Threat Level: green Handler on Duty: Johannes Ullrich

SANS ISC: Evil Sports Sites - SANS Internet Storm Center SANS ISC InfoSec Forums

Participate: Learn more about our honeypot network

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Evil Sports Sites

One of our regular readers submitted a Google query to us that points to yet another temptation that the criminals are taking advantage of - the March Madness basketball tournaments here in the USA.  I'm sure that other sporting events are just as popular with the scammers and crooks.  If you want to check out the fun, put this into your browser:

We trust that you are not crazy enough to click on the links that Google marks as hazardous to your computer's health, but if you do and you net something really cool that you'd like to analyze, please let us know what you uncover.  Use the comment feature below or send us a note via our contact form.

Thanks Melvin for the info!

Marcus H. Sachs
Director, SANS Internet Storm Center


301 Posts
ISC Handler
Mar 13th 2010
I analyzed the URI's using fiddler

These are the sequence of http requests
1> Compromised website
302 Moved Temporarily to

2> leads to a Polish domain
302 Found to

3)and finally FakeAV favourite .in domain which also downloads a obfuscated javascript

302 Moved Temporarily to

4) Encoded response from the .in domain

<meta http-equiv="Refresh" content="1; URL='?cmd=executeRedirect&p=rVaunZxWcmqaYpCIoZmRVmxrkE%2FDkpLYT52GpoZ4VGKHytNbbFZxa2ZlcW2PX5mYX2JmVl5a1pLIUmqIldfY02uTYZKU2NqwYJuoo5%2BgnWfEnNHCYKOSlaSbzGzTbZLPlI7YyJ9ipqXa09Gan5mnqGNmaGqRWNvPnJlPYFSk10%2BcaFyInNaGnVOuqI61g49blJ2dVnJWmpiqcpyIXVKgqJOs2aCEapbHmdbJj1OspKKHm4WhpqipbpRjlGjOktbPn2JfYp%2Bn05yQk5%2FTiZLN0V%2Bnmqak1aCbk5ekVmRWm5yDZ4atc1JZVqNanpPDnKPLWYXYzKWjl1ifx8SlpZllVp6dpJ6DZ8rHnaOSYFSuzZLZUmrMjs%2FXyF1ZpqrRg51bYmVraJtqbnHCX5aIXVKhp1RylV%2BYaGaWXZyVl11ZpqmXg51qZGpxamhkcWqVqg%3D%3D'"><script type="text/javascript"> window.location = '';</script>


Sign Up for Free or Log In to start participating in the conversation!