tag:blogger.com,1999:blog-29922389138996452522009-11-10T08:23:13.876-08:00secur065webhttp://www.blogger.com/profile/03927955797207814790noreply@blogger.comBlogger299125tag:blogger.com,1999:blog-2992238913899645252.post-2884358107847673702009-11-10T08:02:00.000-08:002009-11-10T08:14:10.789-08:002009-11-10T08:14:10.789-08:00<div><div>IP Address:</div><div><b>121.11.85.32</b></div><div><b>218.75.149.156</b></div><div><br /></div></div><div>www.iptobmue.cn</div><div><div>admin.blushcold.com</div><div>admin.iqbgwrue.cn</div><div>admin.sunwrong.com</div><div>bell.roundflow.com</div><div>bendbrand.com</div><div>bgu735.ocsmncea.cn</div><div>blahbeauty.com</div><div>blushcold.com</div><div>blushwire.com</div><div>catlike.cruisesound.com</div><div>code59884.rolexoffertoday.com</div><div>cruisesound.com</div><div>flushstick.com</div><div>iawhosue.cn</div><div>iqbgwrue.cn</div><div>lgt674.iawhosue.cn</div><div>marlinautumn.com</div><div>marlinsign.com</div><div>nrnpf343.aijnaido.cn</div><div>ns1.getsomedns.com</div><div>ns1.marlinsign.com</div><div>ns1.onlinetagdns.com</div><div>ns1.serverraw.com</div><div>ns1.sunwrong.com</div><div>ns2.dnslackingtemp.com</div><div>ns2.iqmeiuea.cn</div><div>ns2.marlinsign.com</div><div>nucleic.marlinautumn.com</div><div>ocsmncea.cn</div><div>osjjjzea.cn</div><div>seamarlin.com</div><div>siberia.marlinautumn.com</div><div>since.brownsunny.com</div><div>smart.marlinsign.com</div><div>smart.seamarlin.com</div><div>stipple.brownsunny.com</div><div>sunwrong.com</div><div>www.blahbeauty.com</div><div>www.flushstick.com</div><div>www.sunwrong.com</div><div><br /></div></div><div><div>IP Address:</div><div><b>218.93.202.120</b></div><div><b>60.172.210.4</b></div></div><div><br /></div><div>6678net.com</div><div><div>chinacarveout.com</div><div>chinadigger.com</div><div>chinajiaoao.com</div><div>cmccblog.com</div><div>cuninfo.com</div><div>cuniv.com</div><div>jinjk.com</div><div>jiwudu.com</div><div>mail.cmccblog.com</div><div>maogai.com</div><div>oumel.com</div><div>yiyixue.com</div><div>yybest.com</div><div>0cb26.jduridew.cn</div><div>178.zsezukes.cn</div><div>2002.vkalufor.cn</div><div>230951.gcuzipoj.cn</div><div>2edb5.jogawaw.cn</div><div>303190.jyasuhev.cn</div><div>3293ae.bjexipat.cn</div><div>38b680.xreyupuc.cn</div><div>402.zulapep.cn</div><div>428c.ntademef.cn</div><div>4ea6.pzuqeleh.cn</div><div>51cf.xpasetad.cn</div><div>523.fmacinuy.cn</div><div>532b.jjobijen.cn</div><div>5965a.sxuzejaf.cn</div><div>5c563.cquconej.cn</div><div>66d2f3.gzuvafuz.cn</div><div>66ead0.qnabefuc.cn</div><div>68e4a.gxohudet.cn</div><div>6bf8.nxugiral.cn</div><div>702.rwihopot.cn</div><div>8a4695.txusinuf.cn</div><div>8acc.zsumuhey.cn</div><div>90c06.dkaxirey.cn</div><div>9340e.zcuxedoc.cn</div><div>9d8d1.bjidasut.cn</div><div>b1ec.hlapowoc.cn</div><div>b26.nwifiwed.cn</div><div>b555.gnaburen.cn</div><div>ba94.rwukison.cn</div><div>benefit.gyefocev.cn</div><div>bj9.ru</div><div>borngentle.com</div><div>c852.cvupuqal.cn</div><div>d11.hfizipan.cn</div><div>d57e8.klosoqiw.cn</div><div>dc7f.qgapefey.cn</div><div>e75.jagegop.cn</div><div>eb0.pxefidag.cn</div><div>eef56.lyalojuf.cn</div><div>everest.qdegivah.cn</div><div>f984.jnomariq.cn</div><div>gguwelag.cn</div><div>gxohudet.cn</div><div>hlapowoc.cn</div><div>jagegop.cn</div><div>jyasuhev.cn</div><div>klosoqiw.cn</div><div>kmakafum.cn</div><div>lqafokuw.cn</div><div>lxucubaf.cn</div><div>mhuhafuy.cn</div><div>movement.qlonipaf.cn</div><div>nevutud.cn</div><div>ntademef.cn</div><div>overal.wsemuhin.cn</div><div>pxefidag.cn</div><div>pyonelul.cn</div><div>qcesipof.cn</div><div>qforuhum.cn</div><div>rikanoj.cn</div><div>rkujalal.cn</div><div>rwihopot.cn</div><div>sxopiken.cn</div><div>sxuzejaf.cn</div><div>vkalufor.cn</div><div>www.ddekowim.cn</div><div>www.lxucubaf.cn</div><div>www.slujarug.cn</div><div>www.zziduxux.cn</div><div>xcopidox.cn</div><div>xehicaw.cn</div><div>xlejuwof.cn</div><div>xreyupuc.cn</div><div>xzewutos.cn</div><div>ysuyonoh.cn</div><div>yveqekov.cn</div><div>zicorem.cn</div><div>zsezukes.cn</div><div>zulapep.cn</div><div>zziduxux.cn</div><div><div>www.fosigwc.cn</div><div>www.zocatwl.cn</div><div>www.mifezxd.cn</div></div></div><div><br /></div><div>IP Address: <b>193.227.114.2</b></div><div><br /></div><div>yupnyojrufl.com</div><div><div>admin.kynugtab.com</div><div>cefjedhoha.com</div><div>homru.com</div><div>icpigyfzin.com</div><div>joellinoa.com</div><div>kynugtab.com</div><div>mail.cefjedhoha.com</div><div>mail.kynugtab.com</div><div>ns1.homru.com</div><div>ns2.homru.com</div><div><br /></div></div><div>IP Address: <b>111.67.200.246</b></div><div><br /></div><div>157c2.leyoksh.cn</div><div> f8b52.leyoksh.cn</div><div>38004a1.himoxbb.cn</div><div>www.zehuqlq.cn</div><div>ffb4973.xogurwy.cn</div><div>www.tuyezxx.cn</div><div>www.yexawls.cn</div><div>www.pijimjb.cn</div><div><br /></div><div>IP Address: <b>124.217.210.223</b></div><div><br /></div><div><div>brighthub.mindbigger.cn</div><div>diqorad.cn</div><div>discover.mindbigger.cn</div><div>enginering.mindbigger.cn</div><div>jujezuj.cn</div><div>mindbigger.cn</div><div>mindshops.cn</div><div>ns1.diqorad.cn</div><div>ns1.jujezuj.cn</div><div>ns1.mindbigger.cn</div><div>ns1.mindshops.cn</div><div>ns1.rvoxbdci.cn</div><div>ns1.rxcounterattack.cn</div><div>ns1.rxerudition.cn</div><div>ns1.rxexacerbate.cn</div><div>ns1.rxlitters.cn</div><div>ns1.rxpaternoster.cn</div><div>ns1.rxpuddle.cn</div><div>ns1.rxreemployment.cn</div><div>ns1.rxsectors.cn</div><div>ns1.rxslobbered.cn</div><div>ns1.rxtweak.cn</div><div>ns1.rxyoghurt.cn</div><div>ns1.wilfre.cn</div><div>ns1.zapoqiw.cn</div><div>ns2.brightpalilaliaazuz.cn</div><div>ns2.diqorad.cn</div><div>ns2.mindbigger.cn</div><div>ns2.rvoxbdci.cn</div><div>ns2.rxcounterattack.cn</div><div>ns2.rxerudition.cn</div><div>ns2.rxexacerbate.cn</div><div>ns2.rxlitters.cn</div><div>ns2.rxpaternoster.cn</div><div>ns2.rxreemployment.cn</div><div>ns2.rxsectors.cn</div><div>ns2.rxslobbered.cn</div><div>ns2.rxtweak.cn</div><div>ns2.rxyoghurt.cn</div><div>ns2.zapoqiw.cn</div><div>ns3.diqorad.cn</div><div>ns3.jujezuj.cn</div><div>ns3.mindbigger.cn</div><div>ns3.rvoxbdci.cn</div><div>ns3.rxcounterattack.cn</div><div>ns3.rxerudition.cn</div><div>ns3.rxexacerbate.cn</div><div>ns3.rxlitters.cn</div><div>ns3.rxpaternoster.cn</div><div>ns3.rxpuddle.cn</div><div>ns3.rxreemployment.cn</div><div>ns3.rxslobbered.cn</div><div>ns3.rxtweak.cn</div><div>ns3.wilfre.cn</div><div>ns3.zapoqiw.cn</div><div>ns4.diqorad.cn</div><div>ns4.mindbigger.cn</div><div>ns4.rvoxbdci.cn</div><div>ns4.rxerudition.cn</div><div>ns4.rxexacerbate.cn</div><div>ns4.rxlitters.cn</div><div>ns4.rxpaternoster.cn</div><div>ns4.rxpuddle.cn</div><div>ns4.rxreemployment.cn</div><div>ns4.rxsectors.cn</div><div>ns4.rxslobbered.cn</div><div>ns4.rxtweak.cn</div><div>ns4.rxyoghurt.cn</div><div>ns4.zapoqiw.cn</div><div>peril.mindbigger.cn</div><div>rxchoice.cn</div><div>rxcounterattack.cn</div><div>rxerudition.cn</div><div>rxexacerbate.cn</div><div>rxhugs.cn</div><div>rxlitters.cn</div><div>rxoccupier.cn</div><div>rxpaternoster.cn</div><div>rxpuddle.cn</div><div>rxreemployment.cn</div><div>rxsectors.cn</div><div>rxslobbered.cn</div><div>rxtonsillectomy.cn</div><div>rxtweak.cn</div><div>rxyoghurt.cn</div><div>scotish.fodmantel.cn</div><div>www.diqorad.cn</div><div>www.jujezuj.cn</div><div>www.rvoxbdci.cn</div><div>www.rxcounterattack.cn</div><div>www.rxerudition.cn</div><div>www.rxexacerbate.cn</div><div>www.rxlitters.cn</div><div>www.rxoccupier.cn</div><div>www.rxpaternoster.cn</div><div>www.rxpuddle.cn</div><div>www.rxreemployment.cn</div><div>www.rxsectors.cn</div><div>www.rxslobbered.cn</div><div>www.rxtweak.cn</div><div>www.rxyoghurt.cn</div><div>www.zapoqiw.cn</div><div>zapoqiw.cn</div></div><div>finding.bulliedwatches.cn</div><div>facing.minddeal.cn</div><div><br /></div><div>IP Address: <b>221.203.168.175</b></div><div><br /></div><div><div>05e.keiscpom.cn</div><div>09cfn.ptijsbat.cn</div><div>0bv.adadjvcbje.cn</div><div>4bf.tkmqtnek.cn</div><div>4nwnzdw.yxukawlv.cn</div><div>5wh.uoosfkvfbt.cn</div><div>6fuwf.listweek.cn</div><div>7p5t.bcozanow.cn</div><div>880y6.xrcatvgs.cn</div><div>9tqtg7.srwuiuyc.cn</div><div>aanfsgnuje.cn</div><div>adadjvcbje.cn</div><div>admin.aanfsgnuje.cn</div><div>admin.cnsffmvssw.cn</div><div>admin.flushstreet.com</div><div>admin.flushwrong.com</div><div>admin.flushyear.com</div><div>admin.fvqdalrfuj.cn</div><div>admin.groundlong.cn</div><div>admin.hxukawyv.cn</div><div>admin.iaxacrug.cn</div><div>admin.iqbgwrue.cn</div><div>admin.ittjdfhh.cn</div><div>admin.listweek.cn</div><div>admin.padfgrvbit.cn</div><div>admin.ptijsbat.cn</div><div>admin.roundlong.cn</div><div>admin.srwuiuyc.cn</div><div>admin.tkmqtnek.cn</div><div>admin.ultimate-replicas.com</div><div>admin.uoosfkvfbt.cn</div><div>admin.wordlong.cn</div><div>admin.yxukawlv.cn</div><div>b9or.veiqscia.cn</div><div>cnsffmvssw.cn</div><div>crjd90.wordlong.cn</div><div>drcfnwl.icesfjsfsb.cn</div><div>ea759.diffsivioe.cn</div><div>eo0.groundlong.cn</div><div>f3vxcw6.fvqdalrfuj.cn</div><div>f5ow3fr.aanfsgnuje.cn</div><div>fbevgi.cnsffmvssw.cn</div><div>flushstreet.com</div><div>flushwrong.com</div><div>flushyear.com</div><div>fvqdalrfuj.cn</div><div>groundlong.cn</div><div>ht92tu.padfgrvbit.cn</div><div>hxukawyv.cn</div><div>iaxacrug.cn</div><div>iqbgwrue.cn</div><div>ittjdfhh.cn</div><div>ivu.seiapsny.cn</div><div>jei70p.icesfjsfsb.cn</div><div>listweek.cn</div><div>ns1.aanfsgnuje.cn</div><div>ns1.cnsffmvssw.cn</div><div>ns1.flushstreet.com</div><div>ns1.flushwrong.com</div><div>ns1.flushyear.com</div><div>ns1.fvqdalrfuj.cn</div><div>ns1.groundlong.cn</div><div>ns1.hxukawyv.cn</div><div>ns1.iqbgwrue.cn</div><div>ns1.ittjdfhh.cn</div><div>ns1.listweek.cn</div><div>ns1.padfgrvbit.cn</div><div>ns1.roundlong.cn</div><div>ns1.tkmqtnek.cn</div><div>ns1.ukmqtnsc.cn</div><div>ns1.ultimate-replicas.com</div><div>ns1.uoosfkvfbt.cn</div><div>ns1.wordlong.cn</div><div>ns1.yeiexixo.cn</div><div>ns2.aanfsgnuje.cn</div><div>ns2.cnsffmvssw.cn</div><div>ns2.fvqdalrfuj.cn</div><div>ns2.groundlong.cn</div><div>ns2.hxukawyv.cn</div><div>ns2.iqbgwrue.cn</div><div>ns2.ittjdfhh.cn</div><div>ns2.listweek.cn</div><div>ns2.padfgrvbit.cn</div><div>ns2.roundlong.cn</div><div>ns2.tkmqtnek.cn</div><div>ns2.uoosfkvfbt.cn</div><div>ns2.wordlong.cn</div><div>ns2.xeuiavwp.cn</div><div>omsw98.seiapsny.cn</div><div>padfgrvbit.cn</div><div>roundlong.cn</div><div>tkmqtnek.cn</div><div>ultimate-replicas.com</div><div>uoosfkvfbt.cn</div><div>walyjl4.hxukawyv.cn</div><div>wordlong.cn</div><div>wsess.deivgxri.cn</div><div>wyr.ittjdfhh.cn</div><div>xc12.roundlong.cn</div><div>xcwd.yxukawlv.cn</div></div><div>qirlr2.pinazxjud.cn</div><div>87ie3c.hxusksfffv.cn</div><div><br /></div><div>IP Address: <b>58.22.138.39</b></div><div><b><br /></b></div><div>rxdemographical.cn</div><div><div>ns3.rxyoghurt.cn</div><div>ns4.rxcounterattack.cn</div><div>rxforgery.cn</div><div>rxcounterattack.cn</div><div>rxyoghurt.cn</div></div><div><br /></div><div><br /></div><div class="blogger-post-footer"><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/2992238913899645252-288435810784767370?l=www.web2secure.com'/></div> <p><a href="http://feedads.g.doubleclick.net/~a/0y8gt1DYpYkDjrUWfu-NG98eWiA/0/da"><img src="http://feedads.g.doubleclick.net/~a/0y8gt1DYpYkDjrUWfu-NG98eWiA/0/di" border="0" ismap="true"></img></a><br/> <a href="http://feedads.g.doubleclick.net/~a/0y8gt1DYpYkDjrUWfu-NG98eWiA/1/da"><img src="http://feedads.g.doubleclick.net/~a/0y8gt1DYpYkDjrUWfu-NG98eWiA/1/di" border="0" ismap="true"></img></a></p>secur065webhttp://www.blogger.com/profile/03927955797207814790noreply@blogger.com0http://www.web2secure.com/2009/11/spam-10-nov-09.htmltag:blogger.com,1999:blog-2992238913899645252.post-37269561298447059972009-11-05T07:58:00.000-08:002009-11-05T08:02:41.722-08:002009-11-05T08:02:41.722-08:00Reference: <a href="http://www.shinnai.net/exploits/QvPRidskEo6sBSxmE5b6.txt">http://www.shinnai.net</a><div><br /><div><div> #-----------------------------------------------------------------------</div><div> # Microsoft GDI+ TIFF Memory Corruption Vulnerability</div><div> # url: http://www.microsoft.com/technet/security/Bulletin/ms09-062.mspx</div><div> #</div><div> # author: shinnai</div><div> # mail: shinnai[at]autistici[dot]org</div><div> # site: http://www.shinnai.net</div><div> #</div><div> # This was written for educational purpose. Use it at your own risk.</div><div> # Author will be not responsible for any damage.</div><div> #-----------------------------------------------------------------------</div><div> </div><div><br /></div><div><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://1.bp.blogspot.com/_N2xP0b-ECBo/SvL2n8lNEzI/AAAAAAAAA18/77ECG0-OL3o/s1600-h/MicrosoftGDI.PNG"><img src="http://1.bp.blogspot.com/_N2xP0b-ECBo/SvL2n8lNEzI/AAAAAAAAA18/77ECG0-OL3o/s320/MicrosoftGDI.PNG" border="0" alt="" id="BLOGGER_PHOTO_ID_5400650069308150578" style="cursor: pointer; width: 320px; height: 244px; " /></a></div><div><br /></div><div>Reference: </div><div><a href="http://www.shinnai.net/exploits/QvPRidskEo6sBSxmE5b6.txt">http://www.shinnai.net</a></div><div><a href="http://www.microsoft.com/technet/security/Bulletin/ms09-062.mspx">Microsoft MS09-062</a></div></div></div><div class="blogger-post-footer"><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/2992238913899645252-3726956129844705997?l=www.web2secure.com'/></div> <p><a href="http://feedads.g.doubleclick.net/~a/vw9ZDeEhsl572YfgRqZT410rSpw/0/da"><img src="http://feedads.g.doubleclick.net/~a/vw9ZDeEhsl572YfgRqZT410rSpw/0/di" border="0" ismap="true"></img></a><br/> <a href="http://feedads.g.doubleclick.net/~a/vw9ZDeEhsl572YfgRqZT410rSpw/1/da"><img src="http://feedads.g.doubleclick.net/~a/vw9ZDeEhsl572YfgRqZT410rSpw/1/di" border="0" ismap="true"></img></a></p>secur065webhttp://www.blogger.com/profile/03927955797207814790noreply@blogger.com0http://www.web2secure.com/2009/11/microsoft-gdi-tiff-memory-corruption.htmltag:blogger.com,1999:blog-2992238913899645252.post-72794936662621137032009-11-05T07:52:00.000-08:002009-11-05T07:58:35.453-08:002009-11-05T07:58:35.453-08:00<div><div>Reference: <a href="http://www.shinnai.net/exploits/Nvq0D797JvE7sf7IrPMz.txt">http://www.shinnai.net</a></div><div><br /></div><div>Author: shinnai</div><div>mail: shinnai[at]autistici[dot]org</div><div>site: http://www.shinnai.net/</div><div><br /></div><div>File: MSOWC.DLL</div><div>Ver.: 9.0.0.8966</div><div>ProgID: OWC.DataSourceControl.9</div><div>Descr.: Microsoft Office Data Source Control 9.0</div><div><br /></div><div>Marked: RegKey Safe for Script: False</div><div>RegKey Safe for Init: False</div><div>Implements IObjectSafety:True</div><div>IDisp Safe: Safe for untrusted: caller</div><div><br /></div><div>Member: DeleteRecordSourceIfUnused (ByVal RecordSource As String)</div></div><div><br /></div><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://1.bp.blogspot.com/_N2xP0b-ECBo/SvL1tdXr6mI/AAAAAAAAA10/opPsrY8VXl4/s1600-h/ddos.PNG"><img style="cursor:pointer; cursor:hand;width: 320px; height: 215px;" src="http://1.bp.blogspot.com/_N2xP0b-ECBo/SvL1tdXr6mI/AAAAAAAAA10/opPsrY8VXl4/s320/ddos.PNG" border="0" alt="" id="BLOGGER_PHOTO_ID_5400649064497539682" /></a><div><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://1.bp.blogspot.com/_N2xP0b-ECBo/SvL1tdXr6mI/AAAAAAAAA10/opPsrY8VXl4/s1600-h/ddos.PNG"></a><br /><div><br /></div><div>Reference: <a href="http://www.shinnai.net/exploits/Nvq0D797JvE7sf7IrPMz.txt">http://www.shinnai.net</a></div><div><br /></div></div><div class="blogger-post-footer"><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/2992238913899645252-7279493666262113703?l=www.web2secure.com'/></div> <p><a href="http://feedads.g.doubleclick.net/~a/LypIgvSAbKdfWF9eUxn0gfXbSX0/0/da"><img src="http://feedads.g.doubleclick.net/~a/LypIgvSAbKdfWF9eUxn0gfXbSX0/0/di" border="0" ismap="true"></img></a><br/> <a href="http://feedads.g.doubleclick.net/~a/LypIgvSAbKdfWF9eUxn0gfXbSX0/1/da"><img src="http://feedads.g.doubleclick.net/~a/LypIgvSAbKdfWF9eUxn0gfXbSX0/1/di" border="0" ismap="true"></img></a></p>secur065webhttp://www.blogger.com/profile/03927955797207814790noreply@blogger.com0http://www.web2secure.com/2009/11/microsoft-office-data-source-control-90.htmltag:blogger.com,1999:blog-2992238913899645252.post-55520167351251110902009-11-05T07:45:00.000-08:002009-11-05T07:52:23.596-08:002009-11-05T07:52:23.596-08:00<div><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://4.bp.blogspot.com/_N2xP0b-ECBo/SvLzZRfuu3I/AAAAAAAAA1k/zg0LDpOL2EU/s1600-h/av2009.PNG"><img style="cursor:pointer; cursor:hand;width: 320px; height: 169px;" src="http://4.bp.blogspot.com/_N2xP0b-ECBo/SvLzZRfuu3I/AAAAAAAAA1k/zg0LDpOL2EU/s320/av2009.PNG" border="0" alt="" id="BLOGGER_PHOTO_ID_5400646518689414002" /></a></div><div><div><div><div><br /></div><div>IP Address: <b>209.200.247.194</b></div><div><br /></div><div>Domains sharing same IP address:</div><div><br /></div><div><div>2009antivirusreviews.com</div><div>2009datarecoveryreviews.com</div><div>activexfix.org</div><div>chkdskerrors.com</div><div>driversdownloadhub.com</div><div>driversupdate.org</div><div>fastfastpc.com</div><div>fastuninstaller.com</div><div>fixoutlookexpress.org</div><div>freerecordsregistry.com</div><div>inmate-finder.com</div><div>makepcfaster.org</div><div>myhostingreviews.com</div><div>pcperformancetools.com</div><div>program-uninstaller.com</div><div>speedypc.org</div><div>top25workathome.com</div><div>windowsfix.org</div><div>www.driversdownloadhub.com</div><div>www.driversupdate.org</div><div>www.fastfastpc.com</div><div>www.freerecordsregistry.com</div><div>www.myhostingreviews.com</div><div>www.pcperformancetools.com</div><div>www.windowsfix.org</div><div><br /></div><div><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://3.bp.blogspot.com/_N2xP0b-ECBo/SvL0KBzSoII/AAAAAAAAA1s/P3FhDNZxcjg/s1600-h/pcperformance.PNG"><img src="http://3.bp.blogspot.com/_N2xP0b-ECBo/SvL0KBzSoII/AAAAAAAAA1s/P3FhDNZxcjg/s320/pcperformance.PNG" border="0" alt="" id="BLOGGER_PHOTO_ID_5400647356290080898" style="cursor: pointer; width: 320px; height: 169px; " /></a></div><div><br /></div><div>IP Address: <b>209.200.247.194</b></div><div><br /></div><div>Domains sharing same IP address:</div><div><br /></div><div><div>2009antivirusreviews.com</div><div>2009datarecoveryreviews.com</div><div>activexfix.org</div><div>chkdskerrors.com</div><div>driversdownloadhub.com</div><div>driversupdate.org</div><div>fastfastpc.com</div><div>fastuninstaller.com</div><div>fixoutlookexpress.org</div><div>freerecordsregistry.com</div><div>inmate-finder.com</div><div>makepcfaster.org</div><div>myhostingreviews.com</div><div>pcperformancetools.com</div><div>program-uninstaller.com</div><div>speedypc.org</div><div>top25workathome.com</div><div>windowsfix.org</div><div>www.driversdownloadhub.com</div><div>www.driversupdate.org</div><div>www.fastfastpc.com</div><div>www.freerecordsregistry.com</div><div>www.myhostingreviews.com</div><div>www.pcperformancetools.com</div><div>www.windowsfix.org</div><div><br /></div></div></div></div></div></div><div class="blogger-post-footer"><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/2992238913899645252-5552016735125111090?l=www.web2secure.com'/></div> <p><a href="http://feedads.g.doubleclick.net/~a/qQMZ36FT5GlJ-5qoYsm0E0BvtiE/0/da"><img src="http://feedads.g.doubleclick.net/~a/qQMZ36FT5GlJ-5qoYsm0E0BvtiE/0/di" border="0" ismap="true"></img></a><br/> <a href="http://feedads.g.doubleclick.net/~a/qQMZ36FT5GlJ-5qoYsm0E0BvtiE/1/da"><img src="http://feedads.g.doubleclick.net/~a/qQMZ36FT5GlJ-5qoYsm0E0BvtiE/1/di" border="0" ismap="true"></img></a></p>secur065webhttp://www.blogger.com/profile/03927955797207814790noreply@blogger.com0http://www.web2secure.com/2009/11/rogue-av-antivirus-reviews-paretologic.htmltag:blogger.com,1999:blog-2992238913899645252.post-14772937931425251202009-11-04T05:49:00.000-08:002009-11-04T05:54:20.921-08:002009-11-04T05:54:20.921-08:00<div>IP Address: <b>208.67.219.132</b></div><div><br /></div><div>Domains sharing same IP Address:</div><div><br /></div><div>yupnyojrufl.com</div><div>goowy.net</div><div>iris-germany.com</div><div>quienestadetrasdelascuarderias.org</div><div>www.iengkque.cn</div><div>www.iufkwbue.cn</div><div>ofralfyski.com</div><div>copobpt.cn</div><div>tikesdx.cn</div><div>www.gotfed.com</div><div>recorta.com</div><div><br /></div><div>IP Address: <b>59.53.88.133</b></div><div><br /></div><div>Domains sharing same IP address:</div><div><br /></div><div>42ad7d.camacnm.cn</div><div>dxzhaosheng.cn</div><div>gudurc.com</div><div>gyalirad.cn</div><div>hkjinlong.com</div><div>www.558job.cn</div><div>www.dxzhaosheng.cn</div><div>deyuwec.cn</div><div>www.nekexkk.cn </div><div>www.fijattf.cn</div><div><br /></div><div><br /></div><div>IP Address: <b>60.172.210.4</b></div><div><br /></div><div>Domains sharing same IP address:</div><div><br /></div><div>*.bjogivos.cn</div><div>*.cbuhovig.cn</div><div>*.ddekowim.cn</div><div>*.dimaxal.cn</div><div>*.djubatuj.cn</div><div>*.gguwelag.cn</div><div>*.gnaburen.cn</div><div>*.gpucivek.cn</div><div>*.hfizipan.cn</div><div>*.hlapowoc.cn</div><div>*.jagegop.cn</div><div>*.jduridew.cn</div><div>*.jogawaw.cn</div><div>*.kqadibul.cn</div><div>*.lxucubaf.cn</div><div>*.nevutud.cn</div><div>*.nwurakex.cn</div><div>*.nxugiral.cn</div><div>*.pnunidun.cn</div><div>*.psavapip.cn</div><div>*.pxefidag.cn</div><div>*.pzuqeleh.cn</div><div>*.qgohogok.cn</div><div>*.rikanoj.cn</div><div>*.rwihopot.cn</div><div>*.slujarug.cn</div><div>*.sxopiken.cn</div><div>*.ttanames.cn</div><div>*.vsaqifuj.cn</div><div>*.xlejuwof.cn</div><div>*.yveqekov.cn</div><div>*.zsojexuh.cn</div><div>*.zsumuhey.cn</div><div>*.zxatuyox.cn</div><div>0cb26.jduridew.cn</div><div>178.zsezukes.cn</div><div>2002.vkalufor.cn</div><div>230951.gcuzipoj.cn</div><div>2edb5.jogawaw.cn</div><div>303190.jyasuhev.cn</div><div>3293ae.bjexipat.cn</div><div>38b680.xreyupuc.cn</div><div>402.zulapep.cn</div><div>428c.ntademef.cn</div><div>4ea6.pzuqeleh.cn</div><div>51cf.xpasetad.cn</div><div>523.fmacinuy.cn</div><div>532b.jjobijen.cn</div><div>5965a.sxuzejaf.cn</div><div>5c563.cquconej.cn</div><div>66d2f3.gzuvafuz.cn</div><div>66ead0.qnabefuc.cn</div><div>68e4a.gxohudet.cn</div><div>6bf8.nxugiral.cn</div><div>702.rwihopot.cn</div><div>8a4695.txusinuf.cn</div><div>8acc.zsumuhey.cn</div><div>90c06.dkaxirey.cn</div><div>9340e.zcuxedoc.cn</div><div>9d8d1.bjidasut.cn</div><div>b1ec.hlapowoc.cn</div><div>b26.nwifiwed.cn</div><div>b555.gnaburen.cn</div><div>ba94.rwukison.cn</div><div>benefit.gyefocev.cn</div><div>bj9.ru</div><div>borngentle.com</div><div>c852.cvupuqal.cn</div><div>d11.hfizipan.cn</div><div>d57e8.klosoqiw.cn</div><div>dc7f.qgapefey.cn</div><div>e75.jagegop.cn</div><div>eb0.pxefidag.cn</div><div>eef56.lyalojuf.cn</div><div>everest.qdegivah.cn</div><div>f984.jnomariq.cn</div><div>gguwelag.cn</div><div>gxohudet.cn</div><div>hlapowoc.cn</div><div>jagegop.cn</div><div>jyasuhev.cn</div><div>klosoqiw.cn</div><div>kmakafum.cn</div><div>lqafokuw.cn</div><div>lxucubaf.cn</div><div>mhuhafuy.cn</div><div>movement.qlonipaf.cn</div><div>nevutud.cn</div><div>ntademef.cn</div><div>overal.wsemuhin.cn</div><div>pxefidag.cn</div><div>pyonelul.cn</div><div>qcesipof.cn</div><div>qforuhum.cn</div><div>rikanoj.cn</div><div>rkujalal.cn</div><div>rwihopot.cn</div><div>sxopiken.cn</div><div>sxuzejaf.cn</div><div>vkalufor.cn</div><div>www.ddekowim.cn</div><div>www.lxucubaf.cn</div><div>www.slujarug.cn</div><div>www.zziduxux.cn</div><div>xcopidox.cn</div><div>xehicaw.cn</div><div>xlejuwof.cn</div><div>xreyupuc.cn</div><div>xzewutos.cn</div><div>ysuyonoh.cn</div><div>yveqekov.cn</div><div>zicorem.cn</div><div>zsezukes.cn</div><div>zulapep.cn</div><div>zziduxux.cn</div><div><br /></div><div><br /></div><div>IP Address: <b>60.172.210.3</b></div><div><br /></div><div>Domains sharing same IP address:</div><div><br /></div><div>*.nicebob.com</div><div>barrington.steadybreak.com</div><div>bentham.steadywall.com</div><div>bibscreen.com</div><div>breakwin.com</div><div>darkfrom.com</div><div>intrigue.steadyblur.com</div><div>killjoy.steadybreak.com</div><div>linefollow.com</div><div>nicebob.com</div><div>ns1.nicebob.com</div><div>ns2.countrydnsname.com</div><div>ns2.dnsgetonline.com</div><div>ns2.fullmountdns.com</div><div>ns2.grabdnsinfo.com</div><div>ns2.hostmasterpro.com</div><div>ns2.linkdnspowersetup.com</div><div>ns2.linkdnssetup.com</div><div>ns2.roadhostdns.com</div><div>ns2.skyhostingpower.com</div><div>ns2.wallpaperdns.com</div><div>ns2.wishstardns.com</div><div>ns2.worlddnstype.com</div><div>towelnow.com</div><div><br /></div><div><br /></div><div>IP Address: <b>60.172.210.5</b></div><div><br /></div><div>Domains sharing same IP address:</div><div><br /></div><div>*.8888r.com</div><div>*.baidugame.cn</div><div>*.hondy.net</div><div>*.sf66666.com</div><div>*.wuhu365.com</div><div>1maile.com</div><div>51jsbbs.com</div><div>7cspk.com</div><div>8888r.com</div><div>ahfcst.com</div><div>ahhaopu.com</div><div>bu2007.com</div><div>fagao888.com</div><div>fcjstz.com</div><div>gyljf.com</div><div>hkyurun.com</div><div>hnjpt.com</div><div>hzshuiyun.com</div><div>jcfw2008.com</div><div>nlaixin.com</div><div>nojetpm.com</div><div>nxspxx.com</div><div>rijinmuju.com</div><div>sylzgy.com</div><div>szsdck.com</div><div>weinotts.com</div><div>whcbzs.com</div><div>whyrhz.com</div><div>wuhu365.cn</div><div>wuhu365.com</div><div>wuhucrm.cn</div><div>wuhugogo.com</div><div>wuhumail.com</div><div>wuhuprinter.com</div><div>www.wuhu365.com</div><div>xinyuemusic.com</div><div>xn--49ss1hl9pext.com</div><div>yjgafj.com</div><div><br /></div><div><br /></div><div>IP Address: <b>218.75.149.156</b></div><div><br /></div><div>Domains sharing same IP address:</div><div><br /></div><div>*.blahbeauty.com</div><div>*.blushcold.com</div><div>*.flushstick.com</div><div>*.iawhosue.cn</div><div>*.iqbgwrue.cn</div><div>*.iqmeiuea.cn</div><div>*.marlinsign.com</div><div>*.ocsmncea.cn</div><div>*.osjjjzea.cn</div><div>*.seamarlin.com</div><div>*.sunwrong.com</div><div>admin.blushcold.com</div><div>admin.iqbgwrue.cn</div><div>admin.sunwrong.com</div><div>bell.roundflow.com</div><div>bendbrand.com</div><div>bgu735.ocsmncea.cn</div><div>blahbeauty.com</div><div>blushcold.com</div><div>blushwire.com</div><div>catlike.cruisesound.com</div><div>code59884.rolexoffertoday.com</div><div>cruisesound.com</div><div>flushstick.com</div><div>iawhosue.cn</div><div>iqbgwrue.cn</div><div>lgt674.iawhosue.cn</div><div>marlinautumn.com</div><div>marlinsign.com</div><div>nrnpf343.aijnaido.cn</div><div>ns1.getsomedns.com</div><div>ns1.marlinsign.com</div><div>ns1.onlinetagdns.com</div><div>ns1.serverraw.com</div><div>ns1.sunwrong.com</div><div>ns2.dnslackingtemp.com</div><div>ns2.iqmeiuea.cn</div><div>ns2.marlinsign.com</div><div>nucleic.marlinautumn.com</div><div>ocsmncea.cn</div><div>osjjjzea.cn</div><div>seamarlin.com</div><div>siberia.marlinautumn.com</div><div>since.brownsunny.com</div><div>smart.marlinsign.com</div><div>smart.seamarlin.com</div><div>stipple.brownsunny.com</div><div>sunwrong.com</div><div>www.blahbeauty.com</div><div>www.flushstick.com</div><div>www.sunwrong.com</div><div><br /></div><div>IP Address: <b>221.203.168.175</b></div><div><br /></div><div>Domains sharing same IP address:</div><div><br /></div><div>*.aenkweac.cn</div><div>*.cnsffmvssw.cn</div><div>*.flushstreet.com</div><div>*.flushwrong.com</div><div>*.flushyear.com</div><div>*.fvqdalrfuj.cn</div><div>*.iqbgwrue.cn</div><div>*.ittjdfhh.cn</div><div>*.listweek.cn</div><div>*.padfgrvbit.cn</div><div>*.roundlong.cn</div><div>*.ukmqtnsc.cn</div><div>*.ultimate-replicas.com</div><div>*.xeuiavwp.cn</div><div>09cfn.ptijsbat.cn</div><div>4nwnzdw.yxukawlv.cn</div><div>6fuwf.listweek.cn</div><div>9tqtg7.srwuiuyc.cn</div><div>admin.cnsffmvssw.cn</div><div>admin.flushstreet.com</div><div>admin.flushwrong.com</div><div>admin.flushyear.com</div><div>admin.fvqdalrfuj.cn</div><div>admin.iaxacrug.cn</div><div>admin.iqbgwrue.cn</div><div>admin.ittjdfhh.cn</div><div>admin.listweek.cn</div><div>admin.padfgrvbit.cn</div><div>admin.ptijsbat.cn</div><div>admin.srwuiuyc.cn</div><div>admin.ultimate-replicas.com</div><div>admin.yxukawlv.cn</div><div>b9or.veiqscia.cn</div><div>cnsffmvssw.cn</div><div>f3vxcw6.fvqdalrfuj.cn</div><div>fbevgi.cnsffmvssw.cn</div><div>flushstreet.com</div><div>flushwrong.com</div><div>flushyear.com</div><div>fvqdalrfuj.cn</div><div>ht92tu.padfgrvbit.cn</div><div>iaxacrug.cn</div><div>iqbgwrue.cn</div><div>ittjdfhh.cn</div><div>jei70p.icesfjsfsb.cn</div><div>listweek.cn</div><div>ns1.cnsffmvssw.cn</div><div>ns1.flushstreet.com</div><div>ns1.flushwrong.com</div><div>ns1.flushyear.com</div><div>ns1.fvqdalrfuj.cn</div><div>ns1.iqbgwrue.cn</div><div>ns1.listweek.cn</div><div>ns1.padfgrvbit.cn</div><div>ns1.ukmqtnsc.cn</div><div>ns1.ultimate-replicas.com</div><div>ns1.yeiexixo.cn</div><div>ns2.cnsffmvssw.cn</div><div>ns2.fvqdalrfuj.cn</div><div>ns2.iqbgwrue.cn</div><div>ns2.ittjdfhh.cn</div><div>ns2.listweek.cn</div><div>ns2.padfgrvbit.cn</div><div>ns2.xeuiavwp.cn</div><div>omsw98.seiapsny.cn</div><div>padfgrvbit.cn</div><div>ultimate-replicas.com</div><div>wyr.ittjdfhh.cn</div><div>xcwd.yxukawlv.cn</div><div><br /></div><div class="blogger-post-footer"><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/2992238913899645252-1477293793142525120?l=www.web2secure.com'/></div> <p><a href="http://feedads.g.doubleclick.net/~a/aSuZ-F8ePHHSl2Gdg9bXCQ6gdqA/0/da"><img src="http://feedads.g.doubleclick.net/~a/aSuZ-F8ePHHSl2Gdg9bXCQ6gdqA/0/di" border="0" ismap="true"></img></a><br/> <a href="http://feedads.g.doubleclick.net/~a/aSuZ-F8ePHHSl2Gdg9bXCQ6gdqA/1/da"><img src="http://feedads.g.doubleclick.net/~a/aSuZ-F8ePHHSl2Gdg9bXCQ6gdqA/1/di" border="0" ismap="true"></img></a></p>secur065webhttp://www.blogger.com/profile/03927955797207814790noreply@blogger.com0http://www.web2secure.com/2009/11/spam-04-nov-09.htmltag:blogger.com,1999:blog-2992238913899645252.post-993322917295083072009-11-02T08:56:00.000-08:002009-11-02T08:59:51.038-08:002009-11-02T08:59:51.038-08:00This is not something new, I would like to post again here so that Windows 7 or Vista users aware about this. Normally the intrusion prevention in your systems will alerting when SpyNet is pinging. <div><br /></div><div><br /></div><div><div><b>Microsoft Security Essentials</b></div><div><br /></div><div>Microsoft Security Essentials is the latest avatar of Microsoft antispyware. It is a signature based free antimalware software that can be used to protect your system against potential threats, such as viruses, spyware, and other potentially unwanted software.</div><div><br /></div><div><b>Microsoft Spynet</b></div><div><br /></div><div>When you first install Microsoft Security Essentials you agree to become a part of this unfortunately named community of Windows Defender and Microsoft Security Essentials users. Microsoft SpyNet helps Microsoft in differentiating a malware program from a legitimate program based on inputs automatically collected from the Microsoft SpyNet members.</div><div><br /></div><div>There are two types of memberships basic and advanced. As a basic member -which is the default- your copy of Microsoft Security Essentials “sends basic information to Microsoft about software that Microsoft Security Essentials detects, including where the software came from, the actions that you apply or that Microsoft Security Essentials applies automatically, and whether the actions were successful. In some instances, personal information might unintentionally be sent to Microsoft. However, Microsoft will not use this information to identify you or to contact you.”</div><div><br /></div><div>An advanced member sends more information in addition to what is stated above and again “in some instances, personal information might unintentionally be sent to Microsoft.” Microsoft Security Essentials also collects standard computer information, which includes information about your computer software and hardware, such as your IP address, operating system, Web browser software, and version.”</div><div><br /></div><div>There is no option not to participate in the SpyNet community. Microsoft Security Essentials privacy policy confirms that “to continue using Microsoft Security Essentials, you will need to remain a member of this online community.”</div><div><br /></div><div>The mandatory enrolling of members in the SpyNet community makes many people to see red and seek ways to disable Microsoft SpyNet without losing the functionality of Microsoft Security Essentials.</div><div>Blocking Microsoft SpyNet without losing functionality</div><div><br /></div><div>According to Microsoft documentation “The online Microsoft SpyNet community helps you see how other people respond to software that has not yet been classified for risks. You can use this information to help you choose whether to allow this software on your computer. In turn, if you participate, your choices are added to the community ratings to help other people decide what to do. ” The community also helps stop the spread of new infections.</div><div><br /></div><div>This means that if you block Microsoft SpyNet your choices in rating the programs that you run are NOT added to the community while you use other people’s choices to respond to potential threats. If you really want to do this, proceed further.</div><div><br /></div><div>There are two ways to go about this. One is through editing the registry and the other is by entering couple of entries to your hosts file.</div><div>Block Microsoft SpyNet by editing the Registry</div><div><br /></div><div>All caveats about editing the Windows registry apply here. Before you edit the registry, export the keys in the registry that you plan to edit, or back up the whole registry. How to back up and restore the registry in Windows</div><div><br /></div><div>Type regedit in the run command box and press enter to open the registry editor. Navigate and select the following key on the left pane:</div></div><div><br /></div><div>Reference: <a href="http://www.malwarehelp.org/how-to-block-microsoft-spynet-2009.html">www.malwarehelp.org</a></div><div class="blogger-post-footer"><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/2992238913899645252-99332291729508307?l=www.web2secure.com'/></div> <p><a href="http://feedads.g.doubleclick.net/~a/y-86-GjDbGjx971_tfzVMWrlpOI/0/da"><img src="http://feedads.g.doubleclick.net/~a/y-86-GjDbGjx971_tfzVMWrlpOI/0/di" border="0" ismap="true"></img></a><br/> <a href="http://feedads.g.doubleclick.net/~a/y-86-GjDbGjx971_tfzVMWrlpOI/1/da"><img src="http://feedads.g.doubleclick.net/~a/y-86-GjDbGjx971_tfzVMWrlpOI/1/di" border="0" ismap="true"></img></a></p>secur065webhttp://www.blogger.com/profile/03927955797207814790noreply@blogger.com0http://www.web2secure.com/2009/11/how-to-block-microsoft-spynet.htmltag:blogger.com,1999:blog-2992238913899645252.post-15122177932572052462009-11-02T08:49:00.000-08:002009-11-02T08:56:08.369-08:002009-11-02T08:56:08.369-08:00Reference: <a href="http://blog.didierstevens.com/2009/11/02/cve-2009-2979-or-the-xml-bombed-pdf/">blog.didierstevens.com</a><div><br /></div><div>Didier Steven disclosed about PDF exploit that related to Extensible Metadata Platform. Adobe already aware about this vulnerability and patched was released to fix the vulnerability.</div><div><br /></div><div><img src="http://1.bp.blogspot.com/_N2xP0b-ECBo/Su8PFwx01GI/AAAAAAAAA1c/hSYN6F3uls8/s320/steven.PNG" style="cursor:pointer; cursor:hand;width: 320px; height: 169px;" border="0" alt="" id="BLOGGER_PHOTO_ID_5399551069908161634" /></div><div><br /></div><div class="blogger-post-footer"><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/2992238913899645252-1512217793257205246?l=www.web2secure.com'/></div> <p><a href="http://feedads.g.doubleclick.net/~a/WbHvdbD9A0odays-sz9uGjqVqLA/0/da"><img src="http://feedads.g.doubleclick.net/~a/WbHvdbD9A0odays-sz9uGjqVqLA/0/di" border="0" ismap="true"></img></a><br/> <a href="http://feedads.g.doubleclick.net/~a/WbHvdbD9A0odays-sz9uGjqVqLA/1/da"><img src="http://feedads.g.doubleclick.net/~a/WbHvdbD9A0odays-sz9uGjqVqLA/1/di" border="0" ismap="true"></img></a></p>secur065webhttp://www.blogger.com/profile/03927955797207814790noreply@blogger.com0http://www.web2secure.com/2009/11/xml-bombed-pdf.htmltag:blogger.com,1999:blog-2992238913899645252.post-8883440463482365472009-11-02T08:38:00.000-08:002009-11-02T08:49:38.847-08:002009-11-02T08:49:38.847-08:00Not surprising that Facebook become one of the threat landscape for the last few months and the more and more threat will come from Facebook. My reader today sent me email regarding the spam message that spread from hacked or compromised accounts. The message sound "<b>Saturday News simple-works.org</b>". It will enticing the friends within the account to view the URL link that posted in message. From here, users can be easily become victim and vulnerable to the web attacks.<div><img src="http://2.bp.blogspot.com/_N2xP0b-ECBo/Su8M0hU2RsI/AAAAAAAAA1M/gd-3vRpSW8E/s320/fbspam-edit.PNG" style="cursor:pointer; cursor:hand;width: 320px; height: 162px;" border="0" alt="" id="BLOGGER_PHOTO_ID_5399548574679058114" /></div><div><br /></div><div><br /></div><div>Other than facebook, twitter also become another threat landscape for spreading the suspicious link. According to "<b>trendistic.com</b>", "<b>simple-works.org</b>" words are one of the famous words spread through twitters. </div><div><br /></div><div><img src="http://2.bp.blogspot.com/_N2xP0b-ECBo/Su8M00GluKI/AAAAAAAAA1U/Ib5CPr_Py1E/s320/fbspam2-edit.PNG" style="cursor:pointer; cursor:hand;width: 320px; height: 178px;" border="0" alt="" id="BLOGGER_PHOTO_ID_5399548579719526562" /></div><div><br /></div><div>Reference: <span class="Apple-style-span" style="font-weight: bold; "><a href="http://trendistic.com">trendistic.com</a></span></div><div class="blogger-post-footer"><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/2992238913899645252-888344046348236547?l=www.web2secure.com'/></div> <p><a href="http://feedads.g.doubleclick.net/~a/RK4qT1UpTEIctykQVWChpTOnVEo/0/da"><img src="http://feedads.g.doubleclick.net/~a/RK4qT1UpTEIctykQVWChpTOnVEo/0/di" border="0" ismap="true"></img></a><br/> <a href="http://feedads.g.doubleclick.net/~a/RK4qT1UpTEIctykQVWChpTOnVEo/1/da"><img src="http://feedads.g.doubleclick.net/~a/RK4qT1UpTEIctykQVWChpTOnVEo/1/di" border="0" ismap="true"></img></a></p>secur065webhttp://www.blogger.com/profile/03927955797207814790noreply@blogger.com2http://www.web2secure.com/2009/11/simple-worksorg-spamming-in-facebook.htmltag:blogger.com,1999:blog-2992238913899645252.post-14371143100049024702009-10-30T04:30:00.000-07:002009-10-30T04:38:54.709-07:002009-10-30T04:38:54.709-07:00Spam links from my inbox<div><br /></div><div><div>http://www.iqbgwrue.cn</div><div>http://www.ipuiubue.cn</div><div>http://yozninext.com/</div><div>http://www.barafcp.cn</div><div>http://www.kulagqz.cn</div><div>http://optin.fanbox.com</div><div>http://xikugsc.cn</div><div>http://www.buwonjv.cn</div><div>http://www.sumavys.cn</div><div>http://www.iblmbdue.cn</div><div>http://yozninext.com</div><div>http://www.onzxckea.cn</div><div>http://xikugsc.cn/</div><div>http://www.qejindj.cn</div><div>http://www.yoxufog.cn</div><div>http://www.omjpvvea.cn</div><div>http://kayupyp.cn</div><div>http://www.zilazon.cn</div><div>http://kayupyp.cn</div><div>http://www.opqzrlea.cn</div><div>http://www.ikfysaue.cn</div><div>http://www.gubobos.cn</div><div>http://www.nuzopeh.cn</div><div>http://www.iypjvgue.cn</div><div>http://0rj3op.taficpk.cn</div><div>http://9kaps.uecawsnr.cn</div><div>http://bd00c.toqorcy.cn</div><div>http://7e1c1.jehegyc.cn</div><div>http://0c77e.ratalcj.cn</div><div>http://c503.wiriccq.cn</div><div>http://than.wucidxg.cn</div><div>http://f8d5.togovys.cn</div><div>http://dd005.gocofgr.cn</div><div>http://6f8.josayjr.cn</div><div>http://6d03bb.mukaktl.cn</div><div>http://12cf.nupaqjv.cn</div><div>http://6d208.bomavpf.cn</div><div>http://invitel.hu/frstcchl/3.html</div><div>http://de72.zohorsc.cn</div><div>http://0ac39d.zohorsc.cn</div></div><div class="blogger-post-footer"><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/2992238913899645252-1437114310004902470?l=www.web2secure.com'/></div> <p><a href="http://feedads.g.doubleclick.net/~a/krHih-E9qeraZt0Xub7NeLpMumo/0/da"><img src="http://feedads.g.doubleclick.net/~a/krHih-E9qeraZt0Xub7NeLpMumo/0/di" border="0" ismap="true"></img></a><br/> <a href="http://feedads.g.doubleclick.net/~a/krHih-E9qeraZt0Xub7NeLpMumo/1/da"><img src="http://feedads.g.doubleclick.net/~a/krHih-E9qeraZt0Xub7NeLpMumo/1/di" border="0" ismap="true"></img></a></p>secur065webhttp://www.blogger.com/profile/03927955797207814790noreply@blogger.com0http://www.web2secure.com/2009/10/spam-30-oct.htmltag:blogger.com,1999:blog-2992238913899645252.post-55627692693015197952009-10-29T09:47:00.000-07:002009-10-29T09:53:56.055-07:002009-10-29T09:53:56.055-07:00My reader sent me email regarding their country Malaysia's largest bank Maybank fake websites. She would like to share out with readers who link to here.<div><br /><div><img src="http://3.bp.blogspot.com/_N2xP0b-ECBo/SunH2eeu5UI/AAAAAAAAA08/UmvpBVKTx2c/s320/maybank.PNG" style="cursor:pointer; cursor:hand;width: 320px; height: 168px;" border="0" alt="" id="BLOGGER_PHOTO_ID_5398065367089079618" /></div><div><br /></div><div><img src="http://2.bp.blogspot.com/_N2xP0b-ECBo/SunH2rqcWRI/AAAAAAAAA1E/CT5T5D80hqc/s320/maybank1.PNG" style="cursor:pointer; cursor:hand;width: 320px; height: 168px;" border="0" alt="" id="BLOGGER_PHOTO_ID_5398065370627856658" /></div><div><br /></div><div>Phishing website:</div><div><div>hxxp://sebastianschaper.net/aegabi06/cache/May2u-Service/Maybank2u_com.html</div><div>hxxp://tradewindcay.com/images/Internet-Customer/Maybank2u.html</div><div><br /></div><div><br /></div><div><div>IP Address: <b>62.140.23.135</b></div><div><br /></div><div>Domains sharing same IP address:</div><div><br /></div><div>*.bierhaus79cent.com</div><div>*.days-of-defeat.com</div><div>*.direct-headhunter.com</div><div>*.direkt-headhunter.com</div><div>*.freesurfmag.com</div><div>*.geniale-geldquelle.de</div><div>*.hardcore-basicwear.com</div><div>*.hardcorebasicwear.com</div><div>*.papenrode.com</div><div>*.rank-records.com</div><div>*.ruhoglu.com</div><div>*.sanjoes.com</div><div>*.smoothlights.com</div><div>*.urnatur.com</div><div>*.wertholz-handel.com</div><div>*.wertholzhandel.com</div><div>*.wwwsk-gaming.com</div><div>*.xlixi.com</div><div>*.ziami-business-marketing.com</div><div>alex-treff.com</div><div>alwaysdollar.com</div><div>architekturverlag.com</div><div>b-waren.com</div><div>beauty-date.com</div><div>bidilicious-records.com</div><div>bierhaus79cent.com</div><div>bosporos.net</div><div>business-language-support.com</div><div>chiacanemondo.com</div><div>crazypinup.com</div><div>das-ginge.com</div><div>days-of-defeat.com</div><div>deadlyviperassassinationsquad.com</div><div>der-naturgarten.com</div><div>dineia.com</div><div>direct-headhunter.com</div><div>direkt-headhunter.com</div><div>elbetaler.com</div><div>enterprise-buisness.com</div><div>excedense.com</div><div>feuerloescher-tv.com</div><div>fostaclicc.com</div><div>freesurfmag.com</div><div>friseurmeisterin.com</div><div>fruehgeburt.com</div><div>geniale-geldquelle.de</div><div>hardcore-basicwear.com</div><div>hardcorebasicwear.com</div><div>hocazade.net</div><div>hyde-undead.com</div><div>influenzapandemie.com</div><div>isotecs.com</div><div>just-fx.com</div><div>knowledgediscoverer.com</div><div>langerle.com</div><div>mail.alex-treff.com</div><div>mail.bierhaus79cent.com</div><div>mail.bosporos.net</div><div>mail.crazypinup.com</div><div>mail.direct-headhunter.com</div><div>mail.direkt-headhunter.com</div><div>mail.freesurfmag.com</div><div>mail.geniale-geldquelle.de</div><div>mail.hardcore-basicwear.com</div><div>mail.hocazade.net</div><div>mail.mariavit.com</div><div>mail.panmental.com</div><div>mail.papenrode.com</div><div>mail.rank-records.com</div><div>mail.relaxdivers.com</div><div>mail.relaxdivers.net</div><div>mail.ruf-wilhelmshaven.net</div><div>mail.ruhoglu.com</div><div>mail.sanjoes.com</div><div>mail.sebastianschaper.net</div><div>mail.smoothlights.com</div><div>mail.teamspeak-showtime.de</div><div>mail.urnatur.com</div><div>mail.wertholz-handel.com</div><div>mail.wertholzhandel.com</div><div>mail.wwwsk-gaming.com</div><div>mail.xlixi.com</div><div>mail.ziami-business-marketing.com</div><div>mariavit.com</div><div>mc-loft.com</div><div>mediaontour.com</div><div>meseth.com</div><div>michael-neefe.com</div><div>mysaptuning.com</div><div>noal-entertainment.com</div><div>o3-bar.com</div><div>p201b.user.evanzo-server.de</div><div>panmental.com</div><div>papenrode.com</div><div>peermedien.com</div><div>projektblog.com</div><div>rank-records.com</div><div>reise06.com</div><div>relaxdivers.com</div><div>ruf-wilhelmshaven.net</div><div>ruhoglu.com</div><div>schweizer-bauen.com</div><div>schweizerbauen.com</div><div>sebastianschaper.net</div><div>seniorexpertnet.com</div><div>sex-stars-nackt.com</div><div>showtime.teamspeak-showtime.de</div><div>sientec.com</div><div>stelmacher.com</div><div>tanz-mit.com</div><div>teamspeak-showtime.de</div><div>textexport.com</div><div>the-dark-sun.com</div><div>urnatur.com</div><div>wertholz-handel.com</div><div>wertholzhandel.com</div><div>wwwsk-gaming.com</div><div>x-citer.com</div><div>xlixi.com</div><div>ziami-business-marketing.com</div><div>zupanet.com</div><div><br /></div><div><br /></div><div>IP Address: <b>76.163.230.210</b></div><div><br /></div><div>Domains sharing same IP address:</div><div><br /></div><div>*.tradewindcay.com</div><div>tradewindcay.com</div></div></div><div><br /></div></div><div class="blogger-post-footer"><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/2992238913899645252-5562769269301519795?l=www.web2secure.com'/></div> <p><a href="http://feedads.g.doubleclick.net/~a/q2WPWTDLbxx3kISnZPOiMJagWEM/0/da"><img src="http://feedads.g.doubleclick.net/~a/q2WPWTDLbxx3kISnZPOiMJagWEM/0/di" border="0" ismap="true"></img></a><br/> <a href="http://feedads.g.doubleclick.net/~a/q2WPWTDLbxx3kISnZPOiMJagWEM/1/da"><img src="http://feedads.g.doubleclick.net/~a/q2WPWTDLbxx3kISnZPOiMJagWEM/1/di" border="0" ismap="true"></img></a></p>secur065webhttp://www.blogger.com/profile/03927955797207814790noreply@blogger.com0http://www.web2secure.com/2009/10/fake-malaysia-maybank-website-phishing.htmltag:blogger.com,1999:blog-2992238913899645252.post-13845178814088373282009-10-28T09:03:00.000-07:002009-10-28T09:13:41.036-07:002009-10-28T09:13:41.036-07:00<a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://3.bp.blogspot.com/_N2xP0b-ECBo/SuhrqZ-rl5I/AAAAAAAAA00/XrA73Vb8OSA/s1600-h/msn.PNG"><img style="cursor:pointer; cursor:hand;width: 320px; height: 230px;" src="http://3.bp.blogspot.com/_N2xP0b-ECBo/SuhrqZ-rl5I/AAAAAAAAA00/XrA73Vb8OSA/s320/msn.PNG" border="0" alt="" id="BLOGGER_PHOTO_ID_5397682529676007314" /></a><br /><div><br /></div><div>IP Address: <b>121.54.174.85</b></div><div><br /></div><div>Domains sharing same IP address:</div><div><br /></div><div><div>fq4xnx.see-they-blocked-me.com</div><div>www.ooo-seems-im-blocked.com</div><div>ahem-they-blocked-me.com</div><div>cindrella-blocked-me.com</div><div>damnn-they-blocked-me.com</div><div>did-they-block-you.com</div><div>face-blocked-truth.com</div><div>find-reason-of-being-blocked.com</div><div>finding-who-blocks.com</div><div>friends-block-buddies.com</div><div>grab-block-status.com</div><div>grab-my-block-status.com</div><div>have-they-blocked-you.com</div><div>heroes-never-block.com</div><div>how-come-they-block-me.com</div><div>im-fedup-of-being-blocked.com</div><div>im-sad-im-blocked.com</div><div>ima-checking-block-status.com</div><div>jesus-he-blocked-us.com</div><div>kephsa.why-do-they-block.com</div><div>lame-friends-block-you.com</div><div>leme-check-block-status.com</div><div>mean-friends-block.com</div><div>mjzfx0.why-do-they-block.com</div><div>no-damn-way-im-blocked.com</div><div>notice-they-blocked-u.com</div><div>oh-i-was-blocked.com</div><div>omg-they-blocked-me.com</div><div>phew-they-blocked-me.com</div><div>phewww-seems-i-am-blocked.com</div><div>puff-im-blocked.com</div><div>pwdgds.grab-my-block-status.com</div><div>sad-i-was-blocked.com</div><div>tchv9l.find-reason-of-being-blocked.com</div><div>they-were-haha.com</div><div>ufff-i-was-blocked.com</div><div>urr-he-blocked-us.com</div><div>weird-i-was-blocked.com</div><div>who-let-me-block.com</div><div>why-do-they-block.com</div><div>why-my-friends-block.com</div><div>wooh-im-blocked.com</div><div>www.ahem-they-blocked-me.com</div><div>www.ahh-im-blocked.com</div><div>www.damn-im-blocked.com</div><div>www.damnn-they-blocked-me.com</div><div>www.did-they-block-you.com</div><div>www.duh-i-got-blocked.com</div><div>www.face-blocked-truth.com</div><div>www.finding-who-blocks.com</div><div>www.friends-block-buddies.com</div><div>www.grab-my-block-status.com</div><div>www.have-they-blocked-you.com</div><div>www.hey-you-block-me.com</div><div>www.how-come-they-block-me.com</div><div>www.im-fedup-of-being-blocked.com</div><div>www.im-sad-im-blocked.com</div><div>www.ima-checking-block-status.com</div><div>www.jealoused-people-block.com</div><div>www.jesus-he-blocked-us.com</div><div>www.jesus-im-blocked.com</div><div>www.lame-friends-block-you.com</div><div>www.leme-check-block-status.com</div><div>www.let-people-laugh.com</div><div>www.let-them-hehe.com</div><div>www.mean-friends-block.com</div><div>www.my-block-status-check.com</div><div>www.my-friends-block-me.com</div><div>www.my-mates-blocked-me.com</div><div>www.no-damn-way-im-blocked.com</div><div>www.notice-they-blocked-u.com</div><div>www.oh-i-was-blocked.com</div><div>www.ohh-ma-friend-blocked-me.com</div><div>www.omg-they-blocked-me.com</div><div>www.phew-they-blocked-me.com</div><div>www.puff-im-blocked.com</div><div>www.query-block-status.com</div><div>www.sad-i-was-blocked.com</div><div>www.see-they-blocked-me.com</div><div>www.they-were-haha.com</div><div>www.ufff-i-was-blocked.com</div><div>www.urr-he-blocked-us.com</div><div>www.weird-i-was-blocked.com</div><div>www.who-let-me-block.com</div><div>www.why-do-they-block.com</div><div>www.why-i-got-blocked.com</div><div>www.why-my-friends-block.com</div><div>www.wooh-im-blocked.com</div><div>www.ooo-seems-im-blocked.com</div><div>see-they-blocked-me.com</div><div>fq4xnx.see-they-blocked-me.com</div></div><div class="blogger-post-footer"><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/2992238913899645252-1384517881408837328?l=www.web2secure.com'/></div> <p><a href="http://feedads.g.doubleclick.net/~a/NFmhKeldJ2M1xeCd_eVPX6mWnOE/0/da"><img src="http://feedads.g.doubleclick.net/~a/NFmhKeldJ2M1xeCd_eVPX6mWnOE/0/di" border="0" ismap="true"></img></a><br/> <a href="http://feedads.g.doubleclick.net/~a/NFmhKeldJ2M1xeCd_eVPX6mWnOE/1/da"><img src="http://feedads.g.doubleclick.net/~a/NFmhKeldJ2M1xeCd_eVPX6mWnOE/1/di" border="0" ismap="true"></img></a></p>secur065webhttp://www.blogger.com/profile/03927955797207814790noreply@blogger.com0http://www.web2secure.com/2009/10/msn-messenger-block-checker-phishing.htmltag:blogger.com,1999:blog-2992238913899645252.post-77378022746388947982009-10-27T08:35:00.000-07:002009-10-27T08:37:49.581-07:002009-10-27T08:37:49.581-07:00Reference: <a href="http://www.thetechherald.com/article.php/200944/4682/Researcher-discloses-SQL-Injection-flaw-on-barackobama-com">thetechherald.com</a><br /><br />Update:<br /><br />Jascha Franklin-Hodge, CTO at Blue State Digital, responded to our earlier questions with the following.<br /><br />"As we treat all security issues with the utmost seriousness, we have been working closely with Organizing for America to investigate this alleged SQL injection problem. After careful review, we are confident that the screenshot included in this bug does not contain any data from the barackobama.com site or any other site hosted by Blue State Digital, the DNC, or Organizing for America."<br /><br />"The screenshot, per the "KeyWord" box, appears to be related to a "Roosevelt University Calendar Events," not a site that is hosted by Blue State Digital, nor connected with barackobama.com. Microsoft Access is not used in any capacity on the barackobama.com site or servers."<br /><br />This statement only adds a little more weight to our earlier assumption. Unu has apparently accessed a database on the same server that is unrelated to President Obama’s site. We’ve asked Blue State Digital to confirm if this is in fact the case.<br /><br />If so, we asked why an SQLi from President Obama's site allowed access to the Access database.<br /><br />The answer given was firm, "There is no SQL injection issue on our servers or those hosting/related to the barackobama.com site. We do not run Microsoft Access anywhere in our organization, nor do we (or DNC/OFA) run or host to any calendar at Roosevelt University."<br /><br />It was suggeted that we talk to Unu, who made the allegation in the first place. We've done so and if we hear back, we'll update this story again.<br /><br />Original Article:<br /><br />Unu, the researcher responsible for several site vulnerability disclosures in the past, says there are SQL Injection (SQLi) flaws on barackobama.com. He said these flaws allowed him to access usernames and passwords used on the President's domain. At the same time, the DNC disagrees with him, saying that the information provided is based on incorrect assertions.<br /><br />According to the blog post by Unu, an unsecured parameter in President Obama’s personal domain leads to the SQL Injection, allowing access to the database on the server. Interestingly enough, the database accessed in his example was a MS Access database. MS Access is a database format often rejected by developers on massive Web projects.<br /><br />“We have a table admin. And in this table we can see that the admin passwords are in PLAIN TEXT! The website is big, with many sections, and there are 19 admins. What else we need to get full access on the website? Nothing. After we log in as admins, we can virtually do anything we want with the website: upload PHPShells, redirects, infect pages with Trojan droppers, [and even deface the whole website],” Unu wrote.<br /><br />Continue<a href="http://www.thetechherald.com/article.php/200944/4682/Researcher-discloses-SQL-Injection-flaw-on-barackobama-com">... </a><div class="blogger-post-footer"><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/2992238913899645252-7737802274638894798?l=www.web2secure.com'/></div> <p><a href="http://feedads.g.doubleclick.net/~a/vbK0t3Nkqx8bdCievUCzPU4dOqs/0/da"><img src="http://feedads.g.doubleclick.net/~a/vbK0t3Nkqx8bdCievUCzPU4dOqs/0/di" border="0" ismap="true"></img></a><br/> <a href="http://feedads.g.doubleclick.net/~a/vbK0t3Nkqx8bdCievUCzPU4dOqs/1/da"><img src="http://feedads.g.doubleclick.net/~a/vbK0t3Nkqx8bdCievUCzPU4dOqs/1/di" border="0" ismap="true"></img></a></p>secur065webhttp://www.blogger.com/profile/03927955797207814790noreply@blogger.com0http://www.web2secure.com/2009/10/researcher-discloses-sql-injection-flaw.htmltag:blogger.com,1999:blog-2992238913899645252.post-67229466765009934632009-10-27T07:03:00.000-07:002009-10-27T07:08:50.857-07:002009-10-27T07:08:50.857-07:00<div>IP Address: <b>85.17.138.27</b></div><div><b><br /></b></div><div>Domain sharing same IP address:</div><div><br /></div><div>check-your-iq.ru</div><div>age-bio.ru</div><div>age-ega.ru</div><div>age-info.ru</div><div>agebee.ru</div><div>ageegle.ru</div><div>aggge.ru</div><div>b-i-o-v.ru</div><div>before-life.ru</div><div>beofree.ru</div><div>bestage.ru</div><div>bio-v.ru</div><div>bio-vozrast.ru</div><div>bionaft.ru</div><div>biovoz.ru</div><div>brynetka.ru</div><div>dedlife.ru</div><div>dub-dubom.ru</div><div>former-life.ru</div><div>formerlife.ru</div><div>hochesh-li.ru</div><div>icq-mobila.ru</div><div>icq-tel.ru</div><div>icqtel.ru</div><div>iq-iq.ru</div><div>iqste.ru</div><div>last-another-life.ru</div><div>last-life.ru</div><div>lifoon.ru</div><div>medical-static-center.ru</div><div>neupadi.ru</div><div>nokiaicq.ru</div><div>offiget.ru</div><div>on-liffe.ru</div><div>open-life.ru</div><div>previous-life.ru</div><div>professional-test.ru</div><div>qiiiq.ru</div><div>russkitrax.ru</div><div>some-other-life.ru</div><div>soul-in-you.ru</div><div>soulinyou.ru</div><div>styleicq.ru</div><div>superorgazm.ru</div><div>svestnik.ru</div><div>telicq.ru</div><div>test-health.ru</div><div>test-medicine.ru</div><div>testbio.ru</div><div>the-past.ru</div><div>theprevious.ru</div><div>what-is-your-iq.ru</div><div>www.goored.com</div><div>www.karaokeplus.info</div><div>you-bio.ru</div><div>your-bio.ru</div><div>your-great-mind.ru</div><div>yourbio.ru</div><div><br /></div><div>IP Address: <b>85.17.237.5</b></div><div><br /></div><div>Domain sharing same IP address:</div><div><br /></div><div>*.forbookings.com</div><div>*.mail.forbookings.com</div><div>*.mybetorwager.cn</div><div>*.udta.in</div><div>39u.ru</div><div>3b4.ru</div><div>3cw.ru</div><div>a3j.ru</div><div>a3l.at</div><div>a3l.ru</div><div>a5f.at</div><div>a5g.ru</div><div>a5h.ru</div><div>a5i.at</div><div>a5j.at</div><div>a5j.ru</div><div>a5l.at</div><div>a5m.at</div><div>a8d.ru</div><div>aamelkov.hobby-site.com</div><div>age-age.ru</div><div>age-bio.ru</div><div>agebee.ru</div><div>ageegle.ru</div><div>agend.ru</div><div>autobestwestern.cn</div><div>b5z.ru</div><div>b6l.at</div><div>b6t.at</div><div>b7g.at</div><div>b7g.ru</div><div>b8o.ru</div><div>b9g.ru</div><div>beeeo.ru</div><div>beeoo.ru</div><div>bigtopliteworld.cn</div><div>bio-oib.ru</div><div>bio-tube.ru</div><div>bio-v.ru</div><div>biozavr.ru</div><div>biozov.ru</div><div>bitest.ru</div><div>c1z.at</div><div>c1z.ru</div><div>c5y.at</div><div>c7r.at</div><div>c8b.ru</div><div>c8k.ru</div><div>c9u.ru</div><div>ce5.ru</div><div>ciqx.in</div><div>coolnamemart.cn</div><div>dub-dubom.ru</div><div>f5l.at</div><div>f5x.at</div><div>f7y.ru</div><div>f8a.ru</div><div>findbigthinker.cn</div><div>forbookings.com</div><div>gasa.in</div><div>giantnonfat.cn</div><div>hugetopnonfat.cn</div><div>iletisim.hopto.org</div><div>inhouselabel.cn</div><div>inother.ru</div><div>iq-mozgi.ru</div><div>iqdoza.ru</div><div>kburmenko.go.dyndns.org</div><div>life-before.ru</div><div>liteautoexcellent.cn</div><div>litefinestdirect.cn</div><div>litetopfindguide.cn</div><div>liteupyourride.cn</div><div>lotante.cn</div><div>lotmachinesguide.cn</div><div>mail.forbookings.com</div><div>nanotopdiscover.cn</div><div>nonfathighestlocate.cn</div><div>operations.serveftp.com</div><div>past-another-life.ru</div><div>pornishe.ru</div><div>previous-life.ru</div><div>professional-test.ru</div><div>q0w.ru</div><div>q5v.ru</div><div>red-wolf.ru</div><div>russkitrax.ru</div><div>superorgazm.ru</div><div>t-age.ru</div><div>test-health.ru</div><div>the-previous.ru</div><div>theanotherlife.ru</div><div>u1l.ru</div><div>u1x.ru</div><div>u3h.ru</div><div>u6v.ru</div><div>u7e.ru</div><div>u8i.ru</div><div>udta.in</div><div>uppd.in</div><div>www.bigtopmanagement.cn</div><div>www.finditinbigapple.cn</div><div>www.forbookings.com</div><div>www.mail.forbookings.com</div><div>x0v.ru</div><div>x3b.ru</div><div>x6i.ru</div><div>x7d.ru</div><div>x9f.ru</div><div>x9u.ru</div><div>x9v.ru</div><div>x9w.ru</div><div>xe6.ru</div><div>xh3.ru</div><div>xj4.ru</div><div>xk9.ru</div><div>xv8.ru</div><div>yourbio.ru</div><div>yourlitetopfind.cn</div><div>yournamequickshop.cn</div><div>zdlz.in</div><div><br /></div><div>IP Address: <b>91.121.24.139</b></div><div><br /></div><div>Domains sharing same IP address:</div><div>*.a3j.ru</div><div>*.a5j.ru</div><div>*.a5l.at</div><div>*.agebio.ru</div><div>*.b3a.ru</div><div>*.b5r.ru</div><div>*.b6l.at</div><div>*.b7p.ru</div><div>*.b9g.at</div><div>*.beage.ru</div><div>*.beo-free.ru</div><div>*.bestbeo.ru</div><div>*.bi-test.ru</div><div>*.bio-free.ru</div><div>*.bionaft.ru</div><div>*.biovoz.ru</div><div>*.c1z.ru</div><div>*.c6p.at</div><div>*.c7r.at</div><div>*.c8k.ru</div><div>*.c8t.at</div><div>*.ce5.at</div><div>*.f5x.at</div><div>*.f5x.ru</div><div>*.f7g.ru</div><div>*.f7y.at</div><div>*.last-life.ru</div><div>*.soul-in-you.ru</div><div>*.uppd.in</div><div>*.xj4.ru</div><div>*.xv8.ru</div><div>*.you-bio.ru</div><div>*.youbio.ru</div><div>*.your-age.ru</div><div>18-plus.ru</div><div>39u.ru</div><div>3b4.ru</div><div>a3j.ru</div><div>a3l.at</div><div>a3l.ru</div><div>a5f.at</div><div>a5g.ru</div><div>a5j.ru</div><div>a5l.at</div><div>a5m.at</div><div>a8d.ru</div><div>agebio.ru</div><div>ageee.ru</div><div>ageend.ru</div><div>ageinf.ru</div><div>b5z.ru</div><div>b6l.at</div><div>b6t.at</div><div>b7g.at</div><div>b8o.ru</div><div>b9g.ru</div><div>beage.ru</div><div>beeeo.ru</div><div>beeoo.ru</div><div>bestbeo.ru</div><div>bio-free.ru</div><div>bio-z.ru</div><div>c1z.at</div><div>c1z.ru</div><div>c5y.at</div><div>c7r.at</div><div>c8b.ru</div><div>c8k.ru</div><div>c9u.ru</div><div>ce5.ru</div><div>cedric-guduff.com</div><div>check-your-iq.ru</div><div>dima-bilan-gey.ru</div><div>f5l.at</div><div>f5x.at</div><div>f7y.ru</div><div>f8a.ru</div><div>formerlife.ru</div><div>iq-mozgi.ru</div><div>iqdoza.ru</div><div>ks24667.kimsufi.com</div><div>lekiss.net</div><div>liteautoexcellent.cn</div><div>off-life.ru</div><div>past-another-life.ru</div><div>pornishe.ru</div><div>q5v.ru</div><div>roxane-sara.com</div><div>roxane-sara.net</div><div>roxanesara.com</div><div>roxanesara.net</div><div>roxyblog.net</div><div>sex-finish.ru</div><div>sexfinish.ru</div><div>soul-in-you.ru</div><div>t-age.ru</div><div>test-medicine.ru</div><div>testoid.ru</div><div>thomasmenga.com</div><div>tiqt.ru</div><div>u1l.ru</div><div>uppd.in</div><div>www.a3j.ru</div><div>www.a3l.ru</div><div>www.b3a.ru</div><div>www.b6l.at</div><div>www.b9g.at</div><div>www.bigtopliteworld.cn</div><div>www.c6y.at</div><div>www.c7r.at</div><div>www.c8k.ru</div><div>www.dub-dubom.ru</div><div>www.litehitscar.cn</div><div>www.mymixwager.cn</div><div>www.thebettings.cn</div><div>xj4.ru</div><div>xk9.ru</div><div>xv8.ru</div><div>your-age.ru</div><div>your-great-mind.ru</div><div><br /></div><div>IP Address: <b>91.121.167.41</b></div><div><br /></div><div>Domains sharing same IP address:</div><div><br /></div><div>*.a5f.at</div><div>*.a5m.ru</div><div>*.b5r.at</div><div>*.bqtl.in</div><div>*.findbigshots.cn</div><div>*.nanotopdiscover.cn</div><div>*.oaty.in</div><div>*.q0a.ru</div><div>*.q1k.ru</div><div>*.superorgazm.ru</div><div>*.u0s.in</div><div>*.xb5.ru</div><div>*.xc8.ru</div><div>18-plus.ru</div><div>a5f.ru</div><div>a5i.ru</div><div>age-t.ru</div><div>b5r.at</div><div>b6l.ru</div><div>bigtopbrands.cn</div><div>bigtoprocks.cn</div><div>bio-a.ru</div><div>c5e.at</div><div>c6y.ru</div><div>creativeblockplay.cn</div><div>f6e.at</div><div>f7p.at</div><div>f9a.at</div><div>filmoflife.cn</div><div>findyourbigidea.cn</div><div>gasa.in</div><div>gianthighest.cn</div><div>gzpf.in</div><div>hugebestbuys.cn</div><div>jumbobestrate.cn</div><div>jxsb.in</div><div>kbgg.in</div><div>ks361128.kimsufi.com</div><div>litehighestmodel.cn</div><div>litetopdiscoversite.cn</div><div>litetopseeksite.cn</div><div>lotmachinesguide.cn</div><div>martpictureexistence.cn</div><div>mediahomenameshopmovie.cn</div><div>mixbetonline.cn</div><div>mixgrouptravel.cn</div><div>namegamestore.cn</div><div>namemartfilmlife.cn</div><div>ns6.bestlitediscover.cn</div><div>playslotbet.cn</div><div>powermixplay.cn</div><div>q0a.ru</div><div>q0i.ru</div><div>q0j.ru</div><div>q0k.ru</div><div>q1k.ru</div><div>q3b.ru</div><div>q3e.ru</div><div>q47.ru</div><div>q5a.ru</div><div>q5k.ru</div><div>rnfs.in</div><div>shopfilmlifeonline.cn</div><div>shopmoviefestival.cn</div><div>shoponlinefilmsite.cn</div><div>shopvideocommission.cn</div><div>spzr.in</div><div>superbetsports.cn</div><div>superdietfind.cn</div><div>thebestwaytofind.cn</div><div>thelitelocate.cn</div><div>themixbet.cn</div><div>u0b.ru</div><div>u0c.ru</div><div>u0t.ru</div><div>u1m.ru</div><div>u1w.ru</div><div>u1y.ru</div><div>u3w.ru</div><div>u3y.ru</div><div>u6d.ru</div><div>u6k.ru</div><div>u6n.ru</div><div>u7p.ru</div><div>u7x.ru</div><div>u8b.ru</div><div>u9j.ru</div><div>www.a3h.ru</div><div>www.a3j.at</div><div>www.a3l.at</div><div>www.a5f.at</div><div>www.a5h.at</div><div>www.a5h.ru</div><div>www.a5i.at</div><div>www.a5j.at</div><div>www.a5j.ru</div><div>www.a5m.at</div><div>www.atxh.in</div><div>www.bigpremiumlite.cn</div><div>www.bigtopfindsite.cn</div><div>www.bqtl.in</div><div>www.coolnamemart.cn</div><div>www.f5l.ru</div><div>www.shopfilmlifescience.cn</div><div>www.shopmovielife.cn</div><div>www.u0s.in</div><div>www.u6l.ru</div><div>www.u7f.ru</div><div>www.u9a.in</div><div>www.x9m.ru</div><div>www.yourfilmlife.cn</div><div>x6q.ru</div><div>x6r.ru</div><div>x8b.ru</div><div>x8f.ru</div><div>x8m.ru</div><div>xb5.ru</div><div>xg9.ru</div><div>xj7.ru</div><div>xq0.ru</div><div>yourfilmlife.cn</div><div><br /></div><div>IP Address: <b>94.75.198.241</b></div><div><br /></div><div>Domains sharing same IP address:</div><div><br /></div><div>*.cmshop.dk</div><div>2a.cmshop.dk</div><div>911test.ru</div><div>age-inf.ru</div><div>age-t.ru</div><div>bestbio.ru</div><div>biersted.net</div><div>check-your-iq.ru</div><div>cmshop.dk</div><div>dima-bilan-gey.ru</div><div>grubi.ru</div><div>intelq.ru</div><div>lifezilla.ru</div><div>mail.biersted.net</div><div>mail.cmshop.dk</div><div>onelifebefore.ru</div><div>partnertest.net</div><div>pornomig.ru</div><div>samsungicq.ru</div><div>sex-finish.ru</div><div>sexfinish.ru</div><div>test-death.ru</div><div>testodrome.ru</div><div>testoid.ru</div><div>testometr.ru</div><div>yaiq.ru</div><div><br /></div><div>IP Address: <b>89.248.174.58</b></div><div><br /></div><div>Domains sharing same IP address:</div><div><br /></div><div>12scanner.com</div><div>allaboutentourage.com</div><div>chupachupsorg.com</div><div>computer-antivirus19.com</div><div>eric-clapton2009.cn</div><div>ns2.wempowa.com</div><div>the-offspring.cn</div><div><br /></div><div><br /></div><div>Not Active domains:</div><div><br /></div><div>mycomputerbestscan11.com</div><div>mycomputerfastscan11.com</div><div>www.my-garden-state.com</div><div>iron-mit-wine.com</div><div><br /></div><div class="blogger-post-footer"><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/2992238913899645252-6722946676500993463?l=www.web2secure.com'/></div> <p><a href="http://feedads.g.doubleclick.net/~a/RgoL7nxror1ruD_5K_HKLyrOKos/0/da"><img src="http://feedads.g.doubleclick.net/~a/RgoL7nxror1ruD_5K_HKLyrOKos/0/di" border="0" ismap="true"></img></a><br/> <a href="http://feedads.g.doubleclick.net/~a/RgoL7nxror1ruD_5K_HKLyrOKos/1/da"><img src="http://feedads.g.doubleclick.net/~a/RgoL7nxror1ruD_5K_HKLyrOKos/1/di" border="0" ismap="true"></img></a></p>secur065webhttp://www.blogger.com/profile/03927955797207814790noreply@blogger.com0http://www.web2secure.com/2009/10/spam-27-oct-09.htmltag:blogger.com,1999:blog-2992238913899645252.post-90067148857853466732009-10-27T05:18:00.000-07:002009-10-27T06:44:34.006-07:002009-10-27T06:44:34.006-07:00SEO poisoning is common trend used to spread rouge av software. Usually, this type of attack coupled with relevant big event key words or related terms. Today, what I found was totally different from common behavior that noticed from different security blogs. <div><br /></div><div>Upon visiting to rouge av, users not more presented with standard fake website and force users to download rouge av software. New method used to install on users system directly without users interaction. Users's system desktop wallpaper will be changed with "YOUR SYSTEM IS INFECTED", and red icon will appear under at icon panel.<img src="http://4.bp.blogspot.com/_N2xP0b-ECBo/SubrYMUL8_I/AAAAAAAAAzc/7OgSj96csJs/s320/icon.PNG" style="cursor:pointer; cursor:hand;width: 71px; height: 28px;" border="0" alt="" id="BLOGGER_PHOTO_ID_5397260004305400818" /></div><div><br /></div><div><img src="http://1.bp.blogspot.com/_N2xP0b-ECBo/SubrXs2ivoI/AAAAAAAAAzM/CxHWcePKYHQ/s320/desktop.PNG" style="cursor:pointer; cursor:hand;width: 320px; height: 161px;" border="0" alt="" id="BLOGGER_PHOTO_ID_5397259995859566210" /></div><div><br /></div><div><img src="http://2.bp.blogspot.com/_N2xP0b-ECBo/SubrXw5OG4I/AAAAAAAAAzU/tBwHHZjgzAY/s320/error.PNG" style="cursor:pointer; cursor:hand;width: 320px; height: 66px;" border="0" alt="" id="BLOGGER_PHOTO_ID_5397259996944538498" /></div><div><br /></div><div>What happen behind the scenario was visiting to compromised website will be redirecting to lucklysploits site.</div><div><br /></div><div><img src="http://1.bp.blogspot.com/_N2xP0b-ECBo/SubrYa0jPjI/AAAAAAAAAzk/Ey2om-IuKuo/s320/main.PNG" style="cursor:pointer; cursor:hand;width: 320px; height: 169px;" border="0" alt="" id="BLOGGER_PHOTO_ID_5397260008199241266" /></div><div><br /></div><div>After De-obfuscating</div><div><br /></div><div><img src="http://4.bp.blogspot.com/_N2xP0b-ECBo/Subr8Pj3anI/AAAAAAAAAzs/MnObiZHmJ4A/s320/main1.PNG" style="cursor:pointer; cursor:hand;width: 320px; height: 30px;" border="0" alt="" id="BLOGGER_PHOTO_ID_5397260623651760754" /></div><div><br /></div><div>Redirector with hostname "morning1.cn" will redirecting to LuckySploit page that look similar like this.</div><div><br /></div><div>Obfuscated code</div><div><img src="http://1.bp.blogspot.com/_N2xP0b-ECBo/SubtvtBqLrI/AAAAAAAAAz8/cRx8vf6m0lc/s320/exploitz1.PNG" style="cursor:pointer; cursor:hand;width: 320px; height: 169px;" border="0" alt="" id="BLOGGER_PHOTO_ID_5397262607246306994" /></div><div><br /></div><div>First layer - De-obfuscate</div><div><img src="http://3.bp.blogspot.com/_N2xP0b-ECBo/SubtvbsdVyI/AAAAAAAAAz0/rPV-nwNIouM/s320/exploitz.PNG" style="cursor:pointer; cursor:hand;width: 320px; height: 169px;" border="0" alt="" id="BLOGGER_PHOTO_ID_5397262602593982242" /></div><div><br /></div><div>Second layers - De-Obfuscate</div><div><img src="http://4.bp.blogspot.com/_N2xP0b-ECBo/Subtvziw3-I/AAAAAAAAA0E/g4I5VWZltkI/s320/exploitz2.PNG" style="cursor:pointer; cursor:hand;width: 320px; height: 169px;" border="0" alt="" id="BLOGGER_PHOTO_ID_5397262608995770338" /></div><div><br /></div><div>CLSIDs found:</div><div><br /></div><div>- BD96C556-65A3-11D0-983A-00C04FC29E30 </div><div>- BD96C556-65A3-11D0-983A-00C04FC29E36 (MS06-014)</div><div>- AB9BCEDD-EC7E-47E1-9322-D4A210617116 (MDAC Vulnerability)</div><div>- 0006F033-0000-0000-C000-000000000046</div><div>- 0006F03A-0000-0000-C000-000000000046</div><div>- 6e32070a-766d-4ee6-879c-dc1fa91d2fc3</div><div>- 6414512B-B978-451D-A0D8-FCFDF33E833C</div><div>- 7F5B7F63-F06F-4331-8A26-339E03C0AE3D</div><div>- 06723E09-F4C2-43c8-8358-09FCD1DB0766</div><div>- 639F725F-1B2D-4831-A9FD-874847682010</div><div>- BA018599-1DB3-44f9-83B4-461454C84BF8</div><div>- D0C07D56-7C69-43F1-B4A0-25F5A11FAB19</div><div>- E8CCCDDF-CA28-496b-B050-6C07C962476B (CVE-2007-0717)</div><div>- 0955AC62-BF2E-4CBA-A2B9-A63F772D46CF (CVE 2008-0015)</div><div><br /></div><div><br /></div><div>MS Office Web Components Spreadsheet (OWC10.Spreadsheet Exploit)</div><div><img src="http://2.bp.blogspot.com/_N2xP0b-ECBo/SubxxEalgjI/AAAAAAAAA0U/G4L7fmQ6F0c/s320/exploitz3.PNG" style="cursor:pointer; cursor:hand;width: 320px; height: 169px;" border="0" alt="" id="BLOGGER_PHOTO_ID_5397267028751254066" /></div><div><br /></div><div>Once system detected contain vulnerability, javascript contain with malware download links "<b>Setup.exe</b>" and "<b>go.jpg</b>" will be triggered. The "Setup.exe" currently has detection rate of about <b>2.44</b> <b>percent</b> on Virustotal. :(</div><div><br /></div><div><img src="http://3.bp.blogspot.com/_N2xP0b-ECBo/SubxVhbAT1I/AAAAAAAAA0M/qDPQKlr7VvE/s320/vtz.PNG" style="cursor:pointer; cursor:hand;width: 320px; height: 129px;" border="0" alt="" id="BLOGGER_PHOTO_ID_5397266555501301586" /></div><div><br /></div><div>"<b>g</b><b>o.jpg</b>" currently have detection rate of about <b>7.32</b><b> percent</b> of Virustotal, contains code like below.</div><div><br /></div><div><img src="http://1.bp.blogspot.com/_N2xP0b-ECBo/Sub0cybd9HI/AAAAAAAAA0k/x8Z_YcJrrQM/s320/goz1.PNG" style="cursor:pointer; cursor:hand;width: 320px; height: 169px;" border="0" alt="" id="BLOGGER_PHOTO_ID_5397269978860614770" /></div><div><br /></div><div><img src="http://1.bp.blogspot.com/_N2xP0b-ECBo/Sub0dDfYPWI/AAAAAAAAA0s/m6Ch__SPiqc/s320/vtz1.PNG" style="cursor:pointer; cursor:hand;width: 320px; height: 130px;" border="0" alt="" id="BLOGGER_PHOTO_ID_5397269983440420194" /></div><div><br /></div><div>And the last was another two malware file "<b>SetupAdvancedVirusRemover.exe</b>" rogue av and "<b>dfghfghgfj.d</b><b>ll</b>" will be download to system. Each of sample gain <b>48.79% percen</b>t and <b>63.42% <span class="Apple-style-span" style="font-weight: normal; "><b>percent</b> in Virustotal respectively.</span></b></div><div><br /></div><div><br /></div><div>Malicious IP address involved:</div><div>- morning1.cn - <b>91.212.198.152</b> (Rusia)</div><div>- coolcount1.com - <b>91.207.116.55</b></div><div>- downloadavr7.com- <b>91.207.116.55</b></div><div><br /></div><div>Domains sharing same IP address: <b>91.212.198.152</b></div><div><br /></div><div><div>morning1.cn </div><div>homut1.cn</div><div>morning1.cn</div><div>scan-your-pc.cn</div><div>www.morning1.cn</div><div>yt6tyg.cn</div><div><br /></div><div><br /></div><div>Domains sharing same IP address: <b>91.207.116.55</b></div><div><br /></div><div>10-open-davinci.com</div><div>advanced-virus-remover-2009.com</div><div>advanced-virusremover-2009.com</div><div>advanced-virusremover2009.com</div><div>advancedvirusremover-2009.com</div><div>best-scan-pc.com</div><div>best-scanpc.com</div><div>best-scanpc.net</div><div>best-scanpc.org</div><div>cathrynzfunz.com</div><div>coolcount1.com</div><div>downloadavr6.com</div><div>downloadavr7.com</div><div>mail.10-open-davinci.com</div><div>mail.advanced-virus-remover-2009.com</div><div>mail.advanced-virusremover2009.com</div><div>mail.best-scan-pc.com</div><div>mail.best-scanpc.org</div><div>mail.cathrynzfunz.com</div><div>mail.coolcount1.com</div><div>mail.downloadavr6.com</div><div>mail.downloadavr7.com</div><div>mail.hard-xxx-tube.com</div><div>mail.testavrdown.com</div><div>mail.xxx-white-tube.net</div><div>testavrdown.com</div><div>www.advanced-virus-remover-2009.com</div><div>www.advancedvirus-remover2009.com</div><div>www.advancedvirusremover-2009.com</div><div>www.best-scan-pc.com</div><div>www.best-scanpc.net</div><div>www.best-scanpc.org</div><div>www.hard-xxx-tube.com</div><div>www.onlinescanxppro.com</div><div>xxx-white-tube.net</div><div><br /></div><div>Thanks,</div><div><br /></div><div>--X0end</div></div><div class="blogger-post-footer"><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/2992238913899645252-9006714885785346673?l=www.web2secure.com'/></div> <p><a href="http://feedads.g.doubleclick.net/~a/JpACx5RNeSCIelvn2MEsiJ5b4ks/0/da"><img src="http://feedads.g.doubleclick.net/~a/JpACx5RNeSCIelvn2MEsiJ5b4ks/0/di" border="0" ismap="true"></img></a><br/> <a href="http://feedads.g.doubleclick.net/~a/JpACx5RNeSCIelvn2MEsiJ5b4ks/1/da"><img src="http://feedads.g.doubleclick.net/~a/JpACx5RNeSCIelvn2MEsiJ5b4ks/1/di" border="0" ismap="true"></img></a></p>secur065webhttp://www.blogger.com/profile/03927955797207814790noreply@blogger.com0http://www.web2secure.com/2009/10/advanced-virus-remover-hxxpmorning1cn.htmltag:blogger.com,1999:blog-2992238913899645252.post-75368966080787028632009-10-26T08:20:00.000-07:002009-10-26T08:33:33.473-07:002009-10-26T08:33:33.473-07:00<div><span class="Apple-style-span" style=" white-space: pre; font-family:Arial;"><span class="Apple-style-span" style="font-size: small;">Africacareerguidance main page.</span></span></div><div><span class="Apple-style-span" style="font-family:Arial;"><span class="Apple-style-span" style="font-size: small; white-space: pre;"><br /></span></span></div><div><img src="http://3.bp.blogspot.com/_N2xP0b-ECBo/SuW_cDyTgvI/AAAAAAAAAys/blXIVk0Ze48/s320/main.PNG" style="cursor:pointer; cursor:hand;width: 320px; height: 169px;" border="0" alt="" id="BLOGGER_PHOTO_ID_5396930217246950130" /></div><div><br /></div><div>Source Code:</div><div><img src="http://2.bp.blogspot.com/_N2xP0b-ECBo/SuW_cabdwLI/AAAAAAAAAy0/9ElbDWAfjEg/s320/code.PNG" style="cursor:pointer; cursor:hand;width: 320px; height: 169px;" border="0" alt="" id="BLOGGER_PHOTO_ID_5396930223325167794" /><br /><br /></div><div>Download link:<br /><img src="http://3.bp.blogspot.com/_N2xP0b-ECBo/SuW_csc92HI/AAAAAAAAAy8/LSS9cjFshYo/s320/main1.PNG" style="cursor:pointer; cursor:hand;width: 320px; height: 169px;" border="0" alt="" id="BLOGGER_PHOTO_ID_5396930228163303538" /><br /><div><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://3.bp.blogspot.com/_N2xP0b-ECBo/SuW_cDyTgvI/AAAAAAAAAys/blXIVk0Ze48/s1600-h/main.PNG"></a><br /><div><br /></div><div>crack_1_.45155.exe (<a href="http://www.virustotal.com/analisis/954989bcda871a01f70fda9a2180b427f6cd34e388fa3a6cfac6d58702dfc3bb-1256570316">Virustotal</a> 6/41)</div><div><br /></div><div>crack_2_.45155.exe (<a href="http://www.virustotal.com/analisis/ff95a46cb45c2d20261df93d1edaded3ddfc4f30c6d7c7f03e91e00abbc76f96-1256570328">Virustota</a>l 6/41)</div><div><br /></div><div><img src="http://2.bp.blogspot.com/_N2xP0b-ECBo/SuXAcqNoT3I/AAAAAAAAAzE/nLKl4a93-FY/s320/code1.PNG" style="cursor:pointer; cursor:hand;width: 320px; height: 17px;" border="0" alt="" id="BLOGGER_PHOTO_ID_5396931327073734514" /></div><div><br /></div></div></div><div class="blogger-post-footer"><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/2992238913899645252-7536896608078702863?l=www.web2secure.com'/></div> <p><a href="http://feedads.g.doubleclick.net/~a/Rou2dSBrxwUSuh_47X26DVI89KE/0/da"><img src="http://feedads.g.doubleclick.net/~a/Rou2dSBrxwUSuh_47X26DVI89KE/0/di" border="0" ismap="true"></img></a><br/> <a href="http://feedads.g.doubleclick.net/~a/Rou2dSBrxwUSuh_47X26DVI89KE/1/da"><img src="http://feedads.g.doubleclick.net/~a/Rou2dSBrxwUSuh_47X26DVI89KE/1/di" border="0" ismap="true"></img></a></p>secur065webhttp://www.blogger.com/profile/03927955797207814790noreply@blogger.com0http://www.web2secure.com/2009/10/wwwafricacareerguidancecom.htmltag:blogger.com,1999:blog-2992238913899645252.post-75204397454672509432009-10-24T06:41:00.000-07:002009-10-24T21:16:21.112-07:002009-10-24T21:16:21.112-07:00My reader sent my email regarding that "<b>jeanietomanek.com</b>" was compromised to host multiple exploits code and contain link redirecting to another exploits side also.<div><br /></div><div>_vti_bin/nav_links.php<br /><div><img src="http://4.bp.blogspot.com/_N2xP0b-ECBo/SuMEP44P5AI/AAAAAAAAAx8/5-oEwNXaT0k/s320/jeanie.PNG" style="cursor: pointer; width: 320px; height: 114px;" alt="" id="BLOGGER_PHOTO_ID_5396161449532843010" border="0" /></div><div><br /></div><div>First layer - De-obfuscated code "nav_links.php"</div><div><img src="http://1.bp.blogspot.com/_N2xP0b-ECBo/SuMEQi8x3NI/AAAAAAAAAyE/jcVtNh3qxh8/s320/jeanie1.PNG" style="cursor: pointer; width: 320px; height: 102px;" alt="" id="BLOGGER_PHOTO_ID_5396161460826135762" border="0" /></div><div><br /></div><div><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://3.bp.blogspot.com/_N2xP0b-ECBo/SuMERfeQR3I/AAAAAAAAAyU/pM2cjv5viw8/s1600-h/tapiroten.PNG"></a>Second layer- De-obfuscated code "nav_links.php"</div><div><br /><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://3.bp.blogspot.com/_N2xP0b-ECBo/SuMERJdJ-KI/AAAAAAAAAyM/7lYLGWAEs2M/s1600-h/jeanie2.PNG"><img style="cursor: pointer; width: 320px; height: 109px;" src="http://3.bp.blogspot.com/_N2xP0b-ECBo/SuMERJdJ-KI/AAAAAAAAAyM/7lYLGWAEs2M/s320/jeanie2.PNG" alt="" id="BLOGGER_PHOTO_ID_5396161471162480802" border="0" /></a></div><div><br /></div><div>From second layer de-obfuscated, there have few URL links:</div><div><br /></div><div>- http://tapiroten.info/lin.cgi?XceKRRySKWKKZKeKKYgYluSiFWKeKRWlclXuKYlYcYWieFKKKYKyKXKKKKKKKKKYK</div><div>- http://tapiroten.info/lin.cgi?XceKRRySKWKKZKeKKWgYluSiFWKeKRWlclXuKYlYcYWieFKKKYKyKXKKKKKKKKYK (DirectShow 0Day)</div><div><div>-http://tapiroten.info/lin.cgi?XceKRRySKWKKZKeKKWgYluSiFWKeKRWlclXuKYlYcYWieFKKKYKyKXKKKKKKKKKe (QuickTime)</div><div>- http://tapiroten.info/lin.cgi?XceKRRySKWKKZKeKKYgYluSiFWKeKRWlclXuKYlYcYWieFKKKYKyKXKKKKKKKKKjK </div></div><div>- http://tapiroten.info/lin.cgi?XceKRRySKWKKZKeKKWgYluSiFWKeKRWlclXuKYlYcYWieFKKKYKyKXKKKKKKKKWS (PDF Exploit) <a href="http://www.virustotal.com/analisis/96ce87971ade11870f07af5af3de1a49d66092558cec33b4e82d96fe9edb5aa9-1256405121">VirusTotal</a> (4/41)</div><div><br /></div><div><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://3.bp.blogspot.com/_N2xP0b-ECBo/SuMERJdJ-KI/AAAAAAAAAyM/7lYLGWAEs2M/s1600-h/jeanie2.PNG"></a><img src="http://4.bp.blogspot.com/_N2xP0b-ECBo/SuM5_tdMfWI/AAAAAAAAAyk/PAfYn6D55_A/s320/cmd.PNG" style="cursor: pointer; width: 320px; height: 245px;" alt="" id="BLOGGER_PHOTO_ID_5396220545216576866" border="0" /></div><div><br /></div><div>Analyst standalone malicious PDF will end with nothing, because there have separate function that visible after second-layer de-obfuscated. It will make analysis work harder. Vulnerable Adobe PDF will crashed when open the PDF file, and it will downloading malware to system that detected by most of Anti-Virus (<a href="http://www.virustotal.com/analisis/8a1218da6bdb03427a9bf48a8f8015b47e1ce0ea7564c3609453a0f712a68811-1256392583">Virustota</a>l 38/41)</div><div><br />From the second layer, obviously this code launched multiple exploits in one page. And it seem exploiting is not enough until it redirecting to "tapiroten.info"</div><div><div><br /></div><div>-tapiroten.info/lin.cgi?jzo</div><div>-tapiroten.info/lin.cgi?XceKRRySKWKKZKeKKKgYluSiFWKeKRWlclXuKYlYcYWieSZZKYeFeRYlSFSjKKKKKKKKKK</div><div>-tapiroten.info//lin.cgi?XceKRRySKWKKZKeKKYgYluSiFWKeKRWlclXuKYlYcYWieFKKKYKyKXKKKKKKKKKYK0 (exe) <a href="http://www.virustotal.com/analisis/46774f9fcd9a6c66f5bb37f642368a0b1115bdb0d5229c57c38bb9a151e10631-1256390052">VirusTotal</a> (23/41)</div><div><br /></div><div>-tapiroten.info/lin.cgi?jzo</div><div><br /><div><img src="http://3.bp.blogspot.com/_N2xP0b-ECBo/SuMERfeQR3I/AAAAAAAAAyU/pM2cjv5viw8/s320/tapiroten.PNG" style="cursor: pointer; width: 320px; height: 114px;" alt="" id="BLOGGER_PHOTO_ID_5396161477072668530" border="0" /></div><div><br /></div><div>De-obfuscated code:</div><div><img src="http://4.bp.blogspot.com/_N2xP0b-ECBo/SuM3Lopo_zI/AAAAAAAAAyc/UZ37z_nlDXA/s320/tapiroten1.PNG" style="cursor: pointer; width: 320px; height: 201px;" alt="" id="BLOGGER_PHOTO_ID_5396217451550146354" border="0" /></div><div><br /></div><div>CLSID found:</div><div><br /></div><div>- BD96C556-65A3-11D0-983A-00C04FC29E36 (MS06-014) </div><div>- 0955AC62-BF2E-4CBA-A2B9-A63F772D46CF (CVE 2008-0015)</div><div>- 02BF25D5-8C17-4B23-BC80-D3488ABDDC6B (CVE-2007-0717)</div><div>- FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6 (CVE-2007-6250)</div><div>- AB9BCEDD-EC7E-47E1-9322-D4A210617116 (MDAC Vulnerability)</div><div>- BD96C556-65A3-11D0-983A-00C04FC29E3o</div><div>- BD96C556-65A3-11D0-983A-00C04FC29E36</div><div>- 0006F033-0000-0000-C000-000000000046</div><div>- 0006F03A-0000-0000-C000-000000000046</div><div>- 6e32070a-766d-4ee6-879c-dc1fa91d2fc3</div><div>- 6414512B-B978-451D-A0D8-FCFDF33E833C</div><div>- 7F5B7F63-F06F-4331-8A26-339E03C0AE3D</div><div>- 06723E09-F4C2-43c8-8358-09FCD1DB0766</div><div>- 639F725F-1B2D-4831-A9FD-874847682010</div><div>- BA018599-1DB3-44f9-83B4-461454C84BF8</div><div>- D0C07D56-7C69-43F1-B4A0-25F5A11FAB19</div><div>- E8CCCDDF-CA28-496b-B050-6C07C962476B</div><div>- 527196a4-b1a3-4647-931d-37ba5af23037 (CVE-2006-0003)</div><div>- d27cdb6e-ae6d-11cf-96b8-444553540000 (CVE-2006-0003)</div><div><br /></div><div>Malicious IP address involved:</div><div>- jeanietomanek.com - 216.39.57.106</div><div>- tapiroten.info - 216.150.79.76</div><div>- 216.155.153.212</div><div>- 174.139.241.2</div><div>- 209.31.180.144</div><div><br /></div><div>Domains sharing same IP address: <b>216.150.79.76</b></div><div><br /></div><div><div>cacorq.info</div><div>clxhbz.info</div><div>dgrxqh.info</div><div>diwiowano.info</div><div>dmdurz.info</div><div>ftp.centod.com</div><div>funkol.info</div><div>geetol.info</div><div>gitoer.info</div><div>gutrandin.info</div><div>hizfek.info</div><div>hopore.info</div><div>ivgzda.info</div><div>jopqae.info</div><div>kolpao.info</div><div>nadotraza.info</div><div>ns.centod.com</div><div>ns2.centod.com</div><div>ofahitino.info</div><div>oirjsa.info</div><div>ornotivec.info</div><div>pirtaf.info</div><div>pop.centod.com</div><div>popsto.info</div><div>qxfcuc.info</div><div>rellok.info</div><div>ruhcsy.info</div><div>sacmtf.info</div><div>sdoras.info</div><div>tapiroten.info</div><div>tiizwb.info</div><div>traxemere.info</div><div>tuerog.info</div><div>ulmqmq.info</div><div>vivibt.info</div><div>www.cacorq.info</div><div>www.centod.com</div><div>www.clxhbz.info</div><div>www.dmdurz.info</div><div>www.geetol.info</div><div>www.gitoer.info</div><div>www.hizfek.info</div><div>www.hopore.info</div><div>www.jimlkn.info</div><div>www.jopqae.info</div><div>www.kolpao.info</div><div>www.niraynome.info</div><div>www.oirjsa.info</div><div>www.pirtaf.info</div><div>www.popsto.info</div><div>www.qxfcuc.info</div><div>www.rellok.info</div><div>www.ruhcsy.info</div><div>www.sdoras.info</div><div>www.tapiroten.info</div><div>www.tiizwb.info</div><div>www.tuerog.info</div><div>www.vivibt.info</div><div>www.yyoqny.info</div><div>xsxydj.info</div><div>yuncdjbiw.info</div><div>yyoqny.info</div><div><br /></div></div><div>Sigh...it really make me tire to analysis this malicious link. The efforts are become harder and harder when evade techniques are improved lots. While Anti-virus have cloud-security computing, and hacker/bad guys have cloud-antisecurity computing.</div><div><br /></div><div>--X0end</div></div></div></div><div class="blogger-post-footer"><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/2992238913899645252-7520439745467250943?l=www.web2secure.com'/></div> <p><a href="http://feedads.g.doubleclick.net/~a/4CudejAsuCXwecXtvkvOy5ykcoY/0/da"><img src="http://feedads.g.doubleclick.net/~a/4CudejAsuCXwecXtvkvOy5ykcoY/0/di" border="0" ismap="true"></img></a><br/> <a href="http://feedads.g.doubleclick.net/~a/4CudejAsuCXwecXtvkvOy5ykcoY/1/da"><img src="http://feedads.g.doubleclick.net/~a/4CudejAsuCXwecXtvkvOy5ykcoY/1/di" border="0" ismap="true"></img></a></p>secur065webhttp://www.blogger.com/profile/03927955797207814790noreply@blogger.com1http://www.web2secure.com/2009/10/jeanietomanekcom-compromised-to-host.htmltag:blogger.com,1999:blog-2992238913899645252.post-30615792908057457852009-10-24T01:45:00.000-07:002009-10-24T01:49:15.652-07:002009-10-24T01:49:15.652-07:00<div>Remove.Total.Security.com</div><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://2.bp.blogspot.com/_N2xP0b-ECBo/SuK-_l1rpsI/AAAAAAAAAx0/HYT-Pm9gV_o/s1600-h/removespyware.PNG"><img style="cursor:pointer; cursor:hand;width: 320px; height: 149px;" src="http://2.bp.blogspot.com/_N2xP0b-ECBo/SuK-_l1rpsI/AAAAAAAAAx0/HYT-Pm9gV_o/s320/removespyware.PNG" border="0" alt="" id="BLOGGER_PHOTO_ID_5396085303241582274" /></a><div><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://2.bp.blogspot.com/_N2xP0b-ECBo/SuK-_l1rpsI/AAAAAAAAAx0/HYT-Pm9gV_o/s1600-h/removespyware.PNG"></a><br /><div><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://2.bp.blogspot.com/_N2xP0b-ECBo/SuK-_l1rpsI/AAAAAAAAAx0/HYT-Pm9gV_o/s1600-h/removespyware.PNG"></a><br /><div>IP Address: <b>208.73.210.27</b></div><div><br /></div><div>spywareprotect2009.com</div><div>3798283.com</div><div>aafsco.com</div><div>absoluteinc.com</div><div>alahdadibrick.com</div><div>alexstram.com</div><div>auditrack.com</div><div>azais.net</div><div>bait-zion.com</div><div>bankvisalia.com</div><div>billmonroefoundation.com</div><div>bodyextreme.com</div><div>bookmarkthispage.com</div><div>bostonbiomedica.com</div><div>brandspecialists.com</div><div>breakthebank.ca</div><div>brook.absoluteinc.com</div><div>celebris.net</div><div>cell2pc.com</div><div>cityassistedliving.com</div><div>clef.ca</div><div>connercreekacademy.com</div><div>cport.com</div><div>customag.com</div><div>davidboyce.com</div><div>dsredirection.com</div><div>e-emco.com</div><div>e-tradinghouse.com</div><div>espotting.info</div><div>evilkey.com</div><div>exchange.makery.com</div><div>exinder.com</div><div>exoticfrogs.com</div><div>fazetron.com</div><div>ftp.messageserver.com</div><div>g-spotting.com</div><div>gabber.us</div><div>geilestars.com</div><div>goodwebsearch.net</div><div>gulamcn.com</div><div>handlanu.net</div><div>harwoodgolf.com</div><div>hotdogsrfun.com</div><div>inetbusiness.com</div><div>inetonline.net</div><div>intellogix.net</div><div>khorasanibrick.com</div><div>live11.com</div><div>mail.bodyextreme.com</div><div>mail.brandspecialists.com</div><div>mail.geilestars.com</div><div>mail.gulamcn.com</div><div>mail.hotdogsrfun.com</div><div>mail.inetonline.net</div><div>mail.majorconnection.com</div><div>mail.messageserver.com</div><div>mail.suesse-maedchen.com</div><div>mailhost.brook.absoluteinc.com</div><div>majorconnection.com</div><div>makery.com</div><div>marwan.ca</div><div>mcaretail.com</div><div>menas.net</div><div>messageserver.com</div><div>mlbk.com</div><div>mmmtech.com</div><div>momyu.net</div><div>mypeoplecanada.com</div><div>nepalink.net</div><div>netwebpage.com</div><div>nonstopsolution.net</div><div>ns.gulamcn.com</div><div>ns1.alahdadibrick.com</div><div>ns1.bhwy.net</div><div>ns1.exinder.com</div><div>ns1.khorasanibrick.com</div><div>ns2.exinder.com</div><div>nyslivingmuseum.org</div><div>pajhwak.com</div><div>pal9.com</div><div>pearlcorporation.com</div><div>phukettravelshop.com</div><div>pojiejidi.com</div><div>precision-resources.com</div><div>puredirectory.com</div><div>python-hpio.net</div><div>racezoneonline.com</div><div>ragshop.com</div><div>rambos.net</div><div>rockparty.com</div><div>room41.com</div><div>russiancoins.net</div><div>salemobiles.com</div><div>samlink.com</div><div>sleftrade.com</div><div>startools.com</div><div>suesse-maedchen.com</div><div>swedenactiveholidays.com</div><div>syndic-faillite-dette.com</div><div>tfainc.com</div><div>toshibamyconnect.com</div><div>vidorpirates.com</div><div>wc3modforge.com</div><div>wembleyco.com</div><div>westernmedia.com</div><div>www.agalleria.com</div><div>www.auditrack.com</div><div>www.bostonbiomedica.com</div><div>www.breakthebank.ca</div><div>www.chs.md</div><div>www.clef.ca</div><div>www.e-emco.com</div><div>www.e-tradinghouse.com</div><div>www.handlanu.net</div><div>www.hotdogsrfun.com</div><div>www.mlbk.com</div><div>www.nyslivingmuseum.org</div><div>www.rockparty.com</div><div>www.syndic-faillite-dette.com</div><div>www.westernmedia.com</div><div>wzbt.org</div><div>zoneaffiliates.com</div><div><br /></div><div><br /></div><div>IP Address: <b>174.132.250.194</b></div><div><br /></div><div>antivirus360remover.com</div><div>av360removaltool.com</div><div>mail.malwarebot.org</div><div>mail.malwaree.com</div><div>mail.malwaree.org</div><div>mail.remove-a360.com</div><div>mail.remove-antivirus-360.com</div><div>mail.remove-antivirus-system-pro.com</div><div>mail.remove-antivirusbest.com</div><div>mail.remove-av360.com</div><div>mail.remove-ie-security.com</div><div>mail.remove-malware-defender.com</div><div>mail.remove-malware-doctor.com</div><div>mail.remove-ms-antispyware.com</div><div>mail.remove-personal-antivirus.com</div><div>mail.remove-personal-defender.com</div><div>mail.remove-spyware-guard.com</div><div>mail.remove-spyware-protect-2009.com</div><div>mail.remove-spyware-protect.com</div><div>mail.remove-system-guard.com</div><div>mail.remove-total-security.com</div><div>mail.remove-ultra-antivir-2009.com</div><div>mail.remove-ultra-antivirus-2009.com</div><div>mail.remove-virus-alarm.com</div><div>mail.remove-virus-melt.com</div><div>mail.remove-winpc-antivirus.com</div><div>mail.remove-winpc-defender.com</div><div>mail.vundofixtool.com</div><div>mail.www-malware.org</div><div>malwarebot.org</div><div>malwaree.com</div><div>malwaree.org</div><div>remove-a360.com</div><div>remove-antivirus-360.com</div><div>remove-antivirus-system-pro.com</div><div>remove-antivirusbest.com</div><div>remove-av360.com</div><div>remove-ie-security.com</div><div>remove-malware-defender.com</div><div>remove-malware-doctor.com</div><div>remove-ms-antispyware.com</div><div>remove-personal-antivirus.com</div><div>remove-personal-defender.com</div><div>remove-spyware-guard.com</div><div>remove-spyware-protect-2009.com</div><div>remove-spyware-protect.com</div><div>remove-system-guard.com</div><div>remove-total-security.com</div><div>remove-ultra-antivir-2009.com</div><div>remove-ultra-antivirus-2009.com</div><div>remove-virus-alarm.com</div><div>remove-virus-melt.com</div><div>remove-winpc-antivirus.com</div><div>remove-winpc-defender.com</div><div>smitfraudfixtool.com</div><div>vundofix.org</div><div>vundofixtool.com</div><div>www-malware.org</div><div>www.av360removaltool.com</div><div>www.malwarebot.org</div><div>www.malwaree.com</div><div>www.malwaree.org</div><div>www.remove-a360.com</div><div>www.remove-antivirus-360.com</div><div>www.remove-av360.com</div><div>www.remove-ie-security.com</div><div>www.remove-ms-antispyware.com</div><div>www.remove-spyware-protect.com</div><div>www.remove-system-guard.com</div><div>www.remove-total-security.com</div><div>www.remove-ultra-antivirus-2009.com</div><div>www.remove-virus-alarm.com</div><div>www.remove-virus-melt.com</div><div>www.vundofixtool.com</div><div><br /></div></div></div><div class="blogger-post-footer"><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/2992238913899645252-3061579290805745785?l=www.web2secure.com'/></div> <p><a href="http://feedads.g.doubleclick.net/~a/E-BUq6g4fKNe5HaywDiYIwAh-pE/0/da"><img src="http://feedads.g.doubleclick.net/~a/E-BUq6g4fKNe5HaywDiYIwAh-pE/0/di" border="0" ismap="true"></img></a><br/> <a href="http://feedads.g.doubleclick.net/~a/E-BUq6g4fKNe5HaywDiYIwAh-pE/1/da"><img src="http://feedads.g.doubleclick.net/~a/E-BUq6g4fKNe5HaywDiYIwAh-pE/1/di" border="0" ismap="true"></img></a></p>secur065webhttp://www.blogger.com/profile/03927955797207814790noreply@blogger.com0http://www.web2secure.com/2009/10/remove-spyware-protect-from-your-pc.htmltag:blogger.com,1999:blog-2992238913899645252.post-74008178082662888832009-10-24T01:09:00.000-07:002009-10-24T01:22:26.450-07:002009-10-24T01:22:26.450-07:00<div>fshanghai.net (<b>113.30.107.99</b>)</div><div><br /></div><div>main.php:</div><div><img src="http://3.bp.blogspot.com/_N2xP0b-ECBo/SuK3YSAB6WI/AAAAAAAAAxk/mwzVDNBMx8g/s320/mainscript.PNG" style="cursor:pointer; cursor:hand;width: 320px; height: 37px;" border="0" alt="" id="BLOGGER_PHOTO_ID_5396076931319982434" /></div><div><br /></div><div>Decoded code:</div><div><img src="http://3.bp.blogspot.com/_N2xP0b-ECBo/SuK3YshMwHI/AAAAAAAAAxs/H-Wz6v17uEA/s320/mainscript2.PNG" style="cursor:pointer; cursor:hand;width: 320px; height: 14px;" border="0" alt="" id="BLOGGER_PHOTO_ID_5396076938438426738" /></div><div><div>->http://fshanghai.net/zb/main.php?s=aKbK6jssA&amp;id=2</div><div>->http://fshanghai.net/zb/main.php?s=aKbK6jssA&amp;id=3</div></div><div><br /></div><div>baramdeco.net</div><div>biss.ssz.kr</div><div>eyesteal.net</div><div>forgogh.net</div><div>fshanghai.net</div><div>jrsansam.com</div><div>linkmoa.net</div><div>moonshinsa.com</div><div>silveryjoy.net</div><div>utaksa.org</div><div>332533.com</div><div>jeilnaksi.com</div><div>sansameo.com</div><div><br /></div><div class="blogger-post-footer"><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/2992238913899645252-7400817808266288883?l=www.web2secure.com'/></div> <p><a href="http://feedads.g.doubleclick.net/~a/rJeVkdwMNBXdmRZhQ7dFPhg0tAc/0/da"><img src="http://feedads.g.doubleclick.net/~a/rJeVkdwMNBXdmRZhQ7dFPhg0tAc/0/di" border="0" ismap="true"></img></a><br/> <a href="http://feedads.g.doubleclick.net/~a/rJeVkdwMNBXdmRZhQ7dFPhg0tAc/1/da"><img src="http://feedads.g.doubleclick.net/~a/rJeVkdwMNBXdmRZhQ7dFPhg0tAc/1/di" border="0" ismap="true"></img></a></p>secur065webhttp://www.blogger.com/profile/03927955797207814790noreply@blogger.com0http://www.web2secure.com/2009/10/malicious-24-oct-fshanghainet.htmltag:blogger.com,1999:blog-2992238913899645252.post-13453309253197199202009-10-24T00:19:00.000-07:002009-10-24T00:24:12.782-07:002009-10-24T00:24:12.782-07:00Recently, I received an email regarding to win brand new iPhone just through answering simple question. Believe that this is one of the scam and people fall to this kind of spam too. <div><br /></div><div><img src="http://2.bp.blogspot.com/_N2xP0b-ECBo/SuKrSe80m3I/AAAAAAAAAxM/x2uQ02u5_iM/s320/games-iphone.PNG" style="cursor:pointer; cursor:hand;width: 320px; height: 194px;" border="0" alt="" id="BLOGGER_PHOTO_ID_5396063637577440114" /></div><div><br /></div><div><img src="http://1.bp.blogspot.com/_N2xP0b-ECBo/SuKrSomKehI/AAAAAAAAAxU/Gfxl0xNXTMc/s320/games-iphone2.PNG" style="cursor:pointer; cursor:hand;width: 320px; height: 192px;" border="0" alt="" id="BLOGGER_PHOTO_ID_5396063640166758930" /></div><div><br /></div><div><img src="http://4.bp.blogspot.com/_N2xP0b-ECBo/SuKrS9j4HTI/AAAAAAAAAxc/bHlruR-cOoY/s320/games-iphone3.PNG" style="cursor:pointer; cursor:hand;width: 320px; height: 192px;" border="0" alt="" id="BLOGGER_PHOTO_ID_5396063645794311474" /></div><div><br /></div><div><br /></div><div class="blogger-post-footer"><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/2992238913899645252-1345330925319719920?l=www.web2secure.com'/></div> <p><a href="http://feedads.g.doubleclick.net/~a/EcwaVH-0GONidT_xlbuvQ7ruU2c/0/da"><img src="http://feedads.g.doubleclick.net/~a/EcwaVH-0GONidT_xlbuvQ7ruU2c/0/di" border="0" ismap="true"></img></a><br/> <a href="http://feedads.g.doubleclick.net/~a/EcwaVH-0GONidT_xlbuvQ7ruU2c/1/da"><img src="http://feedads.g.doubleclick.net/~a/EcwaVH-0GONidT_xlbuvQ7ruU2c/1/di" border="0" ismap="true"></img></a></p>secur065webhttp://www.blogger.com/profile/03927955797207814790noreply@blogger.com0http://www.web2secure.com/2009/10/win-brand-new-iphone-scam.htmltag:blogger.com,1999:blog-2992238913899645252.post-28644897789911381642009-10-23T20:34:00.000-07:002009-10-23T20:36:45.993-07:002009-10-23T20:36:45.993-07:00Reference: <a href="http://www.us-cert.gov/cas/tips/ST04-014.html">US-CERT</a><br /><br /> Cyber Security Tip ST04-014<br /> Avoiding Social Engineering and Phishing Attacks<br /><br /> Do not give sensitive information to anyone unless you are sure that they<br /> are indeed who they claim to be and that they should have access to the<br /> information.<br /><br />What is a social engineering attack?<br /><br /> In a social engineering attack, an attacker uses human interaction (social<br /> skills) to obtain or compromise information about an organization or its<br /> computer systems. An attacker may seem unassuming and respectable, possibly<br /> claiming to be a new employee, repair person, or researcher and even<br /> offering credentials to support that identity. However, by asking questions,<br /> he or she may be able to piece together enough information to infiltrate an<br /> organization's network. If an attacker is not able to gather enough<br /> information from one source, he or she may contact another source within the<br /> same organization and rely on the information from the first source to add<br /> to his or her credibility.<br /><br />What is a phishing attack?<br /><br /> Phishing is a form of social engineering. Phishing attacks use email or<br /> malicious websites to solicit personal information by posing as a<br /> trustworthy organization. For example, an attacker may send email seemingly<br /> from a reputable credit card company or financial institution that requests<br /> account information, often suggesting that there is a problem. When users<br /> respond with the requested information, attackers can use it to gain access<br /> to the accounts.<br /><br /> Phishing attacks may also appear to come from other types of organizations,<br /> such as charities. Attackers often take advantage of current events and<br /> certain times of the year, such as<br /> * natural disasters (e.g., Hurricane Katrina, Indonesian tsunami)<br /> * epidemics and health scares (e.g., H1N1)<br /> * economic concerns (e.g., IRS scams)<br /> * major political elections<br /> * holidays<br /><br />How do you avoid being a victim?<br /><br /> * Be suspicious of unsolicited phone calls, visits, or email messages from<br /> individuals asking about employees or other internal information. If an<br /> unknown individual claims to be from a legitimate organization, try to<br /> verify his or her identity directly with the company.<br /> * Do not provide personal information or information about your<br /> organization, including its structure or networks, unless you are<br /> certain of a person's authority to have the information.<br /> * Do not reveal personal or financial information in email, and do not<br /> respond to email solicitations for this information. This includes<br /> following links sent in email.<br /> * Don't send sensitive information over the Internet before checking a<br /> website's security (see Protecting Your Privacy for more information).<br /> * Pay attention to the URL of a website. Malicious websites may look<br /> identical to a legitimate site, but the URL may use a variation in<br /> spelling or a different domain (e.g., .com vs. .net).<br /> * If you are unsure whether an email request is legitimate, try to verify<br /> it by contacting the company directly. Do not use contact information<br /> provided on a website connected to the request; instead, check previous<br /> statements for contact information. Information about known phishing<br /> attacks is also available online from groups such as the Anti-Phishing<br /> Working Group (http://www.antiphishing.org).<br /> * Install and maintain anti-virus software, firewalls, and email filters<br /> to reduce some of this traffic (see Understanding Firewalls,<br /> Understanding Anti-Virus Software, and Reducing Spam for more<br /> information).<br /> * Take advantage of any anti-phishing features offered by your email<br /> client and web browser.<br /><br />What do you do if you think you are a victim?<br /><br /> * If you believe you might have revealed sensitive information about your<br /> organization, report it to the appropriate people within the<br /> organization, including network administrators. They can be alert for<br /> any suspicious or unusual activity.<br /> * If you believe your financial accounts may be compromised, contact your<br /> financial institution immediately and close any accounts that may have<br /> been compromised. Watch for any unexplainable charges to your account.<br /> * Immediately change any passwords you might have revealed. If you used<br /> the same password for multiple resources, make sure to change it for<br /> each account, and do not use that password in the future.<br /> * Watch for other signs of identity theft (see Preventing and Responding<br /> to Identity Theft for more information).<br /> * Consider reporting the attack to the police, and file a report with the<br /> Federal Trade Commission (http://www.ftc.gov/).<br /><br />Reference: <a href="http://www.us-cert.gov/cas/tips/ST04-014.html">US-CERT</a><div class="blogger-post-footer"><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/2992238913899645252-2864489778991138164?l=www.web2secure.com'/></div> <p><a href="http://feedads.g.doubleclick.net/~a/yJgw6XBCko5CX0C_ah-_bVtBxyU/0/da"><img src="http://feedads.g.doubleclick.net/~a/yJgw6XBCko5CX0C_ah-_bVtBxyU/0/di" border="0" ismap="true"></img></a><br/> <a href="http://feedads.g.doubleclick.net/~a/yJgw6XBCko5CX0C_ah-_bVtBxyU/1/da"><img src="http://feedads.g.doubleclick.net/~a/yJgw6XBCko5CX0C_ah-_bVtBxyU/1/di" border="0" ismap="true"></img></a></p>secur065webhttp://www.blogger.com/profile/03927955797207814790noreply@blogger.com0http://www.web2secure.com/2009/10/avoiding-social-engineering-and.htmltag:blogger.com,1999:blog-2992238913899645252.post-75030669767359252862009-10-23T09:49:00.000-07:002009-10-23T09:56:04.792-07:002009-10-23T09:56:04.792-07:00Facebook is not only networking tools used to communicate with your friends, photos sharing, games and other activities. My reader sent me email regarding Facebook can be used in 100 ways for education purposes. This is such as fabulous idea, thumb up!<div><br /></div><div>Reference: <a href="http://www.onlinecollege.org/2009/10/20/100-ways-you-should-be-using-facebook-in-your-classroom/comment-page-1/#comment-1924">OnlineCollege</a><span class="Apple-tab-span" style="white-space:pre"> </span></div><div><br /></div><div>Facebook isn’t just a great way for you to find old friends or learn about what’s happening this weekend, it is also an incredible learning tool. Teachers can utilize Facebook for class projects, for enhancing communication, and for engaging students in a manner that might not be entirely possible in traditional classroom settings. Read on to learn how you can be using Facebook in your classroom, no matter if you are a professor, student, working online, or showing up in person for class.</div><div><br /></div><div>Continue<a href="http://www.onlinecollege.org/2009/10/20/100-ways-you-should-be-using-facebook-in-your-classroom/comment-page-1/#comment-1924">...</a></div><div><br /></div><div><br /></div><div class="blogger-post-footer"><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/2992238913899645252-7503066976735925286?l=www.web2secure.com'/></div> <p><a href="http://feedads.g.doubleclick.net/~a/fKHuLWe6-xDNbaJvIxVEdVx0HY4/0/da"><img src="http://feedads.g.doubleclick.net/~a/fKHuLWe6-xDNbaJvIxVEdVx0HY4/0/di" border="0" ismap="true"></img></a><br/> <a href="http://feedads.g.doubleclick.net/~a/fKHuLWe6-xDNbaJvIxVEdVx0HY4/1/da"><img src="http://feedads.g.doubleclick.net/~a/fKHuLWe6-xDNbaJvIxVEdVx0HY4/1/di" border="0" ismap="true"></img></a></p>secur065webhttp://www.blogger.com/profile/03927955797207814790noreply@blogger.com0http://www.web2secure.com/2009/10/100-ways-you-should-be-using-facebook.htmltag:blogger.com,1999:blog-2992238913899645252.post-13989809226430824592009-10-19T09:51:00.000-07:002009-10-19T10:14:03.318-07:002009-10-19T10:14:03.318-07:00My reader from China sent me email regarding Cross-Site-Scripting (XSS) executed in IE that posted in China Security Blog recently.<div><br /></div><div>IE8 one of the latest browser from Microsoft claimed offers users more protection than previous versions of the browser through a combination of new security and privacy features. Can be easily become of medium of XSS attack when most users read their text file through browser.</div><div><br /></div><div>The XSS syntax was wrote in text format, executed successfully in browser Microsoft Internet Explorer 8 and IE 6. I don't have IE 7 installed, but I believe possibility is high and working as well in IE 7.</div><div><br /></div><div><div>Text XSS PoC was tested and not working in Firefox browser and Google Chrome.</div><div><br /></div><div><img src="http://2.bp.blogspot.com/_N2xP0b-ECBo/Stya1DkfS3I/AAAAAAAAAws/K03YjNDqu9A/s320/guama.PNG" style="cursor:pointer; cursor:hand;width: 320px; height: 174px;" border="0" alt="" id="BLOGGER_PHOTO_ID_5394356689965108082" /></div><div><br /></div><div><img src="http://1.bp.blogspot.com/_N2xP0b-ECBo/Stya1q9krPI/AAAAAAAAAw0/RjmHr1CBzaU/s320/guama1.PNG" style="cursor:pointer; cursor:hand;width: 177px; height: 121px;" border="0" alt="" id="BLOGGER_PHOTO_ID_5394356700539301106" /></div><div><br /></div><div><img src="http://4.bp.blogspot.com/_N2xP0b-ECBo/Stya2tUnXII/AAAAAAAAAxE/79UWZxJK9Pw/s320/guama3.PNG" style="cursor:pointer; cursor:hand;width: 320px; height: 169px;" border="0" alt="" id="BLOGGER_PHOTO_ID_5394356718352686210" /></div><div><br /></div><div>guama.txt source code:</div><div><br /></div><div><img src="http://2.bp.blogspot.com/_N2xP0b-ECBo/Stya2CbrCVI/AAAAAAAAAw8/pbCcSYCBhQA/s320/guama4.PNG" style="cursor:pointer; cursor:hand;width: 320px; height: 56px;" border="0" alt="" id="BLOGGER_PHOTO_ID_5394356706839562578" /></div><div><br /></div><div><br /></div><div>Due to this kind of XSS can be easily executed in text file (Txt format), why still lots of users taking risks browsing using IE? </div><div><br /></div><div><br /></div><div>reference: www.smxiaoqiang.cn/guama.txt</div></div><div class="blogger-post-footer"><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/2992238913899645252-1398980922643082459?l=www.web2secure.com'/></div> <p><a href="http://feedads.g.doubleclick.net/~a/igevOF2Hjpv64QL0DE9vDUw5XtE/0/da"><img src="http://feedads.g.doubleclick.net/~a/igevOF2Hjpv64QL0DE9vDUw5XtE/0/di" border="0" ismap="true"></img></a><br/> <a href="http://feedads.g.doubleclick.net/~a/igevOF2Hjpv64QL0DE9vDUw5XtE/1/da"><img src="http://feedads.g.doubleclick.net/~a/igevOF2Hjpv64QL0DE9vDUw5XtE/1/di" border="0" ismap="true"></img></a></p>secur065webhttp://www.blogger.com/profile/03927955797207814790noreply@blogger.com0http://www.web2secure.com/2009/10/threat-microsoft-internet-explorer-msie.htmltag:blogger.com,1999:blog-2992238913899645252.post-63466143798480511712009-10-19T09:19:00.000-07:002009-10-19T09:39:54.235-07:002009-10-19T09:39:54.235-07:00When most of the medias reported about the Microsoft Outlook Web Access (OWA) was spamming through emails. What I see OWA keyword become one of with SEO poisoning keyword. Search related to OWA will end to rouge av.<div><br /></div><div><img src="http://2.bp.blogspot.com/_N2xP0b-ECBo/StyTV65koNI/AAAAAAAAAwM/tBaGO7uMpb0/s320/image1.png" style="cursor:pointer; cursor:hand;width: 320px; height: 70px;" border="0" alt="" id="BLOGGER_PHOTO_ID_5394348458480279762" /></div><div><br /></div><div><img src="http://3.bp.blogspot.com/_N2xP0b-ECBo/StyTW6ZVFYI/AAAAAAAAAwc/zAT6hYAqv5E/s320/image3.png" style="cursor:pointer; cursor:hand;width: 320px; height: 243px;" border="0" alt="" id="BLOGGER_PHOTO_ID_5394348475524912514" /></div><div><br /></div><div><img src="http://3.bp.blogspot.com/_N2xP0b-ECBo/StyTWfAbSRI/AAAAAAAAAwU/rHeEMSJ74PI/s320/image2.png" style="cursor:pointer; cursor:hand;width: 320px; height: 138px;" border="0" alt="" id="BLOGGER_PHOTO_ID_5394348468172704018" /></div><div><br /></div><div>The rouge av have very low av detection (Virustotal 1/41)</div><div><img src="http://4.bp.blogspot.com/_N2xP0b-ECBo/StyTXPoRiTI/AAAAAAAAAwk/HFu2GIjN6gc/s320/virustotal.com.png" style="cursor:pointer; cursor:hand;width: 320px; height: 137px;" border="0" alt="" id="BLOGGER_PHOTO_ID_5394348481224739122" /></div><div><br /></div><div><br /></div><div>Related domains and IP address:</div><div><br /></div><div><div>IP Address: <b>91.213.126.150</b></div><div><br /></div><div>coolstats1.net</div><div>goodstats1.net</div><div>sunstats1.net</div><div><br /></div><div><div>IP Address: <b>85.12.24.11</b></div><div><b><br /></b></div><div>top-antispyware-scan9.com</div><div>topantimalwarescan5.com</div><div>your-pc-protection1.com</div><div><br /></div><div><div>IP Address: <b>91.205.40.5</b></div><div><b><br /></b></div><div>marketcoms.cn</div><div><br /></div></div></div></div><div class="blogger-post-footer"><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/2992238913899645252-6346614379848051171?l=www.web2secure.com'/></div> <p><a href="http://feedads.g.doubleclick.net/~a/uUP9rbQW35LdTmSLtFYOs7w_S04/0/da"><img src="http://feedads.g.doubleclick.net/~a/uUP9rbQW35LdTmSLtFYOs7w_S04/0/di" border="0" ismap="true"></img></a><br/> <a href="http://feedads.g.doubleclick.net/~a/uUP9rbQW35LdTmSLtFYOs7w_S04/1/da"><img src="http://feedads.g.doubleclick.net/~a/uUP9rbQW35LdTmSLtFYOs7w_S04/1/di" border="0" ismap="true"></img></a></p>secur065webhttp://www.blogger.com/profile/03927955797207814790noreply@blogger.com0http://www.web2secure.com/2009/10/microsoft-outlook-web-access-owa-seo.htmltag:blogger.com,1999:blog-2992238913899645252.post-70938334330745812112009-10-16T09:54:00.000-07:002009-10-16T09:58:24.245-07:002009-10-16T09:58:24.245-07:00<div>Spam Lists:-</div><div><br /></div><div>IP Address: <b>159.226.7.162</b></div><div><br /></div><div>*.sexiono.cn</div><div>*.sexvideo-thith.cn</div><div>*.tbonx.cn</div><div>*.w58.kj96.cn</div><div>*.xn--i8sw9d6z4a6xk.cn</div><div>*.xrmail4.cn</div><div>*.yu1u.cn</div><div>*.zhong268.cn</div><div>216.105jc001.cn</div><div>5j8dsand.cn</div><div>66sfx.cn</div><div>713sese.cn</div><div>85jaay5.cn</div><div>908jdla222.cn</div><div>abcrot.cn</div><div>abus3r.cn</div><div>adminfile.cn</div><div>aiaoqhfo.cn</div><div>airwaystours.mx1.abcde.cm.cn</div><div>alhesbah.cn</div><div>axa1.cn</div><div>b0san.cn</div><div>baidu-baiduxin4.cn</div><div>cn.mouldbiz.cn</div><div>de89i9.cn</div><div>durakamvezet.cn</div><div>eurosmoke.cn</div><div>famplayfit.cn</div><div>fastfreetest.cn</div><div>fffffffggggg.cn</div><div>firewalled.cn</div><div>fyukj.cn</div><div>hxg011.cn</div><div>idle.a.w-a-y.cn</div><div>ing-groupinc.cn</div><div>is.fr0zen.cn</div><div>it.databsd.cn</div><div>jeflea.cn</div><div>jiqq1.8udns2.cn</div><div>jrjcjzx.cn</div><div>jyeyq.cn</div><div>jzm011.cn</div><div>kamarket.cn</div><div>leizi888.cn</div><div>lj4sll.cn</div><div>madamhcne.cn</div><div>mail.dnsrobot.cn</div><div>mail.hsyccb.cn</div><div>mail.xn--i8sw9d6z4a6xk.cn</div><div>mail.xrmail4.cn</div><div>max-16.cn</div><div>mfjdk.cn</div><div>mndfg.cn</div><div>nikits.cn</div><div>ns2.famplayfit.cn</div><div>ns2.lerte.cn</div><div>of.mon3y.cn</div><div>oitqu.cn</div><div>ok886.8udns1.cn</div><div>pc-check.cn</div><div>pcavublo.cn</div><div>psp777.cn</div><div>qxz7.cn</div><div>regentland.cn</div><div>seek-database.cn</div><div>sex-god.cn</div><div>sex.cn</div><div>simonhongyahoo.cn</div><div>sllwrnm7.cn</div><div>sllwrnm8.cn</div><div>svc.eblyx.cn</div><div>tbsince.cn</div><div>theyourbest.cn</div><div>tsblogon.cn</div><div>tybgh.cn</div><div>una.m-i-a-u.cn</div><div>uni-vod.cn</div><div>unlock69.cn</div><div>user.comgome.cn</div><div>user1.jzm007.cn</div><div>vlokj.cn</div><div>w3og.cn</div><div>web.yu1u.cn</div><div>webcomunity.cn</div><div>www.86qq8.cn</div><div>www.ovemvuea.cn</div><div>www.cc388.cn</div><div>www.co.cn</div><div>www.pikings.cn</div><div>www.ortjntea.cn</div><div>xiaba66.cn</div><div>xmjyq.cn</div><div>xn--9kq39ivpi18g4vn.cn</div><div>xn--eqr446j.cn</div><div>xn--eqrs9hqx1a.cn</div><div>xn--fctw1yg2d65kp3l.cn</div><div>xn--fiqs8seqcu10a4h7c.cn</div><div>xn--i8sw9d6z4a6xk.cn</div><div>xn--kput3ixou56i.cn</div><div>xn--omsv2bg0yq6f.cn</div><div>xn--pss89jq4pvo0ahgi.com</div><div>xn--qev38a12kcvuqtd.cn</div><div>xn--srs561hr5ckwl.cn</div><div>xn--xfrz5mzq4avbl.cn</div><div>xn--xhq82ag8sppbr5iitgdp3d.net</div><div>xn--yrvt74bqhf.cn</div><div>xn--zqs19tzw5a.cn</div><div>ylx99.cn</div><div>yu1u.cn</div><div>zdq003.cn</div><div>zh.018e.cn</div><div>zlwrnm20.cn</div><div>a86d86.kpocepeb.cn</div><div><br /></div><div><br /></div><div>IP Address: <b>60.172.210.4</b></div><div><b><br /></b></div><div>www.ganuxoc.cn</div><div>www.yurihib.cn</div><div>fb3d5f.pubehof.cn</div><div>www.yubajib.cn</div><div>www.bojosid.cn</div><div>996.fabaret.cn</div><div>085.gibazov.cn</div><div>f36.neworer.cn</div><div><br /></div><div><br /></div><div>IP Address: <b>203.93.208.86</b></div><div><br /></div><div>*.bvanafiz.cn</div><div>*.cvupuqal.cn</div><div>*.gkavovom.cn</div><div>*.jxaqivuy.cn</div><div>*.rpafacuj.cn</div><div>*.trazawib.cn</div><div>08075.pquqeter.cn</div><div>0c1007.twelagip.cn</div><div>4245cb.qnahatep.cn</div><div>ns1.buildpious.com</div><div>ns1.cornreal.com</div><div>ns1.coursedo.com</div><div>ns1.dependorder.com</div><div>ns1.noticestream.com</div><div>ns1.renowncook.com</div><div>ns1.sailcalm.com</div><div>ns1.sisterspend.com</div><div>ns1.sizemay.com</div><div>ns1.smilenotice.com</div><div>ns1.wifezeal.com</div><div>ns2.classmover.com</div><div>ns2.strongmouth.com</div><div>ns2321.lamedelegation.ripn.net</div><div>ns3.ba43.com</div><div>ns3.behindmile.com</div><div>ns3.bellfrom.com</div><div>ns3.centmotivation.com</div><div>ns3.cu28.com</div><div>ns3.da39.com</div><div>ns3.decidesit.com</div><div>ns3.deserttwo.com</div><div>ns3.dimplechaste.com</div><div>ns3.fabledsolar.com</div><div>ns3.figurenoon.com</div><div>ns3.flatagain.com</div><div>ns3.grayunique.com</div><div>ns3.groundbed.com</div><div>ns3.haveover.com</div><div>ns3.hitstead.com</div><div>ns3.inventcross.com</div><div>ns3.linehumor.com</div><div>ns3.med22.org</div><div>ns3.minepush.com</div><div>ns3.monthdry.com</div><div>ns3.moverhand.com</div><div>ns3.mu77.net</div><div>ns3.northmy.com</div><div>ns3.nu23.com</div><div>ns3.ourcould.com</div><div>ns3.oversmooth.com</div><div>ns3.painteager.com</div><div>ns3.regionget.com</div><div>ns3.replytwenty.com</div><div>ns3.rowbranch.com</div><div>ns3.sharefollow.com</div><div>ns3.shoecoast.com</div><div>ns3.sightunique.com</div><div>ns3.skinglad.com</div><div>ns3.skinround.com</div><div>ns3.soweight.com</div><div>ns3.speedsuperb.com</div><div>ns3.staymoral.com</div><div>ns3.streamcrowd.com</div><div>ns3.symbolride.com</div><div>ns3.theyfull.com</div><div>ns3.thoughago.com</div><div>ns3.tiedraw.com</div><div>ns3.totalchaste.com</div><div>ns3.tubeold.com</div><div>ns3.via11.net</div><div>ns3.via22.net</div><div>ns3.via99.org</div><div>ns3.wantcover.com</div><div>ns3.washequate.com</div><div>ns3.worthyfound.com</div><div>ns4.advocacycoast.com</div><div>ns4.amresolution.com</div><div>ns4.majormoral.com</div><div>ns4.stoodsail.com</div><div>ns4.valuedflower.com</div><div>ns5.0g7.ru</div><div>ns5.appeartry.com</div><div>ns5.coateach.com</div><div>ns5.fellcause.com</div><div>ns5.putflower.com</div><div>ns6.0ck.ru</div><div>ns6.6s2.ru</div><div>www.csaduxil.cn</div><div>www.caregor.cn</div><div>www.yiqaliq.cn</div><div>www.hatusam.cn</div><div>ynakefir.cn</div><div>0ck.ru</div><div>33-99.com</div><div>amresolution.com</div><div>beginsaid.com</div><div>express-meds.com</div><div>linehumor.com</div><div>oureffect.com</div><div>repeatcrease.com</div><div>smuhelef.cn</div><div>ab8.bebocaw.cn</div><div>alison.hibakiz.cn</div><div>fc01.wzeqnepp.cn</div><div>e34.giduwuq.cn</div><div>ab93.rixofar.cn</div><div><br /></div><div><br /></div><div>IP Address: <b>218.75.149.156</b></div><div><br /></div><div>www.oxdodqea.cn</div><div>blushflash.com</div><div>streetbrown.com</div><div>wwwdnsforum.com</div><div>ns2.wwwdnsforum.com</div><div>www.oiogxbea.cn</div><div>www.iidmdwue.cn</div><div>www.ibpgfbue.cn</div><div><br /></div><div><br /></div><div>IP Address: <b>61.191.188.85</b></div><div><b><br /></b></div><div>www.bemegic.cn</div><div>www.yximolim.cn</div><div>www.yehiwir.cn</div><div>24032.yojokow.cn</div><div>d0c22b.xidudig.cn</div><div>03e.jepawad.cn</div><div>f15.lelibav.cn</div><div>6828.ducuhum.cn</div><div>7445ac.zudavur.cn</div><div>62c.bgomilor.cn</div><div>discipline.qojapos.cn</div><div><br /></div><div><br /></div><div>IP Address: <b>114.205.10.176</b></div><div><br /></div><div>dihenioe.cn</div><div>*.bvuoavts.cn</div><div>*.chancetag.com</div><div>*.coldnew.com</div><div>*.coldtrust.com</div><div>*.linkdnssetup.com</div><div>*.movebowl.com</div><div>*.oceanmath.com</div><div>*.strongbowl.com</div><div>*.trialhuge.com</div><div>blushdisc.com</div><div>blushfish.com</div><div>blushfood.com</div><div>blushsign.com</div><div>bobhot.com</div><div>bowlblush.com</div><div>bvuoavts.cn</div><div>coldnew.com</div><div>coldtrust.com</div><div>herbalpenispill.net</div><div>linkdnssetup.com</div><div>liveblush.com</div><div>movebowl.com</div><div>ns1.bvuoavts.cn</div><div>ns1.chancetag.com</div><div>ns1.coldnew.com</div><div>ns1.coldtrust.com</div><div>ns1.movebowl.com</div><div>ns1.oceanmath.com</div><div>ns1.strongbowl.com</div><div>ns1.townstrong.com</div><div>ns2.chancetag.com</div><div>ns2.coldnew.com</div><div>ns2.movebowl.com</div><div>ns2.oceanmath.com</div><div>ns2.strongbowl.com</div><div>ns2.strongsuper.com</div><div>ns2.townstrong.com</div><div>sizedr.com</div><div>trialhuge.com</div><div>www.trialhuge.com</div><div>chancetag.com</div><div>coldtrust.com</div><div>movebowl.com</div><div>oceanmath.com</div><div>strongbowl.com</div><div>strongsuper.com</div><div>townstrong.com</div><div><br /></div><div><br /></div><div>IP Address: <b>87.242.78.57</b></div><div><br /></div><div>*.by.ru</div><div>*.max-foto.info</div><div>*.wwretsapio.by.ru</div><div>45-24-03.com</div><div>admlyuban.by.ru</div><div>arcland.by.ru</div><div>atb.by.ru</div><div>awn.by.ru</div><div>bancaposte.by.ru</div><div>belgorod.by.ru</div><div>beliy-medved.by.ru</div><div>bpolbancoposta.by.ru</div><div>dreemeer.by.ru</div><div>e-zbuild.com</div><div>egroo.by.ru</div><div>elik.by.ru</div><div>em83.by.ru</div><div>forsyte.by.ru</div><div>gamerland.by.ru</div><div>goz.by.ru</div><div>grayxufyfy.by.ru</div><div>gwtw.by.ru</div><div>gym.by.ru</div><div>host.by.ru</div><div>indetails.info</div><div>itsbi.org</div><div>lag12.by.ru</div><div>localexploit.by.ru</div><div>m-tv.co.cc</div><div>mail.by.ru</div><div>mapple.by.ru</div><div>mendes.by.ru</div><div>montikor.by.ru</div><div>moscargo.com</div><div>ns3.by.ru</div><div>okus.ru</div><div>ot18.info</div><div>personals.by.ru</div><div>posteitali.by.ru</div><div>primero.by.ru</div><div>rebelde-mexico.by.ru</div><div>reklamaru.by.ru</div><div>shura.by.ru</div><div>sjc.ru</div><div>snape.by.ru</div><div>t-stan.by.ru</div><div>tenek.by.ru</div><div>tligurov.by.ru</div><div>tp.by.ru</div><div>transazia.by.ru</div><div>tuganov.by.ru</div><div>tut.by.ru</div><div>ukrokplus.by.ru</div><div>unicreditbancaitalia.by.ru</div><div>uva.ru</div><div>vof.by.ru</div><div>wwretsapio.by.ru</div><div>www.max-foto.info</div><div>i-share.by.ru</div><div>mestovstrechi.by.ru</div><div><br /></div><div><br /></div><div>IP Address: <b>66.45.237.220</b></div><div><b><br /></b></div><div>*.hdfccs_bank.t35.com</div><div>*.t35.com</div><div>abaddonsheaven.t35.com</div><div>abbey1.t35.com</div><div>alfredgomx.t35.com</div><div>angelsaddiavolo.t35.com</div><div>banaameex.t35.com</div><div>banamex-empresas.t35.com</div><div>banamex-personas.t35.com</div><div>banamexboveda.t35.com</div><div>bancanet-online.t35.com</div><div>bancanetonline.t35.com</div><div>barnamex.t35.com</div><div>bl-lit.t35.com</div><div>boveda-banamex.t35.com</div><div>boveda-bancanet.t35.com</div><div>bovedabanamex.t35.com</div><div>bovedabancanet-banamex.t35.com</div><div>burn-proxy.t35.com</div><div>citisecure.t35.com</div><div>citisecures.t35.com</div><div>dandatiger.t35.com</div><div>danke.t35.com</div><div>demo.t35.com</div><div>derricklewizzz.t35.com</div><div>dubaiway.t35.com</div><div>emailyahoo.t35.com</div><div>farsa.t35.com</div><div>freechips.t35.com</div><div>gallerypic.t35.com</div><div>gautamgambhir.t35.com</div><div>gotogo.t35.com</div><div>grupo-banamex.t35.com</div><div>grupofinanciero-banamex.t35.com</div><div>halifax2008.t35.com</div><div>halifaxopen.t35.com</div><div>haliffaxex.t35.com</div><div>hdfcbanks.t35.com</div><div>hdfcbannk.t35.com</div><div>hdfccs_bank.t35.com</div><div>hdfccs_banks.t35.com</div><div>hdffc_update.t35.com</div><div>hdffc_updates.t35.com</div><div>hdffccs_bank.t35.com</div><div>hdffcs_bank.t35.com</div><div>hinter.t35.com</div><div>homefacture.t35.com</div><div>icusecolo.t35.com</div><div>intercontinentalonline.t35.com</div><div>intercontinentals.t35.com</div><div>jaredamaupdate.t35.com</div><div>kalerxy.t35.com</div><div>knownman.t35.com</div><div>lafon.t35.com</div><div>lloydsupdate.t35.com</div><div>lodger.t35.com</div><div>login-verify2.t35.com</div><div>login-verify3.t35.com</div><div>login-verify4.t35.com</div><div>makanarolling.t35.com</div><div>maman123.t35.com</div><div>metalmelt.t35.com</div><div>mmundialbw.t35.com</div><div>mylloydstsbhome.t35.com</div><div>naufork.t35.com</div><div>nertyuu.t35.com</div><div>netkey-banamex.t35.com</div><div>newvisa.t35.com</div><div>newvision.t35.com</div><div>notificacion.t35.com</div><div>notificacionbanamex.t35.com</div><div>notificacionbancanet.t35.com</div><div>notificaciones.t35.com</div><div>onlienforlresak.t35.com</div><div>online-banamex.t35.com</div><div>onlinewachovia.t35.com</div><div>patricia2.t35.com</div><div>portal-banamex.t35.com</div><div>pozaa.t35.com</div><div>qwick-fix.t35.com</div><div>rbconline.t35.com</div><div>rbconlinex.t35.com</div><div>rbscolla.t35.com</div><div>redirectluss.t35.com</div><div>registros.t35.com</div><div>sahariyani1.t35.com</div><div>sbiinternationalonline.t35.com</div><div>sbionlinelive.t35.com</div><div>scotiabank-inverlat.t35.com</div><div>scotti.t35.com</div><div>sesionesbancanetbanamex.t35.com</div><div>seviciomessenger.t35.com</div><div>sururlu.t35.com</div><div>thdao.t35.com</div><div>updatemakana.t35.com</div><div>verifiedvisa.t35.com</div><div>vjio.t35.com</div><div>wach.t35.com</div><div>wachoi.t35.com</div><div>wachoivamndfjewkjak.t35.com</div><div>wachov.t35.com</div><div>wachovia_bankingsecurity.t35.com</div><div>wachoviaaccess.t35.com</div><div>wachoviabola.t35.com</div><div>wachoviabola1.t35.com</div><div>wachoviadeola.t35.com</div><div>wachoviadssa.t35.com</div><div>wachovialook.t35.com</div><div>wachoviaonlines.t35.com</div><div>wachoviasupdates.t35.com</div><div>wachoviaupdatess.t35.com</div><div>warlexy100.t35.com</div><div>wearedone.t35.com</div><div>web951.t35.com</div><div>weter.t35.com</div><div>www.falilat.t35.com</div><div>www.hdfccs_bank.t35.com</div><div>yahooboss.t35.com</div><div>yahooidfarzad.t35.com</div><div>yahoologin00.t35.com</div><div>yahooo1508.t35.com</div><div>yooohooman.t35.com</div><div>orlando.t35.com</div><div><br /></div><div><br /></div><div>IP Address: <b>212.244.48.53</b></div><div><b><br /></b></div><div>republika.d.onet.pl</div><div>*.ab_ovo.republika.pl</div><div>*.cwsunitra.republika.pl</div><div>*.kozi_m.republika.pl</div><div>*.kriso.republika.pl</div><div>*.martavicari.republika.pl</div><div>*.multipro2005.republika.pl</div><div>*.naszaszansa.republika.pl</div><div>*.republika.pl</div><div>*.translatorduo.republika.pl</div><div>ab_ovo.republika.pl</div><div>acanthus.republika.pl</div><div>analizator.republika.pl</div><div>antymobbing.republika.pl</div><div>bianar.republika.pl</div><div>brebox.republika.pl</div><div>chatek.republika.pl</div><div>cwsunitra.com</div><div>cwsunitra.republika.pl</div><div>cyfbar.republika.pl</div><div>czechupwhu.republika.pl</div><div>dariuszpod.republika.pl</div><div>dawidziuk0.republika.pl</div><div>deepurple1.republika.pl</div><div>diabetic.republika.pl</div><div>domykanadyjskie.republika.pl</div><div>edward-bialek.republika.pl</div><div>epolisa.republika.pl</div><div>fhupema.republika.pl</div><div>ftp2.republika.pl</div><div>gim1leszno.republika.pl</div><div>gmph.republika.pl</div><div>goryniakp.republika.pl</div><div>granitgranit.republika.pl</div><div>grom5.republika.pl</div><div>gwiazdka.republika.pl</div><div>hamra.republika.pl</div><div>henry130.republika.pl</div><div>jablonie.republika.pl</div><div>kaliszok.republika.pl</div><div>kangootip.com</div><div>konciel.republika.pl</div><div>kozi_m.republika.pl</div><div>kriso.republika.pl</div><div>leonzs3.republika.pl</div><div>livnew.republika.pl</div><div>lizakicukierki.republika.pl</div><div>madcraft.republika.pl</div><div>mario236.republika.pl</div><div>martavicari.republika.pl</div><div>meniere.republika.pl</div><div>mfmch.republika.pl</div><div>microft.republika.pl</div><div>miniglass.republika.pl</div><div>moduss.republika.pl</div><div>msc1.republika.pl</div><div>multipro2005.republika.pl</div><div>naszaszansa.republika.pl</div><div>netpit.republika.pl</div><div>olambik.republika.pl</div><div>pilot4.republika.pl</div><div>polfito.republika.pl</div><div>polskaferma.republika.pl</div><div>ppgen.republika.pl</div><div>ptchprie.republika.pl</div><div>pwswitch.republika.pl</div><div>raddeli.republika.pl</div><div>republika.d.onet.pl</div><div>rfq.republika.pl</div><div>serwiszegluj.republika.pl</div><div>straznikbeskidu.republika.pl</div><div>superstudent.republika.pl</div><div>swiatkanarkow.republika.pl</div><div>swrazem.republika.pl</div><div>szlifierniaamber.republika.pl</div><div>szpic.republika.pl</div><div>tmsp.republika.pl</div><div>www.ab_ovo.republika.pl</div><div>www.aborcja-pl.republika.pl</div><div>www.afurman.republika.pl</div><div>www.apt.republika.pl</div><div>www.arendarski-maciej.republika.pl</div><div>www.bokamaro.republika.pl</div><div>www.capriszon.republika.pl</div><div>www.chaos.republika.pl</div><div>www.cwsunitra.republika.pl</div><div>www.energowierzba.republika.pl</div><div>www.fakesteroids.republika.pl</div><div>www.fanatic20.republika.pl</div><div>www.isobel.republika.pl</div><div>www.klimapo.republika.pl</div><div>www.klubspp.republika.pl</div><div>www.kozi_m.republika.pl</div><div>www.kriso.republika.pl</div><div>www.lgw.republika.pl</div><div>www.martavicari.republika.pl</div><div>www.mojecharty.republika.pl</div><div>www.mojpodhalan.republika.pl</div><div>www.mukolud23.republika.pl</div><div>www.multipro2005.republika.pl</div><div>www.naszaszansa.republika.pl</div><div>www.niemcza.republika.pl</div><div>www.nieradzik.republika.pl</div><div>www.omegagranitrans.republika.pl</div><div>www.orange47.republika.pl</div><div>www.pabet2005.republika.pl</div><div>www.palabra.republika.pl</div><div>www.pfroios.republika.pl</div><div>www.pinczer.republika.pl</div><div>www.r19.republika.pl</div><div>www.sigmaradomsko.republika.pl</div><div>www.smtj.republika.pl</div><div>www.sznaucer2.republika.pl</div><div>www.taga.republika.pl</div><div>www.tipo.republika.pl</div><div>www.totalwar.republika.pl</div><div>www.translatorduo.republika.pl</div><div>www.unitel.republika.pl</div><div>www.vbscript.republika.pl</div><div>www.windykuj.republika.pl</div><div>www.zrbmardula.republika.pl</div><div>wyooo.republika.pl</div><div>zielonemity.republika.pl</div><div><br /></div><div><br /></div><div>IP Address: <b>217.74.65.162</b></div><div><b><br /></b></div><div>*.deltah.w.interia.pl</div><div>*.w.interia.pl</div><div>adamlukasz.w.interia.pl</div><div>aegis.aaops.w.interia.pl</div><div>agility.w.interia.pl</div><div>agro.chmielno.w.interia.pl</div><div>agro_beskidy.w.interia.pl</div><div>aidspl.w.interia.pl</div><div>aisza.koty.w.interia.pl</div><div>akszeing.w.interia.pl</div><div>aktowka.w.interia.pl</div><div>alfa_gaz.w.interia.pl</div><div>alkohole.w.interia.pl</div><div>allianz.marzena.w.interia.pl</div><div>anatomiac.w.interia.pl</div><div>anna.wroblewska.w.interia.pl</div><div>aquanet.w.interia.pl</div><div>assembling-directx.w.interia.pl</div><div>atiradeon.w.interia.pl</div><div>bdgalinscy.w.interia.pl</div><div>bierzwnik.w.interia.pl</div><div>bioqtr.w.interia.pl</div><div>blackwh.w.interia.pl</div><div>bura4.w.interia.pl</div><div>bw2_wilu.w.interia.pl</div><div>cats-musical.w.interia.pl</div><div>cliff4.w.interia.pl</div><div>deltah.w.interia.pl</div><div>der57.w.interia.pl</div><div>derbeth.w.interia.pl</div><div>dermanovum.w.interia.pl</div><div>devrex.w.interia.pl</div><div>dex11.w.interia.pl</div><div>diabko.w.interia.pl</div><div>dompodsosnami.ustka.w.interia.pl</div><div>doom2.w.interia.pl</div><div>dorota.dubel.w.interia.pl</div><div>dsjbygucias.w.interia.pl</div><div>ekklan.w.interia.pl</div><div>eurekaostrowska.w.interia.pl</div><div>eurolas.w.interia.pl</div><div>fantasy-web.w.interia.pl</div><div>fireasses.w.interia.pl</div><div>gad.w.domu.w.interia.pl</div><div>grazynkasiak.w.interia.pl</div><div>hcastillo.w.interia.pl</div><div>hetmanszopienice.w.interia.pl</div><div>hitmanweb.w.interia.pl</div><div>ibrandt.w.interia.pl</div><div>impzachslon.w.interia.pl</div><div>intervip.w.interia.pl</div><div>j.lenczowski.w.interia.pl</div><div>jamnior.w.interia.pl</div><div>jerzy.stachurski.w.interia.pl</div><div>jjdymek.w.interia.pl</div><div>kalender.w.interia.pl</div><div>klimaks.w.interia.pl</div><div>klubsmakoszy.w.interia.pl</div><div>konkaro.w.interia.pl</div><div>kotlandia.w.interia.pl</div><div>koty.orientalne.somalijskie.w.interia.pl</div><div>ktoz.w.interia.pl</div><div>kubapg2.w.interia.pl</div><div>logokrokus1994.w.interia.pl</div><div>mafia_gc.w.interia.pl</div><div>maine.coon.w.interia.pl</div><div>malspecszkol.w.interia.pl</div><div>marcin.majkut.w.interia.pl</div><div>marcinspooky.w.interia.pl</div><div>markey.w.interia.pl</div><div>maximx86.w.interia.pl</div><div>mike.s.w.interia.pl</div><div>mikrobus.poznan.w.interia.pl</div><div>mimbase.w.interia.pl</div><div>mparlicki.w.interia.pl</div><div>mszlak.w.interia.pl</div><div>naturemed.w.interia.pl</div><div>ncaur.w.interia.pl</div><div>neverhood.cygan.w.interia.pl</div><div>nihilism.w.interia.pl</div><div>odlewnia-lubelskie.w.interia.pl</div><div>opieka-drawsko.w.interia.pl</div><div>parafia.sztum.w.interia.pl</div><div>parda.w.interia.pl</div><div>pawelsiwek.w.interia.pl</div><div>phgrecja.w.interia.pl</div><div>poradnia-sztum.w.interia.pl</div><div>progs-jp.w.interia.pl</div><div>przedszkolenr2darlowo.w.interia.pl</div><div>ptmkwroclaw.w.interia.pl</div><div>pzw-brzana.w.interia.pl</div><div>refj.w.interia.pl</div><div>rodzinqowski.w.interia.pl</div><div>rymesa.w.interia.pl</div><div>ryszard-kujawa.w.interia.pl</div><div>ryszardtoczko.w.interia.pl</div><div>rytel.w.interia.pl</div><div>samotnia_christa.w.interia.pl</div><div>skorczyl.w.interia.pl</div><div>slawik.pl.w.interia.pl</div><div>sp910066kr.w.interia.pl</div><div>std-spz.w.interia.pl</div><div>stmalga.w.interia.pl</div><div>swatclinic.w.interia.pl</div><div>sz_n.w.interia.pl</div><div>szkolabork.w.interia.pl</div><div>sztum.w.interia.pl</div><div>teatr.miniatura.w.interia.pl</div><div>thelo0p.w.interia.pl</div><div>tmkartuz.w.interia.pl</div><div>tomekzurawski.w.interia.pl</div><div>turniejzeo.w.interia.pl</div><div>u.o.i.i.w.interia.pl</div><div>ulacompensa.w.interia.pl</div><div>wosp-mysliborz.w.interia.pl</div><div>www.deltah.w.interia.pl</div><div>zbysw.w.interia.pl</div><div>ziellona.w.interia.pl</div><div>ziolaiprzyprawy.w.interia.pl</div><div>zmuzyki.w.interia.pl</div><div>zsp-czarna-woda.w.interia.pl</div><div>navyowner.w.interia.pl</div><div><br /></div><div class="blogger-post-footer"><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/2992238913899645252-7093833433074581211?l=www.web2secure.com'/></div> <p><a href="http://feedads.g.doubleclick.net/~a/KZSp-E-HF-DJ0nIzg2GuNU-1Fn8/0/da"><img src="http://feedads.g.doubleclick.net/~a/KZSp-E-HF-DJ0nIzg2GuNU-1Fn8/0/di" border="0" ismap="true"></img></a><br/> <a href="http://feedads.g.doubleclick.net/~a/KZSp-E-HF-DJ0nIzg2GuNU-1Fn8/1/da"><img src="http://feedads.g.doubleclick.net/~a/KZSp-E-HF-DJ0nIzg2GuNU-1Fn8/1/di" border="0" ismap="true"></img></a></p>secur065webhttp://www.blogger.com/profile/03927955797207814790noreply@blogger.com0http://www.web2secure.com/2009/10/spam-16-oct-09.htmltag:blogger.com,1999:blog-2992238913899645252.post-90499297876951386732009-10-15T07:05:00.001-07:002009-10-15T08:53:17.120-07:002009-10-15T08:53:17.120-07:00While I am looking for Maya related information through Google, suddenly I was stunned with "<b>This site may harm your computer</b>" and it catch my attention and the website was Maya London " <b>www.mayalondon.com</b>";<div> <div><img src="http://3.bp.blogspot.com/_N2xP0b-ECBo/StctExZK38I/AAAAAAAAAvM/kfFg2LxUbXY/s320/GoogleSearch.PNG" style="cursor:pointer; cursor:hand;width: 320px; height: 68px;" border="0" alt="" id="BLOGGER_PHOTO_ID_5392828638801092546" /></div><div><br /></div><div>With using Fiddler tool, I able to capture http network packets that flow between my guest systems and Web Server. The outcome was main page for "<b>www.mayalondon.com</b>" was injected with malicious links. Once users browsers to infected site, the user is redirecting to execute the injected script to:</div><div><br /></div><div><b>- http://cbx-north.se/buttons/bothnia.php</b></div><div><b>- http://bio-age.ru:8080/index.php</b></div><div><br /></div><div><img src="http://3.bp.blogspot.com/_N2xP0b-ECBo/StctFeQM8nI/AAAAAAAAAvU/yctSYai62Qw/s320/mayacontent.PNG" style="cursor:pointer; cursor:hand;width: 320px; height: 90px;" border="0" alt="" id="BLOGGER_PHOTO_ID_5392828650843075186" /></div><div><br /></div><div>and another injected linked "swfobject.js" contain two malicious links</div><div><b>- http://kryolan.com/images/favicon.php</b></div><div><b>- http://cbx-north.se/buttons/bothnia.php</b></div><div><br /></div><div>User not only stopped with one exploit, there have another exploit chains at "<b>http://cbx-north.se/buttons/bothnia.php</b>" that separately load Exploit PDF and and Exploit Flash file to system. The results for malicious Flash file and PDF file exploiting this vulnerability in this attack are still very low.</div><div><br /></div><div>- <b>cbx-north.se/buttons/bothnia.php?s=zwrUlbs&amp;id=2 </b> (PDF) (<a href="http://www.virustotal.com/analisis/fbd616a95c5737e9d7b580fa87fcd4465ec8ec85812bdd12d9f7238adf8ab5a2-1255618081">VT 4/41</a>)</div><div>- <b>cbx-north.se/buttons/bothnia.php?s=zwrUlbs&amp;id=3</b> (Flash) (<a href="http://www.virustotal.com/analisis/af1e7f7c1c60d947387eebd16e10a9bcd30fecd570824a77be063e953942c273-1255617986">VT 2/41</a>)</div><div><br /></div><div><img src="http://1.bp.blogspot.com/_N2xP0b-ECBo/StctFuKBGaI/AAAAAAAAAvc/h1IgVNqo8fA/s320/mayacontent1.PNG" style="cursor:pointer; cursor:hand;width: 320px; height: 156px;" border="0" alt="" id="BLOGGER_PHOTO_ID_5392828655112100258" /></div><div><br /></div><div>From the script below, "<b>bio-age.ru:8080</b>" contains "Javascript" to perform downloading "Exploit PDF" that contain Adobe util.printf overflow exploit <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2008-2992">CVE-2008-2992</a>. </div><div><br /></div><div><img src="http://2.bp.blogspot.com/_N2xP0b-ECBo/StcvKL7sIuI/AAAAAAAAAvk/meBOUheoe8g/s320/mayacontent2.PNG" style="cursor:pointer; cursor:hand;width: 320px; height: 138px;" border="0" alt="" id="BLOGGER_PHOTO_ID_5392830930847802082" /></div><div><br /></div><div>Without surprising, Exploit PDF file received minor detection rate from VirusTotal. The attackers used heavily obfuscated Javascript combined with script fragmentation to evade detection. I have to salute attacker to give hard work for analysis. </div><div><br /></div><div><img src="http://1.bp.blogspot.com/_N2xP0b-ECBo/StcxnbGSwiI/AAAAAAAAAv8/TXT9FksRmTY/s320/vtresult0.PNG" style="cursor:pointer; cursor:hand;width: 320px; height: 186px;" border="0" alt="" id="BLOGGER_PHOTO_ID_5392833632158269986" /></div><div><br /></div><div><img src="http://4.bp.blogspot.com/_N2xP0b-ECBo/StcwZXMJwMI/AAAAAAAAAvs/Y5zRnYGqZi8/s320/pdfcontent.PNG" style="cursor:pointer; cursor:hand;width: 320px; height: 234px;" border="0" alt="" id="BLOGGER_PHOTO_ID_5392832291079307458" /></div><div><br /></div><div>Exploit PDF file will download malware (load.exe) from "<b>http://youbio.ru:8080/main.php?id=5&amp;hello21</b>" when loaded using unpatch Adobe Reader.</div><div><br /></div><div><img src="http://1.bp.blogspot.com/_N2xP0b-ECBo/StcwZ7pceiI/AAAAAAAAAv0/q2xeDTMGeKo/s320/vtresult.PNG" style="cursor:pointer; cursor:hand;width: 320px; height: 158px;" border="0" alt="" id="BLOGGER_PHOTO_ID_5392832300865845794" /></div><div><br /></div><div>Hostname "<b>bio-age.ru:8080</b>" and "<b>youbio.ru:8080</b>" pointing to same IP Address: <b>208.67.219.132</b></div><div><br /></div><div><br /></div><div><div>"<b>cbx-north.se</b>" -->IP Address: <b>195.47.247.121</b></div><div><br /></div><div>Hostnames sharing same IP:</div><div>1099.se</div><div>1jma.net</div><div>addison.dk</div><div>aid-com.be</div><div>amodei.net</div><div>andersmagnusson.net</div><div>archifacts.net</div><div>arerosseland.com</div><div>arstahavsbad.net</div><div>arubalandscape.net</div><div>arvidson.dk</div><div>aspdalen.net</div><div>betinafriis.net</div><div>beyondthenorthwaves.net</div><div>bgof.net</div><div>birgit-iren.net</div><div>bogbasen.dk</div><div>bornholmerferier.dk</div><div>carloscicchelli.net</div><div>casa50.net</div><div>cbx-north.se</div><div>cdrcrd.com</div><div>clubcosmos.net</div><div>crispycat.com</div><div>cybospace.net</div><div>datavagen.com</div><div>dbs16.dk</div><div>eng-dal.net</div><div>faudo.net</div><div>ferieitoscana.net</div><div>fiberdanmark.dk</div><div>fjellhamarfk.net</div><div>footballglobe.net</div><div>fossekallen.net</div><div>fotbollstrojor.net</div><div>franzensandberg.net</div><div>frodeandersen.net</div><div>gizl.nl</div><div>glitr.net</div><div>gmprod.net</div><div>goergen.net</div><div>grandiscrew.net</div><div>gunmancentral.net</div><div>hanekam.net</div><div>haraldriise.net</div><div>hounds.dk</div><div>hsl.be</div><div>indelfa.com</div><div>innovationmarket.net</div><div>insats.net</div><div>insg.nl</div><div>instituut-waldorf.be</div><div>jeromedeperlinghi.net</div><div>jhlan.net</div><div>jkann.net</div><div>jolv.net</div><div>ka-kjing.net</div><div>kaffesukker.net</div><div>kajhelge.net</div><div>kloverblomman.net</div><div>koksijde.net</div><div>kureer.net</div><div>kvalitena.net</div><div>leeuwerke.net</div><div>leksebistand.net</div><div>lemuelbooks.net</div><div>lifeonacouch.net</div><div>lillehammerbaptist.net</div><div>loshavnsidene.net</div><div>lostinberlin.net</div><div>lyd-tekniker.net</div><div>mail2.nykroppa.se</div><div>malerimetoder.se</div><div>memorybar.net</div><div>mhastings.net</div><div>mitrapa.se</div><div>morden.dk</div><div>muzinfo.net</div><div>nittfors.net</div><div>ns2.cdrcrd.com</div><div>nykroppa.se</div><div>oehlenschlager.dk</div><div>ole-andreas.net</div><div>olethore.net</div><div>oppegaende.net</div><div>oshorisk.dk</div><div>peture.net</div><div>pilegrim.net</div><div>problematisk.net</div><div>relihq.net</div><div>rkcc.dk</div><div>roennerhavnen.dk</div><div>seules.net</div><div>sidenmin.net</div><div>sikkerhedsnettet.net</div><div>smuthullet.net</div><div>spar2design.dk</div><div>spd-mv.de</div><div>srv71.b-one.net</div><div>stromvoll.net</div><div>sunile.no</div><div>sunnydisposition.net</div><div>thaiwok.se</div><div>theien.net</div><div>theil.dk</div><div>tollerforum.net</div><div>trikster.net</div><div>trim1.net</div><div>ultra-ragnar.net</div><div>usenethelp.net</div><div>vinnpenger.net</div><div>voldesign.net</div><div>webbkampanj.net</div><div>wickedfriends.net</div><div>www.bornholmerferier.dk</div><div>www.malerimetoder.se</div><div>www.mitrapa.se</div><div>www.pirken.dk</div><div>www.sunile.no</div><div>www.thaiwok.se</div><div>xweza.com</div><div>zirconium-inc.net</div><div><br /></div><div><br /></div><div>IP Address: <b>208.67.219.132</b></div><div><br /></div><div>bio-age.ru:8080</div><div>youbio.ru:8080</div><div>goowy.net</div><div>iris-germany.com</div><div>quienestadetrasdelascuarderias.org</div><div><br /></div><div><br /></div><div>IP Address: <b>78.46.45.77</b></div><div><b><br /></b></div><div>*.bestensee.de</div><div>*.kryolan.com</div><div>*.omatix.de</div><div>bestensee.de</div><div>cydico.com</div><div>dermacolor-camouflage.net</div><div>gut.de</div><div>haby.net</div><div>kryolan.us</div><div>kryolan.com</div><div>linear-software.de</div><div>lwb-info.de</div><div>omatix.de</div><div>rbo-info.de</div><div>s10.omatix.de</div><div>static.77.45.46.78.clients.your-server.de</div><div>www.bestensee.de</div><div>www.kryolan.de</div><div>www.omatix.de</div><div><br /></div><div><br /></div><div>P/S: The Webmaster for "<b>www.mayalondon.com</b>" suspend their website for maintenance to clean up "malicious" codes. </div><div><br /></div><div><img src="http://3.bp.blogspot.com/_N2xP0b-ECBo/Stc7UWnsQDI/AAAAAAAAAwE/DK3ZkAuFMlI/s320/maya-ofs.PNG" style="cursor:pointer; cursor:hand;width: 320px; height: 220px;" border="0" alt="" id="BLOGGER_PHOTO_ID_5392844299654938674" /></div></div></div><div class="blogger-post-footer"><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/2992238913899645252-9049929787695138673?l=www.web2secure.com'/></div> <p><a href="http://feedads.g.doubleclick.net/~a/l0rPUu_ZKv-j2FGe01PWNQlMzfE/0/da"><img src="http://feedads.g.doubleclick.net/~a/l0rPUu_ZKv-j2FGe01PWNQlMzfE/0/di" border="0" ismap="true"></img></a><br/> <a href="http://feedads.g.doubleclick.net/~a/l0rPUu_ZKv-j2FGe01PWNQlMzfE/1/da"><img src="http://feedads.g.doubleclick.net/~a/l0rPUu_ZKv-j2FGe01PWNQlMzfE/1/di" border="0" ismap="true"></img></a></p>secur065webhttp://www.blogger.com/profile/03927955797207814790noreply@blogger.com0http://www.web2secure.com/2009/10/mayalondoncom-was-compromised-cbx-north.html