[nsp-sec] ACK: Re: 6k probably compromised FTP accounts

Fri Apr 4 14:04:57 EDT 2008

On Fri, 4 Apr 2008, Tom Fischer wrote:

Proxy-ACK for 7859 (pair Networks).  A sanitized report is being 
forwarded to their abuse team.

jms

> attached (the second part of) a list of probably compromised
> FTP accounts. The data is based on an iframer toolkit
> (a toolkit which uses stolen FTP credentials to add iframes/JavaScript/...).

> 7859 | 209.68.2.73     | uinus.pair.com	| webuser
> 7859 | 216.92.75.22    | www.windjammer-landing.com	| windjamm
> 7859 | 66.39.65.51     | qs1605.pair.com	| salvator