(Click fraud botnet hosted by

Resolved to

This is from the same guy as all the installs stuff I just posted, but it was downloaded separately using the smoke loader so I gave it a post of it’s own.

The bot first gets the ad link information from the site. The link information is stored in javascript on the index page.

<script language="JavaScript">
    var DisplayLink = "";
    var AdLink = "";
    var AdLink1 = "";
    var AdLink2 = "";
    var AdLink3 = "";

The bot then visits the adlinks using the displaylink as the referer. It looks like the guy has set up a porntube clone and is trying to bot some affilate cash. The bot appears to use the useragent of whatever internet explorer version is installed on the computer.

Hosting infos:

Categories: Uncategorized