Chile Earthquake Tragedy Used To Spread Malware | Zscaler
Attackers use SEO-poisoned sites targeting Chile earthquake searches to serve browser-specific malware and fakeAV via iframes and obfuscated JavaScript. Malicious domains rank on Google for trending earthquake-related queries and serve user-agent-dependent content. Firefox and Chrome users receive obfuscated JavaScript from a known attack IP; IE and Opera users are redirected to fakeAV pages. Mac users are monetized via an affiliate redirect.
Detection / Hunteropenrouter
Immediate Actions
- Block 89.248.160.238 and 217.23.5.216 at firewall and proxy layers
- Block knoxhop.org and knoxtop.org at DNS resolver or web proxy
- Add malicious URLs to threat intelligence feed for automated blocking
Key Takeaways
- Malicious site ranked 19-22 on Google for "Chile tsunami 2010" query
- Different payloads delivered based on browser user-agent and OS detection
- Firefox blocks one attack URL as a known malicious site
- Mac users redirected to zml.com affiliate link for monetization
- Article references similar campaigns targeting Haiti earthquake and Winter Olympics
Attack Chain
- Initial Access: User searches Google for Chile earthquake news and clicks SEO-poisoned result
- Redirect: knoxhop.org serves JavaScript that detects browser and OS via user-agent
- Execution: Firefox and Chrome receive iframe to 89.248.160.238 serving obfuscated JavaScript
- Impact: IE and Opera users redirected to fakeAV pages at 217.23.5.216
- Monetization: Mac users redirected to zml.com affiliate link for revenue generation
Affected Systems
- Windows users browsing with Internet Explorer
- Windows users browsing with Opera
- Firefox users on any OS
- Chrome users on any OS
- Mac users redirected to affiliate site
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | Drive-by compromise via browser; EDR may not inspect iframe or JavaScript content. |
| Network Visibility | High | HTTP requests to malicious IPs and domains are visible in proxy and web gateway logs. |
| Detection Difficulty | Easy | Known malicious IPs and domains can be blocked at network layer; URLs are static. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Users accessing domains ranking for trending news queries that serve user-agent-dependent iframes (T1189) | Web proxy logs with user-agent and destination URL | Initial Access | Medium — legitimate CDNs also vary content by user-agent |
| Browser processes connecting to IPs serving obfuscated JavaScript after visiting search results (T1027) | EDR network connections from browser processes | Execution | Low — direct IP connections from browsers are unusual |
Required Log Sources
- Web proxy logs
- DNS resolution logs
- Firewall egress logs
- Browser security event logs
Key Behavioral Indicators
- Browser process making HTTP requests to raw IP addresses
- User-agent conditional JavaScript with iframe injection patterns
- Multiple iframe redirects to different destinations based on browser type
- Affiliate redirect URLs with did parameter from unexpected referrers
Control Gaps
- Antivirus rated the malicious page as safe at time of analysis
- SEO ranking allowed malicious site to appear on second Google results page
- No browser-level blocking for all attack URLs — only Firefox blocked one
False Positive Assessment
Low — malicious IPs and domains are specific; affiliate URL may trigger false positives for legitimate zml.com traffic.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Enable URL filtering categories for newly registered domains
- Configure web proxy to block direct IP-address HTTP requests from browsers
- Deploy DNS filtering for known SEO poisoning infrastructure patterns
User Protection
- Ensure browser security features and blocklist updates are enabled
- Deploy endpoint protection with web content inspection for obfuscated JavaScript
- Restrict browser iframe rendering from untrusted third-party domains
Security Awareness
- Train users to verify website legitimacy before clicking search results for trending news
- Advise users that antivirus green-light indicators do not guarantee page safety
MITRE ATT&CK Mapping
Initial Access
Execution
Stealth
Plain-Language Summary
Cybercriminals created websites that appear in Google search results for news about the 2010 Chile earthquake. When people click these results, the sites secretly redirect their browsers to malicious pages that try to install fake antivirus software or other malware. Anyone searching for breaking news topics should be cautious of unfamiliar sites, even if they appear near the top of search results.
Additional IOCs
- Domains:
knoxtop[.]org- Alternate domain referenced in SEO poisoning campaign
- Urls:
knoxhop.org/?q=hawai-tsunami-2010- Malicious SEO landing page URL targeting tsunami searches
- domainknoxhop[.]orgSEO-poisoned landing page serving browser-specific iframes
- domainknoxtop[.]orgAlternate domain referenced in SEO poisoning campaign
- ip217[.]23[.]5[.]216Serves fakeAV pages to IE and Opera users
- ip89[.]248[.]160[.]238Serves obfuscated JavaScript to Firefox and Chrome users
- urlhxxp://217[.]23[.]5[.]216/hitin[.]php?land=20&affid=34100FakeAV redirect URL for IE and Opera browsers
- urlhxxp://89[.]248[.]160[.]238/page[.]php?id=46Delivers obfuscated JavaScript payload via iframe
- urlhxxp://www[.]zml[.]com/?did=5663Affiliate redirect target for Mac users