Link injection, basicpills dot com and Blackhat SEO spam
David Dede For the last few weeks we’ve been tracking a very large blackhat SEO spam campaign initiated by basicpills.com, generic-ed-pharmacy.com, getrxpills.com and a few other domains…
Malware week – 0133.0331.0242.0033, javadisplay and more
Very busy week in terms of malware. First Hilary Kneber decided to make a come back, inlovebot.com and crazymasya.com reinfected a lot of sites, and…
Hilary Kneber Again – welcometotheglobalisorg
We are seeing (again) a number of sites infected with a variation of the welcometotheglobalisnet.com malware string that appeared a few weeks ago. The details…
Chase phishing – case study
Last week we were called to fix a Joomla site that was infected by malware and disabled by their hosting company. The user forwarded the…
Brenz.pl is Back With Malicious iFrames
We used to see brenz.pl being used to distribute malware back in 2009, and got shut down. However, for the last few weeks we noticed…
Alexa TOP 100k Sites – The Malware Blues
How big do you think the web-based malware problem is? How many sites do you think were hacked and/or infected with malware in the last…
Grameen Bank web site hacked / infected with spam
The Grameen Bank is in the news today after one of its founders, Muhammad Yunus, was fired from it. You can see the news about…
Alexa top sites – Blacklist for January/2011
Every month we analyze Alexa’s TOP 1 million site ranking and correlate that data with Google’s blacklist. Our goal is to get an overall view…
The attack from the .cc’s domains
Over the last few days we’ve continued to see a large increase in the number of sites hacked and infected with a malicious iframe from…
Hilary Kneber Strikes Again – welcometotheglobalisnet
It seems that after a few months quiet, the “Hilary Kneber” group is back at it again. Their latest approach is very typical of Hilary…
UCalgary web sites compromised with spam
We were cleaning up a compromised site today (with the unfamous pharma hack), when we saw multiple spam links in the hacked site pointing to…