Scareware

Exposing a Portfolio of Pay Per Install Rogue and Fraudulent and Malicious Affiliate Network Domains – An OSINT Analysis

24 Jan 2022 By Dancho Danchev

  Dear blog readers, I’ve decided to share with everyone an in-depth historical OSINT analysis on some of the primary pay per install rogue fraudulent and malicious affiliate network based rogue and fraudulent revenue sharing scheme operating malicious software gangs that are known to have been active back in 2008 with the idea to assistRead More

Exposing the Pay Per Install (PPI) Underground Market Fraudulent and Rogue Business Model – A Photos Compilation

20 Jan 2022 By Dancho Danchev

Dear blog readers, I’ve decided to share with everyone a photos compilation which I obtained and actually collected back in 2008 using Technical Collection for the purtpose of demonstrating the basics of the pay per install fraudulent anda rogue underground market business model with the idea to improve’s situational awareness in the field of researchingRead More

Dissecting the Ongoing Mass SQL Injection Attack

20 Oct 2011 By Dancho Danchev

The ongoing mass SQL injection attack, has already affected over a million web sites. Cybercriminals performing active search engines reconnaissance have managed to inject a malicious script into ASP ASP.NET websites. From client-side exploits to bogus Adobe Flash players, the campaign is active and ongoing. In this intelligence brief, we’ll dissect the campaign and establishRead More

Dissecting the Massive SQL Injection Attack Serving Scareware

31 Mar 2011 By Dancho Danchev

A currently ongoing massive SQL injection attack has affected hundreds of thousands of web pages across the Web, to ultimately monetize the campaign through a scareware affiliate program. Such massive SQL injection attempts are usually conducted using mass vulnerability scanning tools, with the help of search engines which have already crawled the vulnerable sites. What’sRead More

Koobface Gang Responds to the “10 Things You Didn’t Know About the Koobface Gang Post”

17 May 2010 By Dancho Danchev

UPDATED Moday, May 24, 2010: The scareware domains/redirectors pushed by the Koobface botnet, have been included at the bottom of this post, including detection rates and phone back URLs. On May 13th, 2010, the Koobface gang responded to my “10 things you didn’t know about the Koobface gang” post published in February, 2010, by includingRead More

Dissecting the Mass DreamHost Sites Compromise

11 May 2010 By Dancho Danchev

Yet another mass sites compromise is currently taking place, this time targeting DreamHost customers, courtesy of the same gang behind the U.S Treasury/GoDaddy/NetworkSolutions mass compromise campaigns. What’s particularly interesting about the campaign, is not just the Hilary Kneber connection, but also, the fact that a key command and control domain part of the Koobface botnet,Read More

From the Koobface Gang with Scareware Serving Compromised Sites

08 May 2010 By Dancho Danchev

Following last month’s “Dissecting Koobface Gang’s Latest Facebook Spreading Campaign” Koobface gang coverage, it’s time to summarize some of their botnet spreading activities, from the last couple of days. Immediately after the suspension of their automatically registered Blogspot accounts, the gang once again proved that it has contingency plans in place, and started pushing linksRead More

U.S. Treasury Site Compromise Linked to the NetworkSolutions Mass WordPress Blogs Compromise

04 May 2010 By Dancho Danchev

UPDATED: Saturday, May 08, 2010: 5 new domains have been introduced by the same gang, once again parked at 217.23.14.14, AS49981, WorldStream. jumpsearches.com – 217.23.14.14 – Email: alex1978a@bigmir.net ingeniosearch.net – 217.23.14.14 – Email: alex1978a@bigmir.net searchnations.com – 217.23.14.14 – Email: alex1978a@bigmir.net mainssearch.com – 217.23.14.14 – Email: alex1978a@bigmir.net bigsearchinc.com – 217.23.14.14 – Email: alex1978a@bigmir.net Sample exploitation structure:Read More

GoDaddy’s Mass WordPress Blogs Compromise Serving Scareware

27 Apr 2010 By Dancho Danchev

UPDATED: Thursday, May 13, 2010: Go Daddy posted the following update “What’s Up with Go Daddy, WordPress, PHP Exploits and Malware?“. UPDATED: Thursday, May 06, 2010: The following is a brief update of the campaign’s structure, the changed IPs, and the newly introduced scareware samples+phone back locations over the past few days. Sample structure fromRead More

Dissecting Koobface Gang’s Latest Facebook Spreading Campaign

27 Apr 2010 By Dancho Danchev

UPDATED: Thursday, April 29, 2010: Google is aware of these Blogspot accounts, and is currently suspending them. During the weekend, our “dear friends” from the Koobface gang — folks, you’re so not forgotten, with the scale of diversification for your activities to be publicly summarized within the next few days — launched another spreading attemptRead More

Unit-123.org E-shop Owner Information

Who is Dancho Danchev?

Unit-123.org

Focused on delivering daily batches of personally-produced never-ending supply of high-quality and never-published and released before classified and sensitive Intelligence Deliverables.

Latest Products