Creepy BLF Mirrors - Let's figure this out.

[SquartleTurtle]

forum for IT geniuses

[Ad Bot]

[Electrk.]

forum for IT geniuses

ftfy

[XR-7]

ftfy

Which one is that

[Beefcaik]

[Miga]

Yet more goofiness: all the download links for all the trojaned files are hosted at some guy's house. He's using a D-Link router presumably and using the DynDNS service that D-Link provides. The machine that he's hosting the trojan on is running Debian 6.

[McZealot]

I'm trying to contact the support teams for Persephonebooks and Getchip and that site Carbon linked. I really want to know what is going on and how this is happening to their sites. A little awkward since it's all in Russian.

[dargereldren]

did a Google search for my username in both websites, i'm still there

i'm "dargereldren,Barnabas" because the scraping is horrible

[Ragequit]

Yet more goofiness: all the download links for all the trojaned files are hosted at some guy's house. He's using a D-Link router presumably and using the DynDNS service that D-Link provides. The machine that he's hosting the trojan on is running Debian 6.

what country

[Miga]

what country

Looks like the IP traces back to France.

[McZealot]

OK. The crappy skyline banner seems to be the #1 way to find these sites. I've added a bunch more to the OP. I'm gonna contact all the sites (the English ones at least) and ask what is going on.

[Dreams_Of_Cheese]

BTW: If you highlight the text you will see hidden messages in all posts. For some reason they are invisible?

I imagine this is so that search engines will pick on the invisible words and direct more people toward them. One moment you're looking up wheat bread, the next you're downloading malware.

[Miga]

OK. The crappy skyline banner seems to be the #1 way to find these sites. I've added a bunch more to the OP. I'm gonna contact all the sites (the English ones at least) and ask what is going on.

My guess is the person/group doing this is using some vulnerability in Apache to gain access to these sites and this is the result of not keeping your servers up-to-date. And yes, it's all the same person/group doing this, the trojan link leads back to the same D-Link DynDNS result.

[McZealot]

My guess is the person/group doing this is using some vulnerability in Apache to gain access to these sites and this is the result of not keeping your servers up-to-date. And yes, it's all the same person/group doing this, the trojan link leads back to the same D-Link DynDNS result.

goddamn are we all gonna get killed by the russian mafia or something now

[Blocky943]

[Dreams_Of_Cheese]

Hm. If they've picked up on stufflord then they've probably checked up on us recently. I wonder if they saw our thread, and that's why the forum from the book website disappeared?