Sunday, May 20, 2012

McAfee or is it - Interesting !

Update: Seems like a legitimate service by McAfee. The geek-mode functionality  raised a suspicion. Thanks to anonymous for pointing this out.

I was looking for some interesting malware samples and came across with hilarious but rogue domain using McAfee name. It is actually a URL shortening service hosted on this domain. If you want to try, do it here by clicking this

Typically, the shortening and expansion process work as presented below>  s
> The shortened url is >> << [Copy]> e > The expanded url is >> << [Copy]>

Following URL's are accessed by this service for primary actions.

[1] hxxp://

[2] hxxpp://

The analysis of ZeroClipboard10.swf is present here :

Other interesting links are as follows:


The domain still up as for now. You might want to take a look :)


Anonymous said...

Are you sure this is brandjacking?