There’s not much to the recurring “Your Photos” spam apart from some terse text and a link. In this case the spam leads to a malicious payload at [donotclick]pussyriotss.ru:8080/forum/showthread.php?page=5fa58bce769e5c2c (report here).
pussyriotss.ru? Well, if you follow the news in Russia at all then you will have heard of the Pussy Riot case. The IP addresses for pussyriotss.ru are:
190.120.228.92 (Infolink, Panama)
116.12.49.68 (Usonyx , Singapore)
These IPs are also associated with spb-koalitia.ru and a whole bunch of other badness, blocking them would be prudent.
Leave a reply
