funsec mailing list archives
Re: Funsec if your an MMA fan..watch for bad links!
From: Nick FitzGerald <nick () virus-l demon co uk>
Date: Mon, 09 Nov 2009 12:44:11 +1300
RandallM wrote:
Open the UrL on a VMstation and this time the file came from: "SearchglobalSecurity.com"..where as before it was from ""GuardSytem-scanner" Fastfluxing?
Changing target domains is nothing to do with FF, which is more about changing/revolving the IPs returned as A records for a specific domain. Changing the domains that the blackhat SEO, search-engine-referer- checking redirects use is common in these Rogue AV, etc, etc scams, typically happening once to several times a day (though that can be tricky to trace informally because at least some of them use IP tracking and after "a few" hits they will eventually redirect you to some other page, such as an apparent search results page, etc). Regards, Nick FitzGerald _______________________________________________ Fun and Misc security discussion for OT posts. https://linuxbox.org/cgi-bin/mailman/listinfo/funsec Note: funsec is a public and open mailing list.
Current thread:
- Re: Funsec if your an MMA fan..watch for bad links! RandallM (Nov 08)
- Re: Funsec if your an MMA fan..watch for bad links! Nick FitzGerald (Nov 08)
- <Possible follow-ups>
- Re: Funsec if your an MMA fan..watch for bad links! RandallM (Nov 08)
- Re: Funsec if your an MMA fan..watch for bad links! Paul Ferguson (Nov 08)