[nsp-sec] compromised websites (ZeuS drive-by downloads)

[Dirk Stander]

.: Shelton, Steve (Mon, Apr 27, 2009 at 01:33:29PM -0400)
> Was the <hXXp://crew.abnc-portal.com/show.js> aimed at 220.196.59.26
> before being pointed at 88.80.216.114?

Hi Steve,

yes, you're right -- crew.abnc-portal.com did resolve to 220.196.59.26
(like counter.ironsteelmoney.com is doing now).

    Regards, Dirk (1&1) :.