Malware Alert: YouTube masquerader

I found another malicious site, Jaxware Dot Cn, masquerading as YouTube in the World Wide Web yesterday. As a web junkie, I stumbled upon malicious sites almost everyday but I never did bother to warn people about them. As of today, I will share my findings for the sake of the World Wide Web. Let us make the internet a safer place for everybody.


Who is behind Jaxware Dot Cn?

A quick check on WHOIS revealed that the site is registered to a person named Elfimov Evgeniy. The server’s IP address is 72.232.116.51 and located somewhere in New York.


What sort of danger does it pose to internet users?

As you can see from the first image, there is a weird instruction asking visitors to download ActiveX video codec on its page. Once the page is fully loaded, the malicious site will also prompts you to save an executable file (probably a nasty malware) to your hard drive. Heaven knows what that thing will do to your computer!