Anatomy Of An On-going Malvertising Campaign

Investigation of an open incident uncovered a malvertising campaign where a legitimate site chained through third-party ad content and an ad rotator to deliver an exploit kit; multiple newly-registered domains with shared registrant details and recurring IP addresses (e.g., 208.76.54.210 and 199.59.166.86) were observed as infrastructure, and analysts were unable to reliably replay the payload due to dynamic ad variables.