See what was analyzed here: http://vurldissect.co.uk/default.asp?url=http%3A%2F%2Fweb.7k7k.com&btnvURL=Dissect&selUAStr=1&selServer=1&ref=&cbxSource=on&cbxBlacklist=on where resolution failed: http://hosts-file.net/default.asp?s=http%3A%2F%2Fweb.7k7k.com What is going on from that IP: http://support.clean-mx.de/clean-mx/viruses.php?ip=113.107.236.12&sort=id%20DESC Sure there is PHISHING going on there… Malware from that domain: http://62.67.194.183/clean-mx/viruses.php?domain=7k7k.com&sort=email%20asc Also distributing Address Toolbar junkware…
polonus