These sites apparently serve as phishing sites and/or for the purpose of delivering malware. At one point a web page I retrieved from one of these sites contained a Javascript trojan downloader (according to VirusTotal).
hXXp://www.id1471paychex.com/contactshXXp://www.id3641paychex.com/contactshXXp://www.id3711paychex.com/contactshXXp://www.id9561paychex.com/contactsAll of the above domain names currently point to 82.80.252.211:
Code:
$ nslookup id1471paychex.com
Non-authoritative answer:
Name: id1471paychex.com
Address: 82.80.252.211
$ nslookup 82.80.252.211
Non-authoritative answer:
211.252.80.82.in-addr.arpa name = bzq-80-252-211.static.dcenter.bezeqint.net.
McAfee SiteAdvisor page:
http://www.siteadvisor.com/sites/id3114 ... om/msgpage
Posted: Thu Oct 21, 2010 11:25 pm 
