Website Security News

Hilary Kneber (part XI) – sippa.dottasink.net

David Dede

August 24, 2010

Hilary Kneber (hilarykneber@yahoo.com) is at it again. We’ve been detecting various sites infected with a malicious javascript pointing to http://sippa.dottasink.net: < script src = "http://sippa.dottasink.net/music/indi.php”></script>…

Read the Post

More spam: Google-traffic-analytics.com C&C server

David Dede

August 23, 2010

We have been tracking another wave of SPAM that is affecting many popular web sites. What is interesting is all of them have been controlled…

Read the Post

Gmail blacklisted by Spamhaus

David Dede

August 19, 2010

Update: Gmail not blacklisted anymore. It seems that today Spamhaus (a widely used Spam blacklist) started to blacklist the IP addresses used by gmail. We…

Read the Post

Pharma hack and their C&C (Command & control) server

David Dede

August 12, 2010

A large portion of the sites Sucuri has been fixing in recent weeks are stemming from infections caused by the infamous Pharma Hack. We posted…

Read the Post

Yet another series of attacks (part X) – vancouvererrorsonfile.com and the hilarykneber group

David Dede

August 5, 2010

If you have been following our blog long, you probably heard about quite a few large scale attacks affecting many hosting companies: GoDaddy, Bluehost, Dreamhost,…

Read the Post

Cleaning the “siteurlpath” hack on WordPress (wplinksforwork and hemoviestube spam bots)

David Dede

August 4, 2010

Recently we started to see a lot of WordPress sites hacked with malware hidden inside the wp_options -> siteurlpath table. The symptoms are very similar…

Read the Post

UFC.com blacklisted by Google (indirectly)

David Dede

July 31, 2010

Anyone trying to visit the site UFC.com (from Google Chrome or Firefox) will get a big scary warning from Google: Warning: Visiting this site may…

Read the Post

Vulnerability in Vbulletin 3.8.6

David Dede

July 21, 2010

If you are running Vbulletin 3.8.6 (the latest 3.8.x version), make sure to remove the faq.php as soon as possible. A vulnerability has been found…

Read the Post

Yet another series of attacks – This time using whereisdudescars.com

David Dede

July 17, 2010

Update 1: It seems that this attack is limited to only Bluehost and Dreamhost, not GoDaddy like in the previous times. Update 2: This script…

Read the Post

Fox News Website Hacked

Dre Armeda

July 14, 2010

We reported yesterday evening that various sites in the Fox web network have been infected with the Pharma Hack. It doesn’t stop there. I just…

Read the Post

Uncategorized

Various Fox Websites Hit With Pharma Hack

Dre Armeda

July 13, 2010

If you’ve been following Sucuri, you’ve seen a bunch of discussion around the steadily growing Pharma Hack. As we continue research on the issue we…

Read the Post