Google search results poisoned again

I started to notice a few rather odd results while researching another malware site … (highlighted in red) as you can see below this affects quite a few big names … so be careful of the links you click …


In the Microsoft link above (as well as all the others) the link redirects to: (URLs disabled)
hxxp://00119922. com/in.php?&n=837&t=Free+Xxx+Movies+Sharing

Which then redirects to:
hxxp://all-porn-tubes-here. com/xplay.php?id=1555

Then you see the ever famous “You must download Video ActiveX Object to play this video file” which wants you to download “exclusivemovie.1555.exe” … from “codecdownload.downloadexenow. com” this is not very well detected [VirusTotal results]

00119922. com and 098765. com are hosted at:
[Starnet S.r.l][AS31252][87.248.163.0 – 87.248.163.255]

all-porn-tubes-here. com is hosted at:
[Noc4hosts][AS29802][74.50.96.0 – 74.50.127.255]

Google Diagnostic reports: Site is listed as suspicious – visiting this web site may harm your computer.
Malicious software includes 220 scripting exploit(s), 21 trojan(s).

codecdownload.downloadexenow. com is hosted at:
[Eu-zz][AS12553][94.247.2.0 – 94.247.3.255]

Google Diagnostic reports: Site is listed as suspicious – visiting this web site may harm your computer.
Malicious software includes 23 trojan(s).

Hopefully Google can get these type results cleaned-up before too many unsuspecting people get infected.



Comments are closed.