Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: Rogue AV exploiting Haiti earthquake - SANS Internet Storm Center SANS ISC InfoSec Forums

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Rogue AV exploiting Haiti earthquake

Just when you think they couldn't possibly go any lower ... The bad guys behind the Rogue AV scam (see my old diary at about Rogue AV) are heavily using SEO techniques to make links to their sites appear high on search engines. For example, when using Google to search for "haiti earthquake donation" top 6 hits (!) lead to compromised web sites which in turn check the referrer (they verify if you are coming from a search engine) and, if that is true, redirect you to another web site.

Haiti Earthquake Donation search results

At the moment they are redirecting to which appears to be taken down.
As posted on numerous places yesterday – if you plan on donating be very careful about sites you visit.


I will be teaching next: Web App Penetration Testing and Ethical Hacking - SANS Brussels September 2019


381 Posts
ISC Handler

Sign Up for Free or Log In to start participating in the conversation!