Threat Level: green Handler on Duty: Johannes Ullrich

SANS ISC: InfoSec Handlers Diary Blog - Rogue AV exploiting Haiti earthquake InfoSec Handlers Diary Blog

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

Rogue AV exploiting Haiti earthquake

Published: 2010-01-14
Last Updated: 2010-01-14 18:45:02 UTC
by Bojan Zdrnja (Version: 1)
0 comment(s)

Just when you think they couldn't possibly go any lower ... The bad guys behind the Rogue AV scam (see my old diary at about Rogue AV) are heavily using SEO techniques to make links to their sites appear high on search engines. For example, when using Google to search for "haiti earthquake donation" top 6 hits (!) lead to compromised web sites which in turn check the referrer (they verify if you are coming from a search engine) and, if that is true, redirect you to another web site.

Haiti Earthquake Donation search results

At the moment they are redirecting to which appears to be taken down.
As posted on numerous places yesterday – if you plan on donating be very careful about sites you visit.


0 comment(s)
Diary Archives