Tuesday, 28 May 2013
Something (a bit) evil on 158.255.212.96 and 158.255.212.97
Posted on 04:15 by Unknown
The IPs 158.255.212.96 and 158.255.212.97 (EDIS GmbH, Austria) are hosting malware used in injection attacks (see this example for fussball-gsv.de). These two examples report a TDS URL pattern which is resistant to automated analysis. The domains appear to be part of a traffic exchanger system (never a good idea), but they have been used to distribute malware.
The following sites are hosted on
Subscribe to:
Post Comments (Atom)
0 comments:
Post a Comment