Date Malware-Domain r.cgi-path Infected-Domain_(h-param) Infected-Path_(u-param) Malware-Domain-IP 04/Apr/2011 herocopter.com /cgi-bin/r.cgi www.babybaden.ch /index.php 85.17.132.193 04/Apr/2011 infernomag.com /cgi-bin/r.cgi www.ican-aprender-ingles.com /img/book_english_grammar.png 85.17.132.194 04/Apr/2011 infernomag.com /cgi-bin/r.cgi www.ican-aprender-ingles.com /learning_center.htm 85.17.132.194 04/Apr/2011 voictoall.com /cgi-bin/r.cgi www.dorjeshugden.com /panchenshugden.htm 85.17.132.194 05/Apr/2011 trackallnet.com /cgi-bin/r.cgi super-ligue.com /2010BlogueImages-Videos/horloge2.jpg 85.17.19.210 05/Apr/2011 trackallnet.com /cgi-bin/r.cgi www.super-ligue.com /blogue/ 85.17.19.210 05/Apr/2011 trialworld.net /cgi-bin/r.cgi www.chateau-ziltener.com / 85.17.132.193 05/Apr/2011 twowayserf.com /cgi-bin/r.cgi www.vietnamopentour.com /de/Destination/Hanoi.htm 85.17.136.122 05/Apr/2011 virtualmapping.org /cgi-bin/r.cgi www.adventureguide.ch /i/online_anfrage.php 85.17.136.121 07/Apr/2011 allinoneprogmon.net /cgi-bin/r.cgi new-renault-megane.com /berline/luxembourg/luxembourg-francais/un-vehicule-intuitif/bloc-de-compteurs-innovant/ - 07/Apr/2011 herocopter.com /cgi-bin/r.cgi www.babybaden.ch /index.php 85.17.132.193 07/Apr/2011 metromanias.com /cgi-bin/r.cgi www.telefonoarcobaleno.org / 85.17.136.121 07/Apr/2011 trackallnet.com /cgi-bin/r.cgi www.campione-celeste.ch /velos/mtb/felt-m/felit-m.php 85.17.19.210 07/Apr/2011 trialworld.net /cgi-bin/r.cgi www.idocweb.com /joomla/index.php 85.17.132.193 07/Apr/2011 virtualmapping.org /cgi-bin/r.cgi www.aspworldtour.com / 85.17.136.121 07/Apr/2011 voictoall.com /cgi-bin/r.cgi www.swissimmocapital.ch /immobilien.html 85.17.132.194 08/Apr/2011 capitalinformer.com /cgi-bin/r.cgi rondoveneziano.ch /cms/front_content.php 85.17.136.122 08/Apr/2011 virtualmapping.org /cgi-bin/r.cgi www.adventureguide.ch / 85.17.136.121 08/Apr/2011 virtualmapping.org /cgi-bin/r.cgi www.adventureguide.ch /i/online_anfrage.php 85.17.136.121 08/Apr/2011 virtualmapping.org /cgi-bin/r.cgi www.aspworldtour.com / 85.17.136.121 08/Apr/2011 virtualmapping.org /cgi-bin/r.cgi www.justinmcroberts.com /blog/2008/10/ 85.17.136.121 09/Apr/2011 capitalinformer.com /cgi-bin/r.cgi www.bluespool.ch / 85.17.136.122 09/Apr/2011 capitalinformer.com /cgi-bin/r.cgi www.bluespool.ch /foto3.html 85.17.136.122 11/Apr/2011 metromanias.com /cgi-bin/r.cgi www.famulliabinqes.com /foto%20web/mark_gashi.JPG 85.17.136.121 12/Apr/2011 trialworld.net /cgi-bin/r.cgi www.bzgs.ch / 85.17.132.193 13/Apr/2011 capitalinformer.com /cgi-bin/r.cgi www.schule-geiselweid.ch / 85.17.136.122 14/Apr/2011 trialworld.net /cgi-bin/r.cgi www.chateau-ziltener.com /weinhaus.htm 85.17.132.193 14/Apr/2011 trialworld.net /cgi-bin/r.cgi www.tierlihuus.ch /unterseiten/abzugeben.html 85.17.132.193 14/Apr/2011 virtualmapping.org /cgi-bin/r.cgi www.adventureguide.ch / 85.17.136.121 15/Apr/2011 capitalinformer.com /cgi-bin/r.cgi www.restaurantlory.ch /Fleischspez.html 85.17.136.122 15/Apr/2011 gtracking.org /cgi-bin/r.cgi www.my-beachfun.de /Dokumente/Mitgliedsbeitragssatzbestimmung.pdf 85.17.132.194 15/Apr/2011 trackallnet.com /cgi-bin/r.cgi www.campione-celeste.ch /preise/preise-bmc-mtb/preise-bmc-mtb.php 85.17.19.210 15/Apr/2011 trackallnet.com /cgi-bin/r.cgi www.super-ligue.com /blogue/ 85.17.19.210 15/Apr/2011 trafficsources.org /cgi-bin/r.cgi project.clokair.de /other/75.php 85.17.136.121 15/Apr/2011 trialworld.net /cgi-bin/r.cgi www.tierlihuus.ch /unterseiten/abzugeben.html 85.17.132.193 18/Apr/2011 trafficsources.org /cgi-bin/r.cgi www.floridatwrentals.com /fort-myers-condos.php 85.17.136.121 18/Apr/2011 trialworld.net /cgi-bin/r.cgi www.tierlihuus.ch /unterseiten/abzugeben.html 85.17.132.193 18/Apr/2011 virtualmapping.org /cgi-bin/r.cgi www.cityrent.ch /ford_Puma_1.jpg 85.17.136.121 18/Apr/2011 virtualmapping.org /cgi-bin/r.cgi www.cityrent.ch /modelle.htm 85.17.136.121 19/Apr/2011 trafficsources.org /cgi-bin/r.cgi www.initialdrift.com.au /forums/viewtopic.php 85.17.136.121 21/Apr/2011 infernomag.com /cgi-bin/r.cgi web293.sv07.net-housting.de /index.php 85.17.132.194 21/Apr/2011 trackallnet.com /cgi-bin/r.cgi www.campione-celeste.ch /preise/preise-bmc-mtb/preise-bmc-mtb.php 85.17.19.210 21/Apr/2011 trialworld.net /cgi-bin/r.cgi abcradio.lk /v2/goldfmnews/wegmans.php 85.17.132.193 21/Apr/2011 trialworld.net /cgi-bin/r.cgi www.starfame.de /themes/kategorie/index.php 85.17.132.193 26/Apr/2011 bonusforall.net /cgi-bin/r.cgi www.giterural-daviaz.ch / 85.17.19.210 26/Apr/2011 trafficsources.org /cgi-bin/r.cgi project.clokair.de /other/adscontent.php 85.17.136.121 27/Apr/2011 twowayserf.com /cgi-bin/r.cgi srivenkateshinfotech.com /87.php 85.17.136.122 27/Apr/2011 twowayserf.com /cgi-bin/r.cgi www.paradiso-tigers.ch / 85.17.136.122 28/Apr/2011 trafficsources.org /cgi-bin/r.cgi mydesitube.com /ULPIAN/ 85.17.136.121 28/Apr/2011 twowayserf.com /cgi-bin/r.cgi www.greenzer.fr /energie-nucl%c3%a9aire-mais-a-quoi-sert-AIEA-3706 85.17.136.122 29/Apr/2011 indanetwall.net /cgi-bin/r.cgi www.sagennext.com /wp-content/uploads/2010/11/survey_icon.png 85.17.19.210 29/Apr/2011 trafficsources.org /cgi-bin/r.cgi project.clokair.de /other/triglie.php 85.17.136.121 29/Apr/2011 trialworld.net /cgi-bin/r.cgi www.rum-shop.ch /shop/product_info.php/info/p280_El-Dorado-Demerara-White-Rum.html 85.17.132.193 29/Apr/2011 trialworld.net /cgi-bin/r.cgi www.world-of-rum.ch / 85.17.132.193 02/May/2011 herocopter.com /cgi-bin/r.cgi www.maanglers.com /forums/showthread.php 85.17.132.193 02/May/2011 metromanias.com /cgi-bin/r.cgi www.hypequest.com /fuct-x-shawn-mortensen-new-photo-tees/ 85.17.136.121 02/May/2011 virtualmapping.org /cgi-bin/r.cgi www.adventureguide.ch / 85.17.136.121 02/May/2011 virtualmapping.org /cgi-bin/r.cgi www.aspworldtour.com / 85.17.136.121 03/May/2011 trafficsources.org /cgi-bin/r.cgi www.bar.ch /netzwerk.php 85.17.136.121 03/May/2011 trialworld.net /cgi-bin/r.cgi www.chateau-ziltener.com /z_weine/angebot.php 85.17.132.193 03/May/2011 trialworld.net /cgi-bin/r.cgi www.life-source.de / 85.17.132.193 03/May/2011 trialworld.net /cgi-bin/r.cgi www.pyroreports.com /usvdw.php 85.17.132.193 04/May/2011 herocopter.com /cgi-bin/r.cgi www.hollywoodsouvenirs.com /disneys-cars-lightning-mcqueen-p-1845.html 85.17.132.193 04/May/2011 infernomag.com /cgi-bin/r.cgi uraniumcafe-the.com /wp-content/cache/supercache/uraniumcafe-the.com/2008/12/27/uranium-cafe-double-feature-the-leech-woman-and-attack-of-the-giant-leeches//index.html 85.17.132.194 04/May/2011 trialworld.net /cgi-bin/r.cgi www.chateau-ziltener.com /chateau/partikel/regio042006/Regio042006.pdf 85.17.132.193 05/May/2011 trackallnet.com /cgi-bin/r.cgi www.campione-celeste.ch /velos/bike/mtbbmc/mtbbmc.php 85.17.139.68 05/May/2011 virtualmapping.org /cgi-bin/r.cgi www.topreisen.biz /lastminute-jamaika.php 85.17.136.121 09/May/2011 metromanias.com /cgi-bin/r.cgi www.boiron.ch / 85.17.136.121 09/May/2011 trackallnet.com /cgi-bin/r.cgi www.campione-celeste.ch /images/bmcsport3.jpg 85.17.139.68 09/May/2011 trackallnet.com /cgi-bin/r.cgi www.campione-celeste.ch /velos/sportvelos/bmc-sp/bmc-sp.php 85.17.139.68 09/May/2011 trialworld.net /cgi-bin/r.cgi www.frankrossi.com / 85.17.132.193 09/May/2011 virtualmapping.org /cgi-bin/r.cgi www.adventureguide.ch /i/online_anfrage.php 85.17.136.121 09/May/2011 virtualmapping.org /cgi-bin/r.cgi www.creditagricolesuisseopengstaad.ch / 85.17.136.121 10/May/2011 capitalinformer.com /cgi-bin/r.cgi www.pomdapi.fr / 85.17.136.122 10/May/2011 trafficsources.org /cgi-bin/r.cgi conseils.xpair.com /consulter_savoir_faire/climatisation_industrie_commerce/avantages_du_rooftop/1097.htm 85.17.136.121 10/May/2011 trialworld.net /cgi-bin/r.cgi www.pyroreports.com /usvdw.php 85.17.132.193 10/May/2011 virtualmapping.org /cgi-bin/r.cgi www.topreisen.biz /charterflug.php 85.17.136.121 11/May/2011 twowayserf.com /cgi-bin/r.cgi www.vietnamopentour.com /images/maps/MaiChau_Trekking/logo.jpg 85.17.136.122 11/May/2011 twowayserf.com /cgi-bin/r.cgi www.vietnamopentour.com /images/maps/Vietnam_Spectacular/dalat.jpg 85.17.136.122 11/May/2011 twowayserf.com /cgi-bin/r.cgi www.vietnamopentour.com /images/maps/Vietnam_Spectacular/danang.jpg 85.17.136.122 11/May/2011 twowayserf.com /cgi-bin/r.cgi www.vietnamopentour.com /images/maps/Vietnam_Spectacular/halong.jpg 85.17.136.122 11/May/2011 twowayserf.com /cgi-bin/r.cgi www.vietnamopentour.com /images/maps/Vietnam_Spectacular/hoian.jpg 85.17.136.122 11/May/2011 twowayserf.com /cgi-bin/r.cgi www.vietnamopentour.com /images/maps/Vietnam_Spectacular/hue.jpg 85.17.136.122 11/May/2011 twowayserf.com /cgi-bin/r.cgi www.vietnamopentour.com /images/maps/Vietnam_Spectacular/mekong.jpg 85.17.136.122 11/May/2011 twowayserf.com /cgi-bin/r.cgi www.vietnamopentour.com /images/maps/Vietnam_Spectacular/nhatrang.jpg 85.17.136.122 11/May/2011 twowayserf.com /cgi-bin/r.cgi www.vietnamopentour.com /images/maps/Vietnam_Spectacular/saigon.jpg 85.17.136.122 11/May/2011 virtualmapping.org /cgi-bin/r.cgi www.creditagricolesuisseopengstaad.ch / 85.17.136.121 12/May/2011 allinoneprogmon.net /cgi-bin/r.cgi www.new-renault-megane.com /berline/france/francais/design/ 68.178.232.100 12/May/2011 trafficsources.org /cgi-bin/r.cgi conseils.xpair.com /actualite_experts/efficacite_energetique_batiment_mission_commissionnement.htm 85.17.136.121 12/May/2011 trafficsources.org /cgi-bin/r.cgi www.ameisen-apotheke.ch /cms/upload/Heuschnupfen09.pdf 85.17.136.121 12/May/2011 trialworld.net /cgi-bin/r.cgi www.chateau-ziltener.com /z_weine/angebot.php 85.17.132.193 12/May/2011 virtualmapping.org /cgi-bin/r.cgi www.adventureguide.ch / 85.17.136.121 12/May/2011 virtualmapping.org /cgi-bin/r.cgi www.creditagricolesuisseopengstaad.ch / 85.17.136.121 13/May/2011 trialworld.net /cgi-bin/r.cgi www.speedy-promotion.com /product_info.php/info/p1756_Aufblasbares-Mikrofon.html 85.17.132.193 13/May/2011 virtualmapping.org /cgi-bin/r.cgi www.creditagricolesuisseopengstaad.ch / 85.17.136.121 17/May/2011 gtracking.org /cgi-bin/r.cgi more2date.com / 85.17.132.194 17/May/2011 iamprotectedfrom.net /cgi-bin/r.cgi more2date.com /files/attach/images/80/015/002/11351407p1.jpg 85.17.139.68 17/May/2011 trackallnet.com /cgi-bin/r.cgi www.campione-celeste.ch /velos/strassen/bianchistr/bianchistr.php 85.17.139.68 17/May/2011 trialworld.net /cgi-bin/r.cgi www.pyroreports.com /usvdw.php 85.17.132.193 18/May/2011 trafficsources.org /cgi-bin/r.cgi www.lagardedenuit.com / 85.17.136.121 19/May/2011 gtracking.org /cgi-bin/r.cgi optimumholdingsholdingcompanyltd.com /foreclosurequestions.htm 85.17.132.194 19/May/2011 gtracking.org /cgi-bin/r.cgi optimumholdingsholdingcompanyltd.com /optimum_bank.jpg 85.17.132.194 19/May/2011 virtualmapping.org /cgi-bin/r.cgi www.chinchillazucht.eu /chinchilla_afro_violett_weiss_chinchillazucht.html 85.17.136.121 19/May/2011 virtualmapping.org /cgi-bin/r.cgi www.chinchillazucht.eu /chinchillas/chinchilla_believe_afro_violett_weiss_2.jpg 85.17.136.121 20/May/2011 protechere.com /cgi-bin/r.cgi techappetite.com / 85.17.139.68 20/May/2011 virtualmapping.org /cgi-bin/r.cgi www.adventureguide.ch /rt/adv_admin_show.php 85.17.136.121 23/May/2011 capitalinformer.com /cgi-bin/r.cgi yaaridosti.in /gwen-stacy-dies 85.17.136.122 24/May/2011 trackallnet.com /cgi-bin/r.cgi www.campione-celeste.ch / 85.17.139.68 24/May/2011 trafficsources.org /cgi-bin/r.cgi www.bar.ch / 85.17.136.121 24/May/2011 virtualmapping.org /cgi-bin/r.cgi www.adventureguide.ch /i/online_anfrage.php 85.17.136.121 24/May/2011 virtualmapping.org /cgi-bin/r.cgi www.topreisen.biz /single-reisen.php 85.17.136.121 24/May/2011 voictoall.com /cgi-bin/r.cgi watchmanspub.ca / 85.17.132.194 25/May/2011 intronetech.com /cgi-bin/r.cgi www.radioislame.com / 85.17.139.68 25/May/2011 twowayserf.com /cgi-bin/r.cgi www.roommatesusa.com /2011/05/exclusive-arnold-schwarzenegger-facing-legal-battle-new-secret-lover-lawyers-up-%e2%80%94-with-gloria-allred/ 85.17.136.122 25/May/2011 twowayserf.com /cgi-bin/r.cgi www.roommatesusa.com /wp-content/wp-uploads/2011/05/arnold1.jpg 85.17.136.122 28/May/2011 metromanias.com /cgi-bin/r.cgi preshevasot.com /lajme/maturantet-e-shkolles-se-mesme-teknike-preshevapresheve-fillojne-ekskurzionin-drejt-shqiperise-nga-data-28-05-2011-deri-me-02-05-2011/ 95.168.173.236 30/May/2011 metromanias.com /cgi-bin/r.cgi preshevasot.com /lajme/maturantet-e-shkolles-se-mesme-teknike-preshevapresheve-fillojne-ekskurzionin-drejt-shqiperise-nga-data-28-05-2011-deri-me-02-05-2011/ 95.168.173.236 30/May/2011 trialworld.net /cgi-bin/r.cgi www.alanismorissette.it /forum/index.php 95.168.173.202 01/Jun/2011 virtualmapping.org /cgi-bin/r.cgi www.turkeyholidayproperty.co.uk /Assets/golf_logos_border.jpg 95.168.173.236 01/Jun/2011 voictoall.com /cgi-bin/r.cgi cheezeworld.com /object-creation-game-factory/ 95.168.173.235 04/Jun/2011 trialworld.net /cgi-bin/r.cgi www.hunde-kausnacks.de /index.php/cat/c56_Rinder----B-ffelhaut-Kauartikel.html 95.168.173.202 06/Jun/2011 bonusforall.net /cgi-bin/r.cgi soulsummer.com /wp-content/uploads/2009/06/trey-songz.jpg 95.168.177.141 06/Jun/2011 bonusforall.net /cgi-bin/r.cgi www.soulsummer.com /trey-songz-builds-anticipation-w-new-mixtape/ 95.168.177.141 06/Jun/2011 infernomag.com /cgi-bin/r.cgi www.mile2000.com / 95.168.173.235 07/Jun/2011 capitalinformer.com /cgi-bin/r.cgi www.supermartxe.com /parishilton/ 95.168.177.103 07/Jun/2011 infernomag.com /cgi-bin/r.cgi www.mile2000.com / 95.168.173.235 07/Jun/2011 trialworld.net /cgi-bin/r.cgi www.driving-test-tips.co.uk /gettingstarted.htm 95.168.173.202 07/Jun/2011 trialworld.net /cgi-bin/r.cgi www.driving-test-tips.co.uk /question-mark.jpg 95.168.173.202 07/Jun/2011 voictoall.com /cgi-bin/r.cgi www.fraichattitude.com /fruits-legumes-fiche-fruit-legume.htmlpagefl=essentielfruit=Cerise 95.168.173.235 08/Jun/2011 infernomag.com /cgi-bin/r.cgi www.mile2000.com /shop/index.php 95.168.173.235 08/Jun/2011 metromanias.com /cgi-bin/r.cgi oleafrica.com /wp-content/uploads/2010/10/diani-beach.jpg 95.168.173.236 10/Jun/2011 intronetech.com /cgi-bin/r.cgi www.radioislame.com /new/artikulli.php 84.16.234.151 10/Jun/2011 twowayserf.com /cgi-bin/r.cgi www.greenzer.fr /le-top-5-vacances-ecolos 84.16.234.151 14/Jun/2011 metromanias.com /cgi-bin/r.cgi www.lanzaroteisland.com /villas_de_vacaciones/ 84.16.234.150 15/Jun/2011 voictoall.com /cgi-bin/r.cgi www.roamchina.com /images/routes/lijiang1.jpg 84.16.234.150 15/Jun/2011 voictoall.com /cgi-bin/r.cgi www.roamchina.com /routes.php 84.16.234.150 17/Jun/2011 apartliberal.com /cgi-bin/r.cgi www.plasticsurgery.com.cy /images/dermabrasion.jpg 84.16.234.151 17/Jun/2011 apartliberal.com /cgi-bin/r.cgi www.plasticsurgery.com.cy /photo.html 84.16.234.151 17/Jun/2011 jesusonlynet.org /cgi-bin/r.cgi www.chateau-ziltener.com /z_labels/IlSolarinoMerlot.gif 84.16.234.150 17/Jun/2011 jesusonlynet.org /cgi-bin/r.cgi www.chateau-ziltener.com /z_weine/angebot.php 84.16.234.150 18/Jun/2011 costslaid.com /cgi-bin/r.cgi gagavision.net / 84.16.234.151 20/Jun/2011 reportedtechniques.org /cgi-bin/r.cgi www.garage-koestli.ch /id-1er-coupe/articles/bmw-1er-coupe.html 84.16.234.151 20/Jun/2011 virtualmapping.org /cgi-bin/r.cgi printshop-online.at /index.php 84.16.234.150 21/Jun/2011 capitalinformer.com /cgi-bin/r.cgi www.athletic-preparation.com /meniskus.php 84.16.234.150