Hi malware fighters,
Strange indicators to this page: vxchaos.6x.to
Server IP(s):
62.4.83.231
62.93.229.15
=========================
HTTP headers:
GET / HTTP/1.0
Host: vxchaos.6x.to
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Accept-Encoding: gzip
Location Germany
Info on 6x.to
The last time that suspicious code has been found on mentioned site was on 2010-01-04.
Malicious software includes 20 scripting exploits, 6 trojans. Successful infection resulted in an average of 3 new processes on the target machine.
Malicious software has been hosted on 8 domains, e.g. bronx.sk/, mjainfo.mj.funpic.de/, myopera.com/.
1 domain seems to function as a re-direct for spreading maware to visitors of this site, e.g. anhkuloc.byethost13.com/.
This site was hosted on 1 network, including AS8455 (ATOM86).
One site has been infected by this site, e.g. come.vn/.
myopera.com is still infected with
Virus
Threat found: 1
Name of threat: Trojan Horse
Location: hxtp://static03.myopera.com/upic/pool1/iH/jmM/+dyDc5NGqNoZAWAylgA8Fo/2290230_m.jpg
But on 210-02-23 it still had malicious software including 12 trojans, 4 scripting exploits
This site was hosted on 2 network(s) including AS3292 (TDC), AS12552 (IPO),
polonus