« July 2009 · January 2010 · September 2010 »

September 2009
MonTueWedThuFriSatSun
 010203040506
07080910111213
14151617181920
21222324252627
282930    
October 2009
MonTueWedThuFriSatSun
   01020304
05060708091011
12131415161718
19202122232425
262728293031 
November 2009
MonTueWedThuFriSatSun
      01
02030405060708
09101112131415
16171819202122
23242526272829
30      

Calendar:

  • No entries for November 2009.
  • No entries for October 2009.
  • No entries for September 2009.
Newest first Oldest first

Saturday, 4 July 2009

Independence Day - Waledac July 4th Update - New Domains Added


Happy Independence Day to those of you that are here int he United States of America. Just wanted to put out a quick update on Waledac. We have been keeping an eye on it for a bit and it's been actively spamming and updating clients to Fake Antivirus products for the last few months. However, we also saw it start spamming itself out again starting yesterday. Actually saw a quick first post of the from sudosecure.net:

http://www.sudosecure.net/archives/583

No real need to have tons of duplicate write-ups and screen shots. You can get the same basic information from the site. It's the standard spam to a link involving a fake YouTube video that wants you to download an executable.

The following are the most recent Waledac domains: 

	4thfirework.com
	biumer.com
	entrank.com
	fireholiday.com
	fireworksholiday.com
	fireworksnetwork.com
	fireworkspoint.com
	freeindependence.com
	gemells.com
	handyphoneworld.com
	happyindependence.com
	holidayfirework.com
	holidaysfirework.com
	holifireworks.com
	interactiveindependence.com
	movie4thjuly.com
	moviefireworks.com
	movieindependence.com
	movies4thjuly.com
	moviesfireworks.com
	moviesindependence.com
	outdoorindependence.com
	smophi.com
	superhandycap.com
	thehandygal.com
	video4thjuly.com
	videoindependence.com
	yourhandyhome.com
	yusitymp.com

Additionally the domain "miosmschat.com" has been receiving similar updates from Waledac. However, this domain has been around for a while and has been used to grab updates from Waledac infected clients.

We have updated our Waledac domain lists that you can use to block/track Waledac domains. The first URL is to the list that is updated with timestamps, ugly comments, and newest domains at the bottom:

http://www.shadowserver.org/wiki/uploads/Calendar/waledac_domains.txt

We also have the all-time Waledac domain list that contains just the domain listing since the start. It currently has 244 domains on it and can be reached via the following URL:

http://www.shadowserver.org/wiki/uploads/Calendar/waledac_list.txt

These are domains you definitely want to avoid visiting and consider blocking where possible.

=>Posted July 04, 2009, at 08:13 AM by Steven Adair