Sorryforthiscode – iFrame Injection

We were working on a compromised site today that had some hidden iFrames on it. The iFrames were redirecting visitors to what seemed like random domains. This is the iFrame we were seeing:

<iFrame src="httx://directs016. ru/in.cgi?wal" width=1 height=1 ..


Nothing new, but we decided to check how popular it was, and we were able to detect a few other sites with it. After a while the iFrame being injected changed and as we continued to track it, we noticed that it was changing every few hours. Here are some of the domains used up in the last few days: ( ( ( ( ( ( ( ( (

.. many more …

Once this initial iFrame it loaded, it is used as a redirector to secondary domains:

.. and many more variations – also changing every few hours ..

Once the secondary domains are loaded, it redirects the browser back to the domain to distribute the traffic (SutraTDS/Traffic Distributions System):

This Traffic Distribution System (TDS) redirects the user randomly to affiliate sites (pharmacy / Pornography) or malware domains pushing off a Fake AV (antivirus) :;5cd75596797b104d92dc9441749ba4d9

Traffic Distribution Systems / TDS

Using a TDS is a very simple way for the bad guys to make money. They compromise a site and redirect users of that hacked site to a TDS, where they receive an affiliate commission for the traffic sent.

Other bad guys can buy “spots” on those TDS’s and redirect users to their Pharma pages or exploit kit pages.

Code generation – Sorryforthiscode

In the beginning of the post, we mentioned that the iFrames change automatically on the compromised sites. It happens because instead of inserting the iFrame directly on the pages, they inject a PHP code to call and get the iFrame to display:


Yes, sorry for this code… was registered on Sep 20,2012 by

Created On:20-Sep-2012 23:06:27 UTC
Last Updated On:20-Sep-2012 23:06:27 UTC
Expiration Date:20-Sep-2013 23:06:27 UTC

The domain is host on a shared server with more domains.

We will post more details as we continue to monitor this campaign. Note that our SiteCheck scanner will detect this type of compromise.

Read more: Sorryforthiscode – iFrame Injection

Story added 28. September 2012, content source with full text you can find at link above.