Is this site dangerous?

Boonsiri · **Joined:** Fri Jan 23, 2009 12:28 pm **Posts:** 300

I received spam from cardershop.cc. That domain is described as 'dangerous' at urlvoid.com/scan/cardershop.cc , which refers to a listing at hpHosts which indeed exists. The information on hp Hosts (AS41947) is meaningless to me. On http://vurldissect.co.uk/?url=1597541 I then see "hpHosts Status: Not listed". And submission to wepawet also shows nothing malicious. The pagesource of cardershop.cc is:
<HTML><HEAD><SCRIPT language="javascript" src="/sc_db873705ba52b51ac0e39e06e32b5613.js"></SCRIPT></HEAD><BODY onload="scf('3942'+'ccc6','/');"></BODY></HTML>. Can somebody (SIL maybe?) explain why this site is listed as dangerous, and what the JavaScript does?

Red Dwarf · **Joined:** Tue Jun 27, 2006 2:01 am **Posts:** 9227

I also got spam on this.

I captured the load using CURL and got something similar in format but different in content

Code:

<HTML><HEAD><SCRIPT language="javascript" src="/sc_c6565a86baa172e45aff5d66b49c4b69.js"></SCRIPT></HEAD>
<BODY onload="scf('fe6a'+'1df7','/');"></BODY></HTML>

The javascript referenced above contains

Code:

function scf(hsh,uri) {document.cookie="sitechrx" + "=" + escape(hsh + "33046fc8c787b81fde12b1ed") + ";Path=/";window.location=uri;}

Krebs on Security featured the similar site carders.cc in May last year
http://krebsonsecurity.com/2010/05/frau ... cc-hacked/

AlphaCentauri · **Joined:** Thu Mar 01, 2007 3:01 am **Posts:** 5915

I think it's a joe job.

Red Dwarf · **Joined:** Tue Jun 27, 2006 2:01 am **Posts:** 9227

I agree that it is a joe-job. Unlike most joe-jobs, this looks like a particularly unpalatable site.
"Open VPN and Socks Service"

I am also intrigued by the javascript, but I can not determine that it has anything malicious.

Red Dwarf · **Joined:** Tue Jun 27, 2006 2:01 am **Posts:** 9227

The same peculiar code is used by another domain on the same IP 77.91.227.124

st0re.cc

And knuddels.me

Code:

<HTML><HEAD><SCRIPT language="javascript" src="/sc_861b7b6e2ac3659a1d8e7b7efb3da525.js"></SCRIPT></HEAD><BODY onload="scf('338c'+'7e68','/');"></BODY></HTML>

"Domain suspended"

InBoxRevenge KS Forum

Is this site dangerous?

Who is online