Posted 10 August 2012 – 07:06 PM Oh yes, definitely obfuscated and illegitimate.I converted most of the strings though:http://tumblr.com/new/linkhttp://tumblr.com/new/texthttp://tumblr.com/new/photoheaprcomref=http://video2mp3.net/promo.php?dlink=http://video2mp3.net/afterdownload.phphttp://video2mp3.net/view/YouTube/http://96.126.107.154/yt/getComment.phphttp://google.comhttps://google.comhttp://google.co.jphttps://google.co.jphttp://google.dehttps://google.dehttp://google.frhttps://google.frhttp://google.cahttps://google.cahttp://google.eshttps://google.eshttp://google.co.ukhttp://twitter.comhttps://twitter.comhttp://flvto.comhttp://amazon.https://amazon.http://tumblr.http://orkut.http://video2mp3.nethttp://youtube-mp3.orghttp://google.http://clickbank.comIt may be harvesting login information, but I'm still not sure how it's actually using those urls so I can't be sure.It's doing something weird with Amazon also, though I can't figure out what. Probably swapping a [...]
From the category archives: