[nsp-sec] CC at 207.218.241.138

[Serge Droz]

Hi Steve,

alive an kicking just a few minutes ago.
It's from the URL kauto reported on IRC this morning:

http://www9.update.microsoft.com.cfm48.com/windowsupdate/v6/

(Agter clicking download ;-)

Serge

Stephen Gill wrote:
> We reported this one a couple of weeks ago:
> 
>  e66d77d6ef22848f5c81eccdd9cb9bb7775b95ba | 1fbee2a1a34b14e43be7a524ecf86edd
> |        12 | 5809323 | 2008-01-18 17:55:39 |
> http://207.218.241.138/forum.php | 207.218.241.138 | 207.218.241.138 | h
> ttp_post | Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR
> 1.1.4322) | 13749 | US
> 
> Ev1, is it still live?
> 
> -- steve
> 
> 
> On 2/6/08 12:50 PM, "Serge Droz" <serge.droz at switch.ch> wrote:
> 
>> ----------- nsp-security Confidential --------
>>
>> Hello
>>
>> AS      | IP               | AS Name
>> 13749   | 207.218.241.138  | EVERYONES-INTERNET - Everyones Internet
>>
>>
>> POST http://207.218.241.138:80/forum.php
>>
>> Starts sending Mail claiming to originate from Microsoft.
>>
>> Cheers
>> Serge
> 


-- 
SWITCH
Serving Swiss Universities
--------------------------
Serge Droz, SWITCH-CERT
Werdstrasse 2, P.O. Box, 8021 Zurich, Switzerland
phone +41 44 268 15 63, fax +41 44 268 15 78
serge.droz at switch.ch, http://www.switch.ch