Alert: geekstogo.com serving exploit

Just a note folks, geekstogo.com has been compromised again, and is currently serving malicious code, via;

hxxp://www.geekstogo.com/blog/wp-includes/js/scriptaculous/effects.js?ver=1.8.3



I've tried calling geekstogo.com but they rejected my call because my number is ex directory, and the host (SoftLayer) wasn't any help.

The exploit itself is loaded from a Hanaro hosted IP address (219.255.13.77), with another exploit loaded from;

75.127.112.107:82/exemple.com/load.php?spl=javas

75.127.112.107 is on a GNAX IP range. I'd suggest blocking both /24's with immediate effect.

/Update 02:14

A little extra digging has shown another IP involved, 109.236.81.40, which is on a well known criminal friendly IP range - WorldStream, and resolves to unoosearch.com.

Registration Service Provided By: RESELLERCLUB
Contact: +1.4152361970

Domain Name: UNOOSEARCH.COM

Registrant:
N/A
Prokopenko Aleksey (alex1978a@bigmir.net)
ul. Lenina, d 4, kv 1.
Ubileyniy
Luhansk Oblast,35631
UA
Tel. +38.0963639642

Creation Date: 27-Mar-2010
Expiration Date: 27-Mar-2011

Domain servers in listed order:
ns4.everydns.net
ns3.everydns.net
ns2.everydns.net
ns1.everydns.net

Administrative Contact:
N/A
Prokopenko Aleksey (alex1978a@bigmir.net)
ul. Lenina, d 4, kv 1.
Ubileyniy
Luhansk Oblast,35631
UA
Tel. +38.0963639642

Technical Contact:
N/A
Prokopenko Aleksey (alex1978a@bigmir.net)
ul. Lenina, d 4, kv 1.
Ubileyniy
Luhansk Oblast,35631
UA
Tel. +38.0963639642

Billing Contact:
N/A
Prokopenko Aleksey (alex1978a@bigmir.net)
ul. Lenina, d 4, kv 1.
Ubileyniy
Luhansk Oblast,35631
UA
Tel. +38.0963639642

Status:LOCKED