.co.tv Domains Serving Heavily Obfuscated Malicious Code

The report documents a malicious Google News search-based campaign that injects obfuscated JavaScript into pages to conditionally redirect visitors (based on the HTTP referrer) to numerous domains hosted at 64.191.81.117, which then deliver exploit code; the report lists the affected domains and provides WHOIS details for the hosting IP.