1 reply to this topic

[master131]

hxxp://ina6sk.com/
hxxp://ina6co.com/

I'm guessing they are related because they have similar domains.

Links to files:
hxxp://ina6sk.com/download/InternetAntivirusPro.exe
hxxp://ina6sk.com/download/file.exe
hxxp://ina6sk.com/reports/download-report.php?prod_id=9
hxxp://ina6co.com/cki.php?uid=keyin
--------------------------------------------------------------------------
hxxp://goscaniron.com/
--------------------------------------------------------------------------
hxxp://highnews.5webs.net/login.js
hxxp://hittoday.5webs.net/login.js
hxxp://hittoday2.5webs.net/login.js
hxxp://keepnews.5webs.net/login.js

I am also guessing that these have the same rogue product because they are all registered on 5webs.net and all have login.js

All of these links have been retrieved from http://www.malwaredomainlist.com/mdl.php?i...y=50&page=1 (In order of date released)

[Fatdcuk]

Thanks master131,

Will load up files and investigate shortly to see if they not covered.

Agread that MDL is a very good source of reported URL's