Code:
rerec.net 208.73.210.48
nwomscxare.net 208.73.210.48
adxanet.net 208.73.210.48
www.xeoas.com 208.73.210.48
www.esxao.net 208.73.210.48
rerea.net 208.73.210.48
sbr.imxr.net 85.17.162.231
matt-levine.com 67.210.98.145
forestarabians.nl 195.8.208.122
jocudaidie.ru 144.16.111.140
ohphahfech.ru 144.16.111.140
awrinc.net 208.43.45.98
adobeflash-ver16.co.tv 188.165.201.81
netmediaforum.com 3.3.3.3
tdsinfo.tk 94.100.31.28
xptmedia.com 178.162.133.176
whereisdudescars.com 77.78.239.53
www4.realprotection36.co.cc 114.207.244.145
y5-media.com 178.162.133.226
333.gorgrengos.com 91.216.122.85
these are malicious URL's.. they came from "danchev's blog", kimberly's "stopmalvertizing", and "spywaresucks".. and some might also be from the "malwaredomainslist" forum.. some are used in "malvertizedments" and some are for directly downloading malware, which the malvertizements lead to..
http://stopmalvertising.com/i think that "jocudaidie.ru" is "fastflux" so it will resolve to various ip addresses, depending on the luck of the draw..
Code:
creative.clicksor.com 38.99.186.4
this one could be classifed as "ATS" but it is being used in "malvertizements"..