As a follow-up to our recent posts, here’s some additional information.
First, we can ring the all-clear bell. Google took action on these domains and you won’t find them anymore in Google.
However, check out this javascript:
(source: cxsjrkelgvjs(dot)cn/gopnikovnet(dot)js << malware site)
So. if you use search terms like “inurl” and “site”, you won’t see these malware pages in your results. Clever, since that’s one way for malware researchers to find stuff (I recently wrote an article on this subject for VirusBulletin). And, it only cares if you’re coming from Google.
Quite interesting.
Alex Eckelberry
(Thanks to Sunbelt researchers Adam Thomas and Francesco Benedini)