PDA

View Full Version : Coolwebsearch / Trafficadvance Update



PlNGY
2006-04-06, 19:32
Courtesy of our friends at ISC (http://isc.sans.org/diary.php):
http://isc.sans.org/diary.php?storyid=1245

Coolwebsearch / Trafficadvance got a new home...
Published: 2006-04-05,
Last Updated: 2006-04-05 20:09:42 UTC by Daniel Wesemann (Version: 1)

Looks like our long-time "friends" from the Coolwebsearch/Trafficadvance malware department have moved shop to a new hoster. If you've followed our earlier suggestions and zapped their old netblock (81.9.5.x), well, then you might want to consider banning their new sites as well. They all seem reside under 85.249.23.x now, again in St.Petersburg, Russia. If you prefer to block their domains, here's a list. All of the indicated domain names end in .biz.

traffsale1 traffweb toolbarweb toolbarsale iframecash traffcool toolbarcool traffbucks toolbarbucks traffdollars toolbardollars traffbest toolbarbest traffnew toolbarnew traffmoney toolbarmoney vip01

Be advised that unwary surfing to these sites might make your DVD drive spit out peperoni slices, cause your monitor to start flickering, and definitely will result in other side effects detrimental to the integrity of your beloved computing device. You have been warned.
Letting you know if you didn't already. :bigthumb:

tashi
2006-04-06, 19:44
Thanks. :)

FYI: We have an alert's forum hosted by AplusWebMaster.

http://forums.spybot.info/showthread.php?p=19212#post19212