Thanks to our readers for letting us know that they are receiving a good amount of some very authentic looking phishing spam. Although the email appears to be from CNN again, the origination address is not even obfuscated. ISC Handler, Daniel had written a story about the "CNN - Top Ten" storm worm a few days ago. isc.sans.org/diary.html |
Mari Nichols 76 Posts Aug 8th 2008 |
Thread locked Subscribe |
Aug 8th 2008 1 decade ago |
This one's also still the botnet (i.e. the same people as the "CNN.com Top 10") -- the same group of IPs abruptly stopped sending Top 10 and started sending Custom Alert at midnight California time. The linked sites are the same hijacked servers, and the landing pages have the identical JS-obfuscated content I deconstructed yesterday.
(As always, the hour's current data is at http://www.vivtek.com/projects/despammed/stormspam.html) |
Anonymous |
Quote |
Aug 8th 2008 1 decade ago |
You can read http://malware-test-lab.blogspot.com/2008/08/fake-cnn-alerts-my-custom-alert.html in detail.
|
Anonymous |
Quote |
Aug 9th 2008 1 decade ago |
Sign Up for Free or Log In to start participating in the conversation!