Skip to content


qq829.com – A Quick Investigation

For a couple of days, I see strange referrers to this blog. Some visitors are arriving from a qq829.com/web_stat.asp?dn=URL. On that website you see nothing special. Just an image that looks like a tracking icon. If you check the source code of the page you will see, that this icon is included with a Javascript code:
http://s130.cnzz.com/stat.php?id=1958849&web_id=1958849&show=pic1

And indeed, this Javascript file tracks visitors to the qq829.com domain. The hosted domain cnzz.com seems to offer website tracking stats and other services.

As far as I can tell now, it does not look like this is a malicious service (yet). What I do not understand is, why somebody wants to track webesites of mine for some stats. I have never registered anything at cnzz.com. And the exact affiliation of qq829.com and cnzz.com is unclear at this point. As a security measure, don’t click any links and do not visit those sites. For now there seems to be no real solution to block such access.

qq829.com was registered in August 2009 and is hosted in China.

More information can be found on the Google Analytics Support forum.

Posted in Research, Security, Technology.

Tagged with , , , , , , , .


4 Responses

Stay in touch with the conversation, subscribe to the RSS feed for comments on this post.

  1. jolenesiah says

    few days ago is like a small icon
    yesterday i check again, is all in mandarin
    something with window server 2003,

    the page all in black tho

    then it have alot of c:/

  2. Sparkyboy says

    See the article at the following link for more information on what this is:

    http://hubpages.com/hub/qq829com-What-is-it

Continuing the Discussion

  1. Corsin Camichel linked to this post on 19. April 2010

    qq829.com – An Quick Investigation http://goo.gl/fb/dp5mE

  2. Tweets that mention qq829.com – An Quick Investigation – Geekness - closer to the world -- Topsy.com linked to this post on 19. April 2010

    [...] This post was mentioned on Twitter by Corsin Camichel. Corsin Camichel said: qq829.com – An Quick Investigation http://goo.gl/fb/dp5mE [...]