Resolved freetraffcounter.com to 109.236.87.219
This is from the same guy as all the installs stuff I just posted, but it was downloaded separately using the smoke loader so I gave it a post of it’s own.
The bot first gets the ad link information from the freetraffcounter.com site. The link information is stored in javascript on the index page.
<script language="JavaScript">
var DisplayLink = "http://pornkingworldtube.com";
var AdLink = "http://widget.plugrush.com/pornkingworldtube.com/1lhr";
var AdLink1 = "http://www.toonporn.com/video/11568114/3-d-cgi-babes-cum-over-cocks?aid=673";
var AdLink2 = "http://delivery.trafficbroker.com/direct.php?zoneid=158782";
var AdLink3 = "http://avatraffic.com/in.php?sid=987";
</script>
The bot then visits the adlinks using the displaylink as the referer. It looks like the guy has set up a porntube clone and is trying to bot some affilate cash. The bot appears to use the useragent of whatever internet explorer version is installed on the computer.
Hosting infos: http://whois.domaintools.com/109.236.87.219