Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email email@example.com
Re: More Webserver / IE Exploits
From: Benjamin Franz (snowharenihongo.org)
Date: Tue Jul 20 2004 - 12:15:45 CDT
On Mon, 19 Jul 2004, Hubbard, Dan wrote:
> We have discovered more than 300 websites that include malicious code
> that will attempt to run a program on your machine without end-user
> intervention. Similar to the recent Scob attack, a dual-pronged approach
> of exploiting vulnerable servers and clients is being used.
> There is no commonality on the web server side with the exception of 164
> sites that are all hosted by the same hosting facility in Florida.
> Details on the hosting facility in Florida:
> The site that includes the exploit code is:
I suspect this domain is a BlackHat server - period. We had a keylogger
trojan ("Padonok" - it WAS NOT detected by our any of our virus scanners,
malware detectors et al) hit one of our desktops more than a month ago.
It tried to deliver the stolen data to that server. That they are *still*
in operation tells you that they are either unbelievably incompetent or
actually owned in the financial sense by the bad guys.
Here is what little I know about them:
That dates all the way back to March...
Nisi pecuniam omnem mihi dabis ad capul tuum saxum immane mittam.
(Translation: "I have a catapult. Give me all the money or I will fling
an enormous rock at your head.")