from a compromised site at greetingstext.com. I cannot reproduce the problem with URLquery or any other tool, but log files do not lie.

I would recommend that you block these following IPs and domains as a precaution:

108.178.7.118
212.83.164.87
jakiewebs.com
sheethoo.com
chaefooh.com
goldnclouds.com
nofledno.com
zeuriele.com
wqywdo.xip.io
glindeb.com

81.4.106.132 / oochooch.com / 10qnbkh.xip.io

I don't like the look of this [urlquery], seems to be the payload site for some sort of injection attack. Might be worth blocklisting 81.4.106.132.

Something evil on 69.64.39.166

69.64.39.166 (Hosting Solutions International, US) appears to be hosting an exploit kit (possibly Fiesta) according to URLquery reports such as this one.

The code is being injected into target websites, possibly through a malvertising campaign. I would recommend blocking the IP address as the simplest option, although I can identify the following domains on that same IP, all of which are likely to be malicious.

advrzc.myftp.org

amyoau.myftp.biz

aokljwwsap.serveftp.com

bgocodwsiu.myftp.org

bpknbvmc.serveftp.com

cjhkxfpdw.serveftp.com

cvxeitw.serveftp.com

cxrhtcau.myftp.biz

czwaiys.myftp.org

dhdwjwve.myftp.org

djqlcce.myftp.org

drituglgjh.serveftp.com

drpmsmt.serveftp.com

ehetlmna.myftp.biz

euimho.serveftp.com

fvyzhy.serveftp.com

hljozqutc.myftp.org

hlwswbaap.serveftp.com

hwtlzdxic.serveftp.com

idoplhj.serveftp.com

iyrseedlt.myftp.biz

lkuvivr.myftp.biz

lxeoic.myftp.org

orrlnypdvz.myftp.biz

osuqlc.myftp.org

plwxycxij.myftp.org

pmkawqgvob.myftp.org

puifnjav.myftp.biz

sbrckuod.serveftp.com

thtnuj.myftp.biz

ucuqgd.myftp.org

uqqyscgq.myftp.org

uuzkpb.myftp.biz

welfcsuybw.serveftp.com

ykypxoub.myftp.org

yrziqui.serveftp.com

yxoiyjbjt.myftp.biz

Ongoing Fake flash update via .js injection and SkyDrive, Part II

A few days ago I wrote about some ongoing injection attacks that were leading to Adscend Media LLC ads. Adscend say that the affiliate using their ad system was banned, although the ad code is still showing in the injection attacks themselves (update: you can see their take on this in the comments below). F-Secure also covered the attacks from a different aspect.

Although these injection attacks have died down a little they are still ongoing, but usually by the time I get to have a look at them part of the infection chain has been cleaned up. However, this infection is still current and shows what it going on at the moment.

In the case the code has been injected into the legitimate website sotralu.fr (report here) by altering the site's JS files, for example [donotclick]www.sotralu.fr/local/cache-js/fc1bd2678ffcf630f1ab8e56bda3ce7b.js

The code is fairly distinctive being attached at the bottom of the .js file, and it has a limited and fairly generic set of results at VirusTotal.

In this case the injection attempts to run a script from [donotclick]adsrr.home.pl/_vti_txt/rNn3m1K9.php?id=47276976 which in turn tries to download most of its content from [donotclick]adsrr.home.pl/_vti_txt/imgfiles/b.html (report here) which presents itself as a fake Flash update banner.

As well as the Adscend Media ad, this directs the user to download flashplayerinstaller.exe from [donotclick-https]skydrive.live.com/download.aspx?cid=cafe68e3dcbe2d33&resid=CAFE68E3DCBE2D33%21111 which has a VirusTotal detection rate of just 2/50. The Malwr analysis of this file shows a subsequent download from [donotclick-https]skydrive.live.com/download.aspx?cid=cafe68e3dcbe2d33&resid=CAFE68E3DCBE2D33%21112 which has a VirusTotal detection rate of 7/50 but a rather inconclusive Malwr report showing that it modifies the computer to run at startup.

Other researchers might want to grab those files and have a poke at them, so I haven't reported them yet. I'd be interested if anybody can get more intel on whoever is behind it.

The use of SkyDrive is sneaky, but you might decide that it's the sort of thing that you want to block in your corporate environment anyway. It might just be that the best way to counter this sort of attack is to apply a bit of user education about the threat.

Ongoing Fake flash update via .js injection and SkyDrive, Part I

Over the past few days I have seen several cases where legitimate websites have had .js files interfered with in order to serve up something malicious.

Here is a case in point.. the German website physiomedicor.de has been hacked to serve up a fake Flash download, as can be seen from this URLquery report. In this case it's pretty easy to tell what's going on from the URLquery screenshot:

What has happened is that somehow an attacker has altered several .js files on the victim's site and has appened extra code. In this case the code has been appened to [donotclick]www.physiomedicor.de/assets/rollover.js  as follows (click to enlarge):

In this case the code injected tries to load a script from a hijacked site [donotclick]ghionmedia.com/PROjes/goar2RAn.php?id=56356336 but this isn't the first time that I've seen this format of URL injected into a script today as I've seen these other two (also using hijacked sites) as well:

[donotclick]berriesarsuiz.com/ptc84vRb.php?id=117515949
[donotclick]www.karsons.co.uk/qdrX3tDB.php?id=114433444

This second script was found in the high-profile ilmeteo.it hack earlier today, but I've seen it over the past couple of days in other attacks too. The format of the script and method of the attack are too similar to be a coincidence.

This first script [pastebin] identifies itself as coming from Adscend Media LLC .. but of course that's just a comment in the script and could be fake, so let's dig a little deeper.  The key part of this script is a line that says:

document.getElementById('gw_iframe').src = 'http://ghionmedia.com/PROjes/imgfiles/b.html';

..that leads to this script [pastebin] and apart from a load of other stuff you can clearly see another reference to Adscend Media and adscendmedia.com:

    function openpp() {
        //newwindow = window.open("https://adscendmedia.com/pp_click.php?aff=8663&gate=18120&sid=&p=aHR0cDovL3Nob3ctcGFzcy5jb20v", '_blank');
    }

The adscendmedia.com link contains an aff=8663 affiliate ID which indicates that some other party other than Adscend Media LLC may be responsible. This link comes up black when I try to follow it, which might mean a number of things (even the possibility that Adscend Media have terminated the affiliate).

The "other stuff" I mentioned includes a download from skydrive.live.com which is the same thing mentioned in this F-Secure post yesterday. (You can read more about this in Part II)

Adscend Media say that the affiliate was suspended from their network (see the comments below) and they have no control over the code that is showing. Specifically:

..these attacks are not using our advertising services in ANY way. They simply have copied the Javascript code of our content-locking product and used it for their own purposes. Therefore to call this "an Adscend Media ad" is not accurate. In the previous case, there was a commented-out line of Javascript code (where they had replaced our code with their new code), and we were able to see an account number of the person who copied our script, and we suspended the account, however at no point has our real service been used to spread malware. If a person were to copy HTML source code from this page, and use it on a blog that infects users with malware, it would be damaging to your name to repeatedly tie you to something over which you have no control, and that is what is happening here with our company.

You can read part 2 of the analysis here.

Cushion Redirect sites using hijacked GoDaddy domains to block

A very quick write-up about some suspect activity on 194.28.175.129 (BESTHOSTING-AS ON-LINE Ltd, Ukraine) which appears to be hosting some Cushion Redirect domains (explained here) which is being injected into certain sites such as the one in this URLquery report.

A brief examination of the server shows several subdomains of hijacked GoDaddy domains being used for malicious redirects:

d6ld9uir6jgsgasgtfpoff7.yourchicagohummerlimo.com
ht6u1tyyljcketu4b938smf50395383e2197583fa67bd84d474af039.yourbestpartybus.com
770pa3hd21uo1q7wqa5thgh.amateurloginfree.com
d6ld9uir6jgsgasgtfpoff74159538404f0858918145d34c8200d5a7.yourchicagohummerlimo.com
xxctp7yqtwncubsewi6t7pp.yourchicagocarservice.com
63t31l30mdhlep1d0kx82tn70845384049a336c6dc8d7ede92b1d341.yourchicagogranite.com
qxwnnzei6redpxlwbfz1cxg.amateurloginfree.com
ht6u1tyyljcketu4b938smf.amateurloginfree.com
ht6u1tyyljcketu4b938smf50395383e20f64a2782cfdac4ee94285a.yourbestpartybus.com
y1ji3w0l1teth2ydh2k0epj.allgaysitespassfree.com

The hijacked GoDaddy domains in question are:
allgaysitespassfree.com
amateurloginfree.com
yourchicagocarservice.com
yourchicagogranite.com
yourchicagohummerlimo.com
yourbestpartybus.com

A quick look at the Google stats for AS42655 indicate to me personally that blocking 194.28.172.0/22 might be a prudent idea if you don't have any reason to send traffic to Ukrainian sites.

ilmeteo.it hacked

Popular Italian weather site ilmeteo.it appears to have been compromised this morning, with several legitimate .js files on the site altered to drive traffic towards a malicious hacked domain at karsons.co.uk.

The payload is unclear because at the moment the payload site itself is out of bandwidth. It could either be a malware payload or possibly a rogue ad network (which could also be used to spread malware).

According to Alexa statistics, itlmeteo.it is the 29th most popular site in Italy and the 1305th most popular worlwide.

This URLquery report shows the scripts with the injected code:

The injection attempts to run code at [donotclick]www.karsons.co.uk/qdrX3tDB.php?id=114433444 and it can be found in the site's .js files (for example [donotclick]http://www.ilmeteo.it/im10.js). Right at the moment the site has exceeded its bandwidth and is erroring out.

It's hard to say exactly what the payload is or how many users may have been impacted. I've seen a few of these attacks recently that look like they are linked to a rogue ad network, but I can't confirm it in this case.

Update: site appears to be clean as of 1133 CET according to URLquery.

Something evil on 192.95.1.190

It looks like there is some sort of exploit kit on 192.95.1.190 (OVH, Canada) [example] spreading through injection attacks although at the moment I can't reproduce the issue. In any case, I would recommend blocking that IP plus these domains that are in use to spread nastiness:

digitalra.biz
drcoupon.biz
eurosync.biz
expertsurvey.biz
flypanda.biz
funelectronics.biz
interfx.biz
interloanz.biz
learinatlas.biz
mapmchawalit.biz
mapsport.biz
metartri.biz
moreycrm.biz
mrhiuts.biz
perfectcore.biz
safemeta.biz
searchcars.biz
sharpice.biz
softanimal.biz

Some of the subdomains in use are listed here. 

Something evil on 46.19.139.236

46.19.139.236 (Private Layer Inc, Switzerland) seems to be serving up some sort of Java exploit kit via injection attacks which is utilising hijacked legitimate domains, but the domains in use seem to rotate pretty quickly and I haven't got a copy of the payload, but VirusTotal has some examples. These are the domains that I can find running from this IP:

ihavefound.boostprep.com
greedka.byjohnwhitaker.com
green.byjohnwhitaker.com
calc.clermontjumps.com
createmore.clermontjumps.com
freesam.clermontjumps.com
team.clermontjumps.com
breast.ddghost.com
edit.ddghost.com
podkast.ddghost.com
fingerpro.golfrangefinderpro.com
goingup.golfrangefinderpro.com
hksnet.golfrangefinderpro.com
wolfram.golfrangefinderpro.com
bracers.harrismetals.net
cupholder.harrismetals.biz
marriage.harrismetals.biz
materials.harrismetals.biz
stockings.harrismetals.biz
resume.hemorrhoidhometreatmentremedy.com
automatic.herdprogram.com
changed.herdprogram.com
selection.herdprogram.com
variator.herdprogram.com
customers.houston-heights-realtor.com
employee.houston-heights-realtor.com
management.houston-heights-realtor.com
salesmanager.houston-heights-realtor.com
trunam.migweldersforsale.org
demonstration.modelagent.com
promotion.modelagent.com
resume.modelagent.com
servers.modelagent.com
grand.q-host.com
coaches.redbrickplayers.org
concrete.redbrickplayers.org
fiit.redbrickplayers.org
newone.redbrickplayers.org
teams.redbrickplayers.org
button.roadally.org
cars.roadally.org
forums.roadally.org
honest.shattertag.com
server.shattertag.com
service.shattertag.com
tagger.shattertag.com
enter.skillstuff.com
horners.skillstuff.com
sim4you.skillstuff.com
skill.skillstuff.com
urllink.skillstuff.com
servers.sleepets.com
somethingnew.sleepets.com
buddies.southlakehosting.com
goodie.southlakehosting.com
goodluck.southlakehosting.com
honest.southlakehosting.com
namefiest.sugarlandtxhouses.com
soft4you.sugarlandtxhouses.com
blogs.treatmentforeczemaguide.com
disconnected.treatmentforeczemaguide.com
italia.treatmentforeczemaguide.com
template.treatmentforeczemaguide.com
ball.wildbounce.com
savannah.wildbounce.com

These seem to be a mix of GoDaddy, 1&1 and eNom registered domains that have been hijacked. Ones listed in italics have been flagged as malicious by Google:
boostprep.com
byjohnwhitaker.com
clermontjumps.com
ddghost.com
golfrangefinderpro.com
harrismetals.net
harrismetals.biz
hemorrhoidhometreatmentremedy.com
herdprogram.com
houston-heights-realtor.com
migweldersforsale.org
modelagent.com
q-host.com
redbrickplayers.org
roadally.org
shattertag.com
skillstuff.com
sleepets.com
southlakehosting.com
sugarlandtxhouses.com
treatmentforeczemaguide.com
wildbounce.com

Something evil on 91.231.98.149 and boats.net

This injection attack [urlquery] on boats.net caught my attention, a nasty bit of injected code pointing to a (now suspended) domain called gamelikeboards.biz hosted on 91.231.98.149 (Neohost.net, Ukraine). Basically, the victim website has code injected pointing to [donotclick]gamelikeboards.biz/_cp/crone/ which cannot be anything good.

What do we know about gamelikeboards.biz? As luck would have it, the domain was suspended by the registrar, who also removed the Privacy Protection giving the following WHOIS details:

Registrant ID:             DI_29743100
Registrant Name:           Deni Kember
Registrant Organization:   N/A
Registrant Address1:       350 W 42nd St #37D
Registrant City:           New York
Registrant State/Province: NY
Registrant Postal Code:    10036
Registrant Country:        United States
Registrant Country Code:   US
Registrant Phone Number:   +1.6337362122
Registrant Email:          deni_kember658@ghanamail.com

I suspect that these details are fake. The address given is this rather nice $2.1 million apartment in New York, which I suspect has been chosen at random.

I can identify some other (almost definitely malicious) domains that are either on the same server or have been there recently:
eschewsramping.biz
gamelikeboards.biz
sixteenups.biz
sorelyzipmagics.biz
technicaltutoring.biz
zarazagorakakaxx1.org
zarazagorakakaxx2.com

The IP address is allocted as follows:

inetnum:        91.231.98.0 - 91.231.98.255
netname:        NEOHOST
descr:          FOP ILIUSHENKO VOLODYMYR OLEXANDROVUCH
descr:          Neohost.net
country:        UA
org:            ORG-FIVO1-RIPE
admin-c:        IV1015-RIPE
tech-c:         IV1015-RIPE
status:         ASSIGNED PI
mnt-by:         RIPE-NCC-END-MNT
mnt-lower:      RIPE-NCC-END-MNT
mnt-by:         NEOHOST-MNT
mnt-routes:     NEOHOST-MNT
mnt-domains:    NEOHOST-MNT
source:         RIPE # Filtered

organisation:   ORG-FIVO1-RIPE
org-name:       Neohost.net
org-type:       other
address:        Ukraine, Kyiv, 03039, Nauki
admin-c:        IV1015-RIPE
mnt-ref:        NEOHOST-MNT
mnt-by:         NEOHOST-MNT
source:         RIPE # Filtered

person:         ILIUSHENKO VOLODYMYR
address:        Ukraine, Kyiv, 03039
phone:          +38 (044) 599-79-85
nic-hdl:        IV1015-RIPE
mnt-by:         NEOHOST-MNT
source:         RIPE # Filtered

route:          91.231.98.0/24
descr:          Neohost.net
origin:         AS57311
mnt-by:         NEOHOST-MNT
source:         RIPE # Filtered

The name "ILIUSHENKO VOLODYMYR OLEXANDROVUCH" is a weird translation of a name we would more commonly call Vladimir Iliushenko who is the administrator of Neohost. A look at 91.231.98.0/24 indicates a mix of spammy sites plus a number of local Russian and Ukranian sites that look legitimate. Google's prognosis of AS57311 isn't too bad.

I don't know what the payload is, but the IP address was also used in this recent malware attack. The IP and domains are definitely malicious, and I would recommend the following blocklist:

91.231.98.149
eschewsramping.biz
gamelikeboards.biz
sixteenups.biz
sorelyzipmagics.biz
technicaltutoring.biz
zarazagorakakaxx1.org
zarazagorakakaxx2.com

Added: it looks like this site has been compromised before [1] [2] [3]

Something evil on 162.211.231.16

The server at 162.211.231.16 (IT7 Networks, Canada) is currently being used in injection attacks (example) which have been going on for some time [1] [2] and uses several domains, some of which are listed below.

The WHOIS details for these domains seem to be consistent but are possibly fake:

Registrant ID:CR148448937
Registrant Name:Leonardo Salim Chahda
Registrant Street1:Patron 6755
Registrant Street2:
Registrant Street3:
Registrant City:Capital Federal
Registrant State/Province:Buenos Aires
Registrant Postal Code:1408
Registrant Country:AR
Registrant Phone:+46.444407
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:info@brigitteunderwear.com

All the domains are very recently registered by GoDaddy. The WHOIS details for brigitteunderwear.com (also registered by GoDaddy in 2006) are consistent, but I've seen enough hijacked GoDaddy domains recently to be suspicious that there could be an element of identity theft here, and the named person may well have nothing to do with this attack.

I haven't had time to poke around at the payload too much, but this could well be a good IP to block, or alternatively use the list of domains that I have identified below (it may not be comprehensive, though)

Recommended blocklist:
162.211.231.16
acioepod.biz
acioepod.info
acioepod.org
acioepod.us
adrietod.biz
adrietod.info
adrietod.org
adrietod.us
alienore.biz
alienore.info
alienore.org
alienore.us
alpirute.biz
alpirute.info
alpirute.org
alpirute.us
alpojser.biz
alpojser.info
alpojser.net
alpojser.us
aniopirs.us
bialooes.biz
bialooes.info
bialooes.org
bialooes.us
boriskpr.biz
boriskpr.info
boriskpr.org
boriskpr.us
bugaletir.biz
bugaletir.info
bugaletir.org
bugaletir.us
bugaltoiy.biz
bugaltoiy.info
bugaltoiy.org
bugaltoiy.us
buhortes.biz
buhortes.info
buhortes.org
buhortes.us
caniopeo.us
caoilrsr.biz
caoilrsr.info
caoilrsr.org
caoilrsr.us
ciponeor.biz
ciponeor.info
ciponeor.org
ciponeor.us
deilonei.biz
deilonei.info
deilonei.org
deilonei.us
delovyto.biz
delovyto.info
delovyto.org
delovyto.us
diopoesl.us
diposero.biz
eniroikj.biz
eniroikj.info
eniroikj.org
eniroikj.us
feocipor.biz
feocipor.info
feocipor.org
feocipor.us
foleiord.biz
foleiord.info
foleiord.org
foleiord.us
foliadoe.biz
foliadoe.info
foliadoe.org
foliadoe.us
foprtise.biz
foprtise.info
foprtise.org
foprtise.us
gelaiork.biz
gelaiork.info
gelaiork.org
gelaiork.us
gipoeror.biz
gipoeror.info
gipoeror.org
golerods.biz
golerods.info
golerods.org
golerods.us
imanielo.biz
imanielo.info
imanielo.net
imanielo.us
mokioers.org
nimolpeo.biz
nimolpeo.info
nimolpeo.org
nimolpeo.us
niuritos.biz
niuritos.info
niuritos.org
niuritos.us
okoreiki.biz
okoreiki.info
okoreiki.net
okoreiki.us
openirod.biz
openirod.info
openirod.org
openirod.us
reoiklri.biz
reoiklri.info
reoiklri.org
reoiklri.us
tolikord.biz
tolikord.info
tolikord.org
tolikord.us
viloeirp.biz
viloeirp.org
vilosprs.biz
vilosprs.info
vilosprs.org
vilosprs.us
vokoralr.biz
vokoralr.info
vokoralr.org
vokoralr.us