[nsp-sec] ACK71,5714,10782 : Stolen FTP credentials

[Helmut Springer]

Hi,


On Tue, Feb 15, 2011 at 01:35:24PM +0000, Dirk Stander wrote:
> please find attached a list of stolen FTP-credentials, which have
> been used to inject IFrames (pointing to visions7[.]net or axstat[.]com)
> into legitimate web sites.
> 
> The format of the list is:
> <ASN> | <IP> | <CC> | <domain name> <user> <pass> | <AS desc>

Appreciating!

Any timeline available for when this happened?

Some of those belong to FTP drop boxes with upload only
functionality, CSIRT will follow-up on all.


Thanks
helmut

-- 
helmut springer                                          HP Services
email :      delta at hp.com
phone :  +49.7031.14.4240 
mobile: +49.160.9041.7679                    EMEA Escalation Manager