First, we will investigate our observation of non-deterministic
behavior of malicious web servers. Repeated interaction with a
malicious web server did not consistently yield malicious
behavior. Analysis of MPack/ IcePack exploitation kits allows us
to - at least partially - explain this behavior. Figure 3 -
MPack Administrative Interface MPack can be configured via the
$BlockDuplicates option to only deliver an attack to a user it
hasn't seen before. If this “IP tracking functionality” is
enabled, MPack exectutes the CheckAddUser function shown in
Figure 5 . The user's IP address with the browser identifier are
hashed (line 08) and stored in the MPack database (mysql or txt
file) (lines 48-49 and 23-25). Upon repeated visits by the user
with the same IP address and browser identifier, the hash is
once again generated and checked for existence in the MPack
database (lines 15 and 29, 30, 41-42). If it is found, an
“unhappy” emoticon is displayed and no attack is delivered (line
17 and 44). (Similar functionali