[nsp-sec] MW Distribution site AS36351 | 67.228.238.122

[Serge Droz]

Hello List,

36351   | 67.228.238.122   | SOFTLAYER - SoftLayer Technologies Inc.


hxxp://fxwygfxes.com/cgi-bin/index.cgi?b99e7c610100f060007c06eb38060000000002f1c4fe57ff03656e2d75730000000000
hxxp://fxwygfxes.com/cgi-bin/index.cgi?b99e7c610100f060027c06eb38060000000002f1c4fe0000030409000000000200

Seems to very be actively distributing sinowal/torpig

People get to this URL through mass infected webpages (javascript inserted, ....)

Any help is appreciated

Serge
-- 
SWITCH
Serving Swiss Universities
--------------------------
Serge Droz, SWITCH-CERT
Werdstrasse 2, P.O. Box, 8021 Zurich, Switzerland
phone +41 44 268 15 63, fax +41 44 268 15 78
serge.droz at switch.ch, http://www.switch.ch