[nsp-sec] yahoo malware

[Igor Gashinsky]

ACK..

On Wed, 6 Jul 2011, Jon Lewis wrote:

:: ----------- nsp-security Confidential --------
:: 
:: The zeus bot guy is back.
:: 
:: http://www.federal-taxes-irs[dot]com/taxes-report.pdf.exe
:: 
:: ;; QUESTION SECTION:
:: ;www.federal-taxes-irs.com.     IN      A
:: 
:: ;; ANSWER SECTION:
:: www.federal-taxes-irs.com. 1106 IN      CNAME   sbsfe.geo.mf0.yahoodns.net.
:: sbsfe.geo.mf0.yahoodns.net. 206 IN      A       98.139.135.22
:: sbsfe.geo.mf0.yahoodns.net. 206 IN      A       98.139.135.21
:: 
:: ;; AUTHORITY SECTION:
:: mf0.yahoodns.net.       172706  IN      NS      mf3.yahoo.com.
:: mf0.yahoodns.net.       172706  IN      NS      mf4.yahoo.com.
:: mf0.yahoodns.net.       172706  IN      NS      mf1.yahoo.com.
:: mf0.yahoodns.net.       172706  IN      NS      mf2.yahoo.com.
:: 
:: ----------------------------------------------------------------------
::   Jon Lewis, MCP :)           |  I route
::   Senior Network Engineer     |  therefore you are
::   Atlantic Net                |
:: _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________
:: 
:: 
:: _______________________________________________
:: nsp-security mailing list
:: nsp-security at puck.nether.net
:: https://puck.nether.net/mailman/listinfo/nsp-security
:: 
:: Please do not Forward, CC, or BCC this E-mail outside of the nsp-security
:: community. Confidentiality is essential for effective Internet security counter-measures.
:: _______________________________________________
:: 

--------------------+----------------------+------------------
   Igor Gashinsky   | Network Architecture | Yahoo! Inc.
 igor at yahoo-inc.com |  cell 917.807.2213   | Do You... Yahoo?
--------------------+----------------------+------------------