DNS takeover redirects thousands of websites to malware

Starting 5 August 2013, attackers compromised DNS provisioning for multiple web hosters causing thousands of sites to resolve to a malicious IP (178.33.22.5) that served an iframe loading the Blackhole Exploit Kit. The kit delivered PDF and Java exploits which dropped a Tor-enabled secondary payload; the report documents the attack chain, affected domains/IPs, sample HTTP logs, file hashes, and cleanup guidance.