Change Log: Sucuri Malware Labs

Sucuri Malware Labs

Current status: normal - monitoring
Number of users monitoring this page: 1
Most recent sizable change (text, html) : 2013-05-17 00:06
Most recent change (text, html) : 2013-05-17 00:06
Last checked for changes: 2013-05-18 00:06
ChangeDetection started monitoring: 2012-06-07 00:06

monitor this page

summary of most recent changes

Showing 1 - 5 of 22

1 2 3 4 [next]

show added and deleted only added only deleted | show context hide context | show sizable show all

View changes: 2013-05-17 00:06 478 new words, 0 deleted words, 2% change

... | Tools | About Backdoor Injector code Published: 2013-05-16 by Daniel B. Cid A backdoor injector code we found on a compromised site: if(is__writable($dir."/wp-includes/")): file_put_contentz($dir ... /timthumb.php;;true_upload"); }else{ die(";;0;;false_upload"); It looks for a writable directly either inside wp-includes, wp-content or inside uploads to inject a backdoor. Large scale TDS redirections ... | Tools | About Backdoor Injector code Published: 2013-05-16 by Daniel B. Cid A backdoor injector code we found on a compromised site: if(is__writable($dir."/wp-includes/")): file_put_contentz($dir ... /timthumb.php;;true_upload"); }else{ die(";;0;;false_upload"); It looks for a writable directly either inside wp-includes, wp-content or inside uploads to inject a backdoor. Large scale TDS redirections ... | Tools | About ... Large scale TDS redirections more...

View changes: 2013-02-16 01:27 1055 new words, 0 deleted words, 4% change

... | Tools | About Large scale TDS redirections Published: 2013-02-15 by Daniel B. Cid Lots of compromised sites redirecting to TDS: http://1151.website.snafu.de/hkkj.html?h=1475928 http://adaptpro.co. ... com/hazi.htm?h=1056691 http://wildearthfineart.com/eack.htm?h=749606 And that's just a small sample. We have detected just in February over 500 sites compromised exactly like that. ChangeIP (dynamic DNS ... | Tools | About Large scale TDS redirections Published: 2013-02-15 by Daniel B. Cid Lots of compromised sites redirecting to TDS: http://1151.website.snafu.de/hkkj.html?h=1475928 http://adaptpro.co. ... com/hazi.htm?h=1056691 http://wildearthfineart.com/eack.htm?h=749606 And that's just a small sample. We have detected just in February over 500 sites compromised exactly like that. ChangeIP (dynamic DNS ... | Tools | About ... ChangeIP (dynamic DNS more...

View changes: 2012-12-11 00:06 482 new words, 0 deleted words, 2% change

... | Tools | About ChangeIP (dynamic DNS) malware Published: 2012-12-10 by Daniel B. Cid If you look at the top domains distributing malware for the last days (and months), what do you see in common? # ... 6 months ago, .co.cc was the main domain distributing malware, but since it was shut down, the attackers have migrated to changeip.com. Hopefully they will do something about it. More Fake jQuery sites ... | Tools | About ChangeIP (dynamic DNS) malware Published: 2012-12-10 by Daniel B. Cid If you look at the top domains distributing malware for the last days (and months), what do you see in common? # ... 6 months ago, .co.cc was the main domain distributing malware, but since it was shut down, the attackers have migrated to changeip.com. Hopefully they will do something about it. More Fake jQuery sites ... | Tools | About ... More Fake jQuery sites more...

View changes: 2012-11-23 00:06 225 new words, 0 deleted words, 1% change

... | Tools | About More Fake jQuery sites - jqueryc.com Published: 2012-11-22 by Daniel B. Cid We keep seeing fake jQuery sites popping up and being used to distribute malware. One was jquerys.org , other was ... that the domain was just registered (20-nov-2012), so it is not being flagged anywhere. **The official jquery sites are jquery.org or jquery.com. Other variations are likely fake. co.cc seems ... | Tools | About More Fake jQuery sites - jqueryc.com Published: 2012-11-22 by Daniel B. Cid We keep seeing fake jQuery sites popping up and being used to distribute malware. One was jquerys.org , other was ... that the domain was just registered (20-nov-2012), so it is not being flagged anywhere. **The official jquery sites are jquery.org or jquery.com. Other variations are likely fake. co.cc seems | Tools | About ... co.cc seems more...

View changes: 2012-11-21 00:06 91 new words, 0 deleted words, <1% change

... | Tools | About co.cc seems to be gone Published: 2012-11-20 by Daniel B. Cid It seems that the .co.cc (sub TLD) that used to be mass used by spammers and malware is now gone. Their registration page is offline: $ host co.cc Host co.cc not found: 3(NXDOMAIN) $ host www.co.cc Host www.co.cc not found: 3(NXDOMAIN) And we hope it stays that way. Iframes generator: http | Tools | About co.cc seems to be gone Published: 2012-11-20 by Daniel B. Cid It seems that the .co.cc (sub TLD) that used to be mass used by spammers and malware is now gone. Their registration page is offline: $ host co.cc Host co.cc not found: 3(NXDOMAIN) $ host www.co.cc Host www.co.cc not found: 3(NXDOMAIN) And we hope it stays that way. Iframes generator: http | Tools | About ... Iframes generator: http

link to this change log

Changes to the page labs.sucuri.net/?notes are logged on this page as they are detected. You can link to this log by pasting the HTML below into your page. It produces a link which looks like this: change log

Sucuri Malware Labs

monitor this page

summary of most recent changes

link to this change log

log in

search