|
|
|
Fake Web Hosting Provider - Front-end to Scareware Blackhat SEO Campaign at Blogspot |
Si vous voulez bloquer ce service sur vos fils RSS
Si vous voulez nous contacter ou nous proposer un fil RSS
Menu > Articles de la revue de presse : - l'ensemble [ tous | francophone] - par mots clé [ tous] - par site [ tous] - le tagwall [ voir] - Top bi-hebdo de la revue de presse [ Voir]
Présentation : []Just like GazTranzitStroyInfo's case, what we've got here is failure to understand that the efforts put into building legitimacy of front-ends to cybercrime, is prone to get undermined upon closer examination of the particular web hosting provider. Who, and what is Life4you .info - Free Hosting for Live (dirsite .com; 65.98.15.80; Dennis Linkor Email: admin@dirsite.com)? []"We are pleased to announce the launch of dirsite.com, the best ASP.NET host on the web. We currently offer one plan. This plan is entirely free! Free ASP.NET 2.0 hosting*! Unfortunately we have hit our quota for ad free accounts. Every new signup is now required to display a 460x60 banner ad on their content pages. We will be running another ad free promotion soon, so be sure to check back! We are currently experiencing some technical issues that are out of our control. We are suffering some server problems and as a result, slight delays in processing signups. We are working on it, and will have everything resolved as soon as possible. Thank you for your patience." []What's so special about them? Well, for starters, they've got no customers but the cybercriminals themselves maintaining a portfolio of over 7,000 adult related keywords which they have been using for blackhat SEO campaigns across thousands of automatically registered -- CAPTCHA recognition outsourced -- Blogspot accounts since February, 2009. With the Blogspot campaign still ongoing, let's assess it and expose all the participating scareware domains. Upon automatic generation of the Blogspot accounts, links like the following are included next to the bogus content, all using dirsite.com's pseudo-legitimate hosting services: goto.dirsite .com/go.php?sid=2ettds-key=erotic+bikini+babes goto.dirsite .com/go.php?sid=2ettds-key=sexe+amateur+on+my+space goto.dirsite .com/go.php?sid=2ettds-key=aunt+judy+older+women goto.dirsite .com/go.php?sid=2ettds-key=view+private+profiles+on+myspace goto.dirsite .com/go.php?sid=2ettds-key=fullmetal+alchemist+porn goto.dirsite .com/go.php?sid=2ettds-key=Asian+style+bed+throws goto.dirsite .com/go.php?sid=2ettds-key=cheerleader+candid+pictures goto.dirsite .com/go.php?sid=2ettds-key=desisexstories goto.dirsite .com/go.php?sid=2ettds-key=Hey+Arnold+porno goto.dirsite .com/go.php?sid=2ettds-key=warcraft+henrai []Upon clicking the users are redirected to tdncgo2009 .com/?uid=68etpid=3 (trdatasft .com; fra22 .net; Email: ) 64.86.17.47, Email: hmlragnsky@whoisservices.cn, where the scareware domains are randomly loaded: virusdoctor-onlinedefender .com - 64.213.140.69 Email: sebarinvert.ivus@gmail.com onlinescan-ultraantivirus2009 .com - 206.53.61.76 virussweeper-scan .net - 206.53.61.76 virusalarm-scanvirus .net - 206.53.61.76 viruscatcher .net - 64.213.140.71 Email: jeannemcpeters@gmail.com fast-antivirus .com - 64.213.140.68 The scareware attempts to phone back to update1.virusshieldpro .com/ReleaseXP.exe - 206.53.61.75 - Email: unitedisystems@gmail.com and to updvmfnow .cn - 64.86.17.9 Email: oijfsd.sd@gmail.com. ReleaseXP.exe then phones back to the following locations, naturally earning profit for the cybecriminal - []pay-virusshield .cn - 64.213.140.70; Email: unitedisystems@gmail.com; Returning the following message: "Sorry, the operation is currently unavailable, please email our support team from product's site (Error Code #150)" updvmfnow .cn - 64.86.17.9 updvmfnow .cn/reports/install-report.php (64.86.17.9) updvmfnow .cn/reports/soft-report.php updvmfnow .cn/reports/minstalls.php []The phone back location is also hosting more active scarewaredomains: ultraantivirus2009 .com - 64.86.17.9 virusalarmpro .com vmfastscanner .com mysuperviser .com pay-virusdoctor .com virusmelt .com payvirusmelt .com Not only is life4info .info or dirsite .com a bogus free hosting provider, but the campaigns hosted by them are interacting with our "dear friends" at AS30407; VELCOM .com which Spamhaus describes as "N. American base of Ukrainian cybercrime spammers" - and with a reason.[][] [] [] [] [] [] [][]
Les mots clés de la revue de presse pour cet article : provider scareware
Les éléments de la revue Twitter pour les mots clé : provider
Les derniers articles du site "Dancho Danchev's Blog Mind Streams of Information Security Knowledge" :
- Dissecting a Scareware-Serving Black Hat SEO Campaign Using Compromised .NL .CH Sites
- Spamvertised Best Buy, Macy's, Evite and Target Themed Scareware Exploits Serving Campaign
- ZeuS Crimeware Serving 123Greetings Ecard Themed Campaign in the Wild
- Dissecting the Xerox WorkCentre Pro Scanned Document Themed Campaign
- Spamvertised Amazon Verify Your Email , Your Amazon Order Malicious Emails
- Sampling Malicious Activity Inside Cybercrime-Friendly Search Engines
- Exploits, Malware, and Scareware Courtesy of AS6851, BKCNET, Sagade Ltd.
- Cybercriminals SQL Inject Cybercrime-friendly Proxies Service
- Sampling 419 Advance Fee Scams Activity
- Dissecting the Exploits Scareware Serving Twitter Spam Campaign
Menu > Articles de la revue de presse : - l'ensemble [ tous | francophone] - par mots clé [ tous] - par site [ tous] - le tagwall [ voir] - Top bi-hebdo de la revue de presse [ Voir]
Si vous voulez bloquer ce service sur vos fils RSS :
- avec iptables "iptables -A INPUT -s 88.191.75.173 --dport 80 -j DROP"
- avec ipfw et wipfw "ipfw add deny from 88.191.75.173 to any 80"
- Nous contacter par mail
| Mini-Tagwall des articles publiés sur SecuObs : | | | | sécurité, exploit, windows, microsoft, attaque, réseau, outil, vulnérabilité, audit, système, virus, internet, données, metasploit, présentation, linux, bluetooth, protocol, source, vista, scanner, réseaux, shell, rootkit, engineering, conférence, trames, paquet, téléphone, wishmaster, sysun, mobile, noyau, mémoire, botnet, https, rapport, libre, téléphones, google, patch, reverse, scapy, security, navigateur |
| Mini-Tagwall de l'annuaire video : | | | | security, vmware, biometric, virus, metasploit, windows, password, lockpicking, botnet, tutorial, attack, exploit, network, linux, crypt, source, iphone, secconf, server, shmoocon, engineering, conficker, virtual, ettercap, wimax, rootkit, wireshark, reverse, hackitoergosum, cisco, internet, hacker, systm, openssh, firewall, openvpn, wireless, openbsd, meterpreter, access, conference, knoppix, arduino, backtrack, brucon |
| Mini-Tagwall des articles de la revue de presse : | | | | security, microsoft, windows, hacker, attack, network, vulnerability, google, exploit, malware, internet, remote, iphone, server, inject, patch, apple, twitter, mobile, virus, ebook, facebook, vulnérabilité, crypt, source, linux, password, intel, research, virtual, phish, access, tutorial, trojan, social, privacy, firefox, adobe, overflow, office, cisco, conficker, botnet, pirate, sécurité |
| Mini-Tagwall des Tweets de la revue Twitter : | | | | security, linux, botnet, attack, metasploit, cisco, defcon, phish, exploit, google, inject, server, firewall, network, twitter, vmware, windows, microsoft, compliance, vulnerability, python, engineering, source, kernel, crypt, social, overflow, nessus, crack, hacker, virus, iphone, patch, virtual, javascript, malware, conficker, pentest, research, email, password, adobe, apache, proxy, backtrack |
|
|
|
|
|
