Upvote on Reddit http://www.reddit.co...scom_with_an_s/
Bump on LoL forums: http://na.leagueofle...d.php?t=2095369
There's another one of these around. I saw this one being spammed in stream chats.
www.lolcounter.com is a legitimate website used for finding counters to a champion.
www.lolcounterS.com (with an 'S') is a copy paste of lolcounter.com text. On loading, it asks you to run a JAVA applet. The JAVA applet has the same certificate details as the last malware site (that one was a ripoff/imposter site of www.leagueofstats.com), originating from Northern Kenya.
It also tells you that your Flash is out of date/missing, and AUTOMATICALLY starts downloading a fake flash installer (legitimate file name copied from the real Flash installer so as to avoid suspicion, but it's more malware)
On viewing the source code, you can see many explicit references to basically ripping text from the legitimate website lolcounter.com, as well as references to the IP 46.166.***.*** which leads to the ANON JDB. This is an FUD JAVA control panel. I'm not going to give the full IP, because I don't really want more people having access to this, to be honest.
http://blog.webroot....e-by-downloads/ confirms that this site follows the exact behavior of an offered paid malware distribution service. JAVA applet, fake flash infection...
AnonJDB – a Java based malware distribution platform for drive-by downloads.
What’s particularly interesting about AnonJDB is its easy-to-manage command and control interface, and the fact that the cybercriminals are offering Dual Infection Via Adobe Flash Update.
...the service is outsourced to a vendor offering managed hosting services for the entire platform, including the supply of fully undetected malicious Java applets and executable binaries.
So, do not go to lolcounterS.com. I would like to reiterate that www.lolCOUNTER.com is legitimate and a lot of people use it. The one with the 'S' on the end is dirty.
Just wanted to let people know, because I'm sure people will go "oh hey looks useful" on a stream chat, or wherever else.