Author Topic: Google: Webalizer exploits gone wild!  (Read 6864 times)

0 Members and 1 Guest are viewing this topic.

August 16, 2009, 02:34:27 pm
Read 6864 times

MysteryFCM

  • Administrator
  • Hero Member

  • Offline
  • *****

  • 1693
  • Personal Text
    Phishing Phanatic
    • I.T. Mate
Quote
Okay, so the title may be wierd, but it sounded good and a little appropriate given both are involved (albeit one indirectly). I came across these whilst researching something else, and thought I'd give it a mention.

In short, as shown in the screenshot, these show a slew of sites that appear to have had Webalizer exploited, with some lovely little exploits put on the sites for unwitting victims that happen to visit. Chances are these will possibly load on the sites themselves, regardless of the URL used, if Webalizer files are referenced, but that's pure speculation as I've not checked.

When visiting one of the sites, for example;

dreisbachmotors.com/webalizer/050709wareza/index.html

You see (if you look at the source code), a .js file (images/counter.js) being loaded;

http://hphosts.blogspot.com/2009/08/google-webalizer-exploits-gone-wild.html
Regards

Steven Burn
I.T. Mate / hpHosts
it-mate.co.uk / hosts-file.net

August 16, 2009, 02:45:24 pm
Reply #1

cleanmx

  • Special Members
  • Hero Member

  • Offline
  • *

  • 3405
    • Spam-Filter Anti-Spam Virenschutz - CLEAN MX Managed Anti-Spam Service ist die Lösung für Ihr Spam-Problem
Hi we crawled these so far...
Code: [Select]
http://dostuz.biz/tags/tag-bic.html
http://darbutterfly.com/webalizer/050709wareza/crack=35=keygen=serial.html
http://consulatebrazil.com/webalizer/050709wareza/crack%3D32%3Dkeygen%3Dserial.html
http://gameophilia.net/webalizer/050709wareza/crack=2=keygen=serial.html
http://contactchange.com/webalizer/050709wareza/crack=10=keygen=serial.html
http://darwebhosting.com/webalizer/050709wareza/crack%3D7%3Dkeygen%3Dserial.html
http://explorerecuador.com/webalizer/050709wareza/crack=3=keygen=serial.html
http://matthewscraftsunique.com/webalizer/050709wareza/crack=53=keygen=serial.html
http://highbastard.com/webalizer/050709wareza/crack=4=keygen=serial.html
http://dreamflierstudios.com/webalizer/050709wareza/crack=58=keygen=serial.html
http://vancityweddings.com/webalizer/050709wareza/crack=25=keygen=serial.html
http://chefsaithong.com/webalizer/050709warez/download%3Dcrack%3Dview%3D19%3Dkeygen.html
http://donspage.com/webalizer/050709wareza/crack=14=keygen=serial.html
http://graphicoremedia.com/webalizer/050709wareza/crack%3D15%3Dkeygen%3Dserial.html
http://dirrtyhairy.com/webalizer/050709wareza/crack%3D35%3Dkeygen%3Dserial.html
http://freedomflyingschool.ca/webalizer/050709warez/download=crack=view=2=keygen.html
http://vancityweddings.com/webalizer/050709wareza/crack=25=keygen=serial.html
http://dirrtyhairy.com/webalizer/050709wareza/crack%3D35%3Dkeygen%3Dserial.html
http://dowa-tht.com/webalizer/050709wareza/crack%3D23%3Dkeygen%3Dserial.html
http://garber-properties.com/webalizer/050709wareza/crack%3D12%3Dkeygen%3Dserial.html
http://crazyhorsetoo.com/webalizer/050709wareza/crack=66=keygen=serial.html
http://bsatroop91.org/webalizer/050709wareza/crack%3D4%3Dkeygen%3Dserial.html
http://blt.kz/1/load.php?e=6
http://mahdilib.ir/webalizer/050709wareza/crack=8=keygen=serial.html
http://eco-gen.com/webalizer/050709wareza/crack%3D16%3Dkeygen%3Dserial.html
http://maemaematernity.com/webalizer/050709wareza/crack%3D1%3Dkeygen%3Dserial.html
http://greenenergy.com.pe/webalizer/050709wareza/crack=7=keygen=serial.html
http://georgelwilliams.com/webalizer/050709wareza/crack%3D41%3Dkeygen%3Dserial.html
http://actionitems.itone.net/webalizer/eng-warez15092009/download%3Dcrack%3Dview%3D19%3Dkeygen.html
http://lappedilla.no/webalizer/050709wareza/crack=45=keygen=serial.html
http://harringtonreed.com/webalizer/050709wareza/crack=6=keygen=serial.html

August 16, 2009, 02:50:51 pm
Reply #2

MysteryFCM

  • Administrator
  • Hero Member

  • Offline
  • *****

  • 1693
  • Personal Text
    Phishing Phanatic
    • I.T. Mate
Regards

Steven Burn
I.T. Mate / hpHosts
it-mate.co.uk / hosts-file.net

August 16, 2009, 04:18:26 pm
Reply #3

cleanmx

  • Special Members
  • Hero Member

  • Offline
  • *

  • 3405
    • Spam-Filter Anti-Spam Virenschutz - CLEAN MX Managed Anti-Spam Service ist die Lösung für Ihr Spam-Problem

August 16, 2009, 07:17:04 pm
Reply #4

SysAdMini

  • Administrator
  • Hero Member

  • Offline
  • *****

  • 3335
Ruining the bad guy's day

August 17, 2009, 02:00:17 am
Reply #5

Malware-Web-Threats

  • Special Members
  • Hero Member

  • Offline
  • *

  • 354
    • MalwareURL
a few more

Code: [Select]
7gameonline.com/webalizer/050709wareza/crack=17=keygen=serial.html
alexanderarzberger.com/webalizer/050709wareza/crack=17=keygen=serial.html
al-fahed.com/webalizer/050709wareza/crack=17=keygen=serial.html
alhabeshi.com/webalizer/050709wareza/crack=17=keygen=serial.html
allstarsportsacademy.com/webalizer/050709wareza/crack=17=keygen=serial.html
al-mutawaa.com/webalizer/050709wareza/crack=17=keygen=serial.html
atiehekavir.com/webalizer/050709wareza/crack=17=keygen=serial.html
barrycommunity.com/webalizer/050709wareza/crack=17=keygen=serial.html
callingcardsinstantly.com/webalizer/050709wareza/crack=17=keygen=serial.html
castawaysmarina.com/webalizer/050709wareza/crack=17=keygen=serial.html
chefsaithong.com/webalizer/050709wareza/crack=17=keygen=serial.html
chiangmaiguide.com/webalizer/050709wareza/crack=17=keygen=serial.html
commonwealthparenting.org/webalizer/050709wareza/crack=17=keygen=serial.html
coopcentral.com.co/webalizer/050709wareza/crack=17=keygen=serial.html
crazyhorsetoophilly.com/webalizer/050709wareza/crack=17=keygen=serial.html
createdillusionsartgallery.com/webalizer/050709wareza/crack=17=keygen=serial.html
creativeimagephotographics.com/webalizer/050709wareza/crack=17=keygen=serial.html
crocencounters.org/webalizer/050709wareza/crack=17=keygen=serial.html
cslogix.com/webalizer/050709wareza/crack=17=keygen=serial.html
ctlf.ca/webalizer/050709wareza/crack=17=keygen=serial.html
customgraphicproducts.com/webalizer/050709wareza/crack=17=keygen=serial.html
cvm3.us/webalizer/050709wareza/crack=17=keygen=serial.html
danceafficionado.com/webalizer/050709wareza/crack=17=keygen=serial.html
dawnframing.com/webalizer/050709wareza/crack=17=keygen=serial.html
deancastleriding.co.uk/webalizer/050709wareza/crack=17=keygen=serial.html
derosarinconada.com/webalizer/050709wareza/crack=17=keygen=serial.html
dhofarinsurance.com/webalizer/050709wareza/crack=17=keygen=serial.html
dhscatwalk.com/webalizer/050709wareza/crack=17=keygen=serial.html
dianahignutt.com/webalizer/050709wareza/crack=17=keygen=serial.html
dibufalafarms.com/webalizer/050709wareza/crack=17=keygen=serial.html
digital-piano.co.uk/webalizer/050709wareza/crack=17=keygen=serial.html
djstripe.com/webalizer/050709wareza/crack=17=keygen=serial.html
dmarco.com.pe/webalizer/050709wareza/crack=17=keygen=serial.html
donspage.com/webalizer/050709wareza/crack=17=keygen=serial.html
dreamflierstudios.com/webalizer/050709wareza/crack=17=keygen=serial.html
dreamsgallery.com/webalizer/050709wareza/crack=17=keygen=serial.html
easyarabia.com/webalizer/050709wareza/crack=17=keygen=serial.html
ecarquote.com/webalizer/050709wareza/crack=17=keygen=serial.html
engagementgroup.nl/webalizer/050709wareza/crack=17=keygen=serial.html
enieargentina.com.ar/webalizer/050709wareza/crack=17=keygen=serial.html
envirohempfamily.com/webalizer/050709wareza/crack=17=keygen=serial.html
equipement2000.com/webalizer/050709wareza/crack=17=keygen=serial.html
ervaring.nl/webalizer/050709wareza/crack=17=keygen=serial.html
espantaplagas.com/webalizer/050709wareza/crack=17=keygen=serial.html
espritensemble.com/webalizer/050709wareza/crack=17=keygen=serial.html
extruded-profiles.com/webalizer/050709wareza/crack=17=keygen=serial.html
fctfcu.org/webalizer/050709wareza/crack=17=keygen=serial.html
fishmonger.co.za/webalizer/050709wareza/crack=17=keygen=serial.html
free-crochet-pattern.com/webalizer/050709wareza/crack=17=keygen=serial.html
freedomflyingschool.ca/webalizer/050709wareza/crack=17=keygen=serial.html
frugalcomputing.com/webalizer/050709wareza/crack=17=keygen=serial.html
gatlininvestigations.com/webalizer/050709wareza/crack=17=keygen=serial.html
gentlecreekhorsefarm.com/webalizer/050709wareza/crack=17=keygen=serial.html
georgelwilliams.com/webalizer/050709wareza/crack=17=keygen=serial.html
gicleephotography.com/webalizer/050709wareza/crack=17=keygen=serial.html
globalitbusiness.com/webalizer/050709wareza/crack=17=keygen=serial.html
gqvelasquez.com/webalizer/050709wareza/crack=17=keygen=serial.html
grandappraisers.com/webalizer/050709wareza/crack=17=keygen=serial.html
navast.com/webalizer/050709wareza/crack=17=keygen=serial.html
dirrtyhairy.com/webalizer/050709wareza/crack=17=keygen=serial.html
vancityweddings.com/webalizer/050709wareza/crack=17=keygen=serial.html
brighidswell.info/webalizer/050709wareza/crack=17=keygen=serial.html
irusniroo.com/webalizer/050709wareza/crack=17=keygen=serial.html
matthewscraftsunique.com/webalizer/050709wareza/crack=17=keygen=serial.html
darwebhosting.com/webalizer/050709wareza/crack=17=keygen=serial.html
contactchange.com/webalizer/050709wareza/crack=17=keygen=serial.html

domain only:

Code: [Select]
7gameonline.com
alexanderarzberger.com
al-fahed.com
alhabeshi.com
allstarsportsacademy.com
al-mutawaa.com
atiehekavir.com
barrycommunity.com
callingcardsinstantly.com
castawaysmarina.com
chefsaithong.com
chiangmaiguide.com
commonwealthparenting.org
coopcentral.com.co
crazyhorsetoophilly.com
createdillusionsartgallery.com
creativeimagephotographics.com
crocencounters.org
cslogix.com
ctlf.ca
customgraphicproducts.com
cvm3.us
danceafficionado.com
dawnframing.com
deancastleriding.co.uk
derosarinconada.com
dhofarinsurance.com
dhscatwalk.com
dianahignutt.com
dibufalafarms.com
digital-piano.co.uk
djstripe.com
dmarco.com.pe
donspage.com
dreamflierstudios.com
dreamsgallery.com
easyarabia.com
ecarquote.com
engagementgroup.nl
enieargentina.com.ar
envirohempfamily.com
equipement2000.com
ervaring.nl
espantaplagas.com
espritensemble.com
extruded-profiles.com
fctfcu.org
fishmonger.co.za
free-crochet-pattern.com
freedomflyingschool.ca
frugalcomputing.com
gatlininvestigations.com
gentlecreekhorsefarm.com
georgelwilliams.com
gicleephotography.com
globalitbusiness.com
gqvelasquez.com
grandappraisers.com
navast.com
dirrtyhairy.com
vancityweddings.com
brighidswell.info
irusniroo.com
matthewscraftsunique.com
darwebhosting.com
contactchange.com

August 17, 2009, 07:41:30 am
Reply #6

MysteryFCM

  • Administrator
  • Hero Member

  • Offline
  • *****

  • 1693
  • Personal Text
    Phishing Phanatic
    • I.T. Mate
Lil followup with a linky to here, and some info on the ongoing LunarPages issue;

http://hphosts.blogspot.com/2009/08/update-google-webalizer-exploits.html
Regards

Steven Burn
I.T. Mate / hpHosts
it-mate.co.uk / hosts-file.net

August 17, 2009, 08:36:23 am
Reply #7

cleanmx

  • Special Members
  • Hero Member

  • Offline
  • *

  • 3405
    • Spam-Filter Anti-Spam Virenschutz - CLEAN MX Managed Anti-Spam Service ist die Lösung für Ihr Spam-Problem