More Malicious Domains
Three More Malicious Domains on 58.65.238.130
Killspy.org
Liveprotection.net
Stopingspy.com
A few days back I had written about the four malicious sites on the server 58.65.238.130. Link
Now the server is hosting seven malicious sites distributing Rogue Security applications. The entire list:
1. Dr-protection.com
2. Guard-center.com
3. Killspy.org
4. Liveantispy.com
5. Liveprotection.net
6. Online-guard.net
7. Stopingspy.com
The download from three new sites was submitted to visrutotal.com and here are the results:
Virustotal Scan Result: 5/32 (15.63%)
AhnLab-V3 2007.12.6.2 2007.12.06 Win-Trojan/Spyshield.51200
Kaspersky 7.0.0.125 2007.12.06 not-a-virus:FraudTool.Win32.SpySheriff.f
Microsoft 1.3007 2007.12.06 Program:Win32/SpySheriff
Sophos 4.24.0 2007.12.06 Troj/DrProt-Gen
VirusBuster 4.3.26:9 2007.12.06 Adware.SpySherif.Gen.2
As you can see the detections are poor stay away from all these sites.
Bharath MN
