Translate

Posts mit dem Label Category SUSPICIOUS IP werden angezeigt. Alle Posts anzeigen
Posts mit dem Label Category SUSPICIOUS IP werden angezeigt. Alle Posts anzeigen

1/07/2014

Category MALICIOUS DOMAIN & IP: www.7secretsearch.com - Referrer-Bot - Spam-Bot - (IP: 192.157.253.9 - United States)

Potentially Malicious Spam (PHISHING, REFERRER) Domain:


 SECRET SPAM 

 

How To Control Visits From Referring Bots Such as Vampirestat, 7secretsearch and Adsensewatchdog ?


Have you ever been annoyed by these sites which increases your visits in your blog and no visits appear in Google Analytics? Or the infamous Whos.amung.us toolbar ? The anonymous robot visits from Vampirestat or Adsensewatchdog and www.7secretsearch.com. Neither Adsensewatchdog nor any other of these Bots have anything whatsoever to do with Google or Google AdSense and are simply spam sites that use automated traffic to blogs to attract clicks to their own sites from blog owners such as you.

Stay away. Traffic from these sites won't affect your standing with the real Adsense, so just ignore them.

Follow the next steps to get these bots under contol and to reduce their traffic:
  • Never click on the referred Domain links in your Blog or Webmaster Satistics, or visit their site.
  • Instead make a post (like this one) on your blog, with a negative review. On the long run their reputation will fall down to negative. Reputation is all that makes them lose.
  • Go to Virus Total (you can stay there anonymous), scan the URL of that Malware Domain, and give em a red flag. If you register you can also post your meaning giving a review. On my blog, if you look through deeply enough, there are enough referring Lookup-Domains for getting information (good or bad) upon a suspicious link or Domain.
  • Additionally, you also can submit a SPAM report to Google (Webmastertools) here.
Vampirestat whois info can be found here:


DOMAIN:
www.7secretsearch.com
  • https://www.virustotal.com/de/url/739a8261db4d68ae323ed83cfbc607b660a24b795f8303556f69a16ff8401d3d/analysis/1389109170/
  • https://www.mywot.com/en/scorecard/7secretsearch.com

www.7secretsearch.com also LINKS TO THESE MALICIOUS DOMAINS (either directly or indirectly):
widgets.amung.us
  • https://www.virustotal.com/de/url/7d7680eeb36197872a2ece324606e7743b74fd3a8e9630c6c368a3e1e21750b3/analysis/1389106363/
  • https://www.mywot.com/en/scorecard/widgets.amung.us
ad.yieldmanager.com
  • https://www.virustotal.com/de/url/e0a975001a88f4f74a9d2b665d51f2926c2419314d71064df9154651e39cf4a3/analysis/1389106564/
  • https://www.mywot.com/en/scorecard/ad.yieldmanager.com
content.yieldmanager.edgesuite.net
  • https://www.virustotal.com/de/url/e6800829b1dc059b832b190918b88a3bf2a9e3abec2ec851fd97f1ef0cae3d5f/analysis/1389106685/
  • https://www.mywot.com/en/scorecard/content.yieldmanager.edgesuite.net
i.imgur.com
  • https://www.virustotal.com/de/url/342cf1310c26da63f694aa634371ad46b4eca8e3a872cf6fa57580da670b3f18/analysis/1389110141/ 
  • http://www.urlvoid.com/scan/i.imgur.com/
  • https://www.mywot.com/en/scorecard/i.imgur.com
ads1.qadabra.com
  • https://www.virustotal.com/de/url/12a7166afab22285b29fbb66a049ff087a12cc15de8946c14c8f854a32753030/analysis/1389110286/
  • https://www.mywot.com/en/scorecard/ads1.qadabra.com
******************************************
IP:
www.7secretsearch.com = 192.157.253.9
  • https://www.virustotal.com/de/url/53855973d65537bd71949729a1f4d4d0e8cb9abb1a4cf483e3cbabaa00b3b0ed/analysis/1389106168/
  • https://www.virustotal.com/de/ip-address/192.157.253.9/information/
Fwd/Rev DNS Match: No
  • http://www.senderbase.org/lookup/?search_string=192.157.253.9
RELATED POSTS: 

Category MALICIOUS DOMAIN & IP: www.vampirestat.com - Referrer-Bot - Spam-Bot - (IP: 192.157.253.9 - United States)

Potentially Malicious Spam (PHISHING, REFERRER) Domain:


 

How To Control Visits From Referring Bots Such as Vampirestat and Adsensewatchdog ?


Have you ever been annoyed by these sites which increases your visits in your blog and no visits appear in Google Analytics? Or the infamous Whos.amung.us toobbar ? The anonymous robot visits from Vampirestat or Adsensewatchdog. Neither Adsensewatchdog nor any other of these Bots have anything whatsoever to do with Google or Google AdSense and are simply spam sites that use automated traffic to blogs to attract clicks to their own sites from blog owners such as you.

Stay away. Traffic from these sites won't affect your standing with the real Adsense, so just ignore them.

Follow the next steps to get these bots under contol and to reduce their traffic:
  • Never click on the referred Domain links in your Blog or Webmaster Satistics, or visit their site.
  • Instead make a post (like this one) on your blog, with a negative review. On the long run their reputation will fall down to hell. Reputation is all that makes them lose.
  • Go to Virus Total (you can stay there anonymous), scan the URL of that Malware Domain, and give em a red flag. If you register you can also post your meaning giving a review. On my blog, if you look through deeply enough, there are enough referring Lookup-Domains for getting information (good or bad) upon a suspicious link or Domain.
  • Additionally, you also can submit a SPAM report to Google (Webmastertools) here.
Vampirestat whois info can be found here:


DOMAIN:
www.vampirestat.com
  • https://www.virustotal.com/de/url/351a5e04578dbede25165617ca14aa393ee229efdc533bae6a1f0960af976edf/analysis/1389105156/
  • https://www.mywot.com/en/scorecard/vampirestat.com
  • http://www.urlvoid.com/scan/vampirestat.com/
www.vampirestat.com also LINKS TO THESE MALICIOUS DOMAINS (either directly or indirectly):
widgets.amung.us
  • https://www.virustotal.com/de/url/7d7680eeb36197872a2ece324606e7743b74fd3a8e9630c6c368a3e1e21750b3/analysis/1389106363/
  • https://www.mywot.com/en/scorecard/widgets.amung.us
ad.yieldmanager.com
  • https://www.virustotal.com/de/url/e0a975001a88f4f74a9d2b665d51f2926c2419314d71064df9154651e39cf4a3/analysis/1389106564/
  • https://www.mywot.com/en/scorecard/ad.yieldmanager.com
content.yieldmanager.edgesuite.net
  • https://www.virustotal.com/de/url/e6800829b1dc059b832b190918b88a3bf2a9e3abec2ec851fd97f1ef0cae3d5f/analysis/1389106685/
  • https://www.mywot.com/en/scorecard/content.yieldmanager.edgesuite.net
******************************************
IP:
www.vampirestat.com = 192.157.253.9
  • https://www.virustotal.com/de/url/53855973d65537bd71949729a1f4d4d0e8cb9abb1a4cf483e3cbabaa00b3b0ed/analysis/1389106168/
  • https://www.virustotal.com/de/ip-address/192.157.253.9/information/
Fwd/Rev DNS Match: No
  • http://www.senderbase.org/lookup/?search_string=192.157.253.9
RELATED POST: 

Category MALICIOUS DOMAIN & IP: www.adsensewatchdog.com - Referrer-Bot - Spam-Bot - (IP: 62.116.143.21 - GERMANY)

Potentially Malicious Spam (PHISHING, REFERRER) Domain:


 

How To Control Visits From Referring Bots Such as Vampirestat and Adsensewatchdog ?

Have you ever been annoyed by these sites which increases your visits in your blog and no visits appear in Google Analytics? Or the infamous Whos.amung.us toolbar ? The anonymous robot visits from Vampirestat or Adsensewatchdog. Neither Adsensewatchdog nor any other of these Bots have anything whatsoever to do with Google or Google AdSense and are simply spam sites that use automated traffic to blogs to attract clicks to their own sites from blog owners such as you.

Stay away. Traffic from these sites won't affect your standing with the real Adsense, so just ignore them.

Follow the next steps to get these bots under contol and to reduce their traffic:
  • Never click on the referred Domain links in your Blog or Webmaster Satistics, or visit their site.
  • Instead make a post (like this one) on your blog, with a negative review. On the long run their reputation will fall down to negative. Reputation is all that makes them lose.
  • Go to Virus Total (you can stay there anonymous), scan the URL of that Malware Domain, and give em a red flag. If you register you can also post your meaning giving a review. On my blog, if you look through deeply enough, there are enough referring Lookup-Domains for getting information (good or bad) upon a suspicious link or Domain.
  • Additionally, you also can submit a SPAM report to Google (Webmastertools) here.
Adsense Watchdog whois info can be found here:


DOMAIN:
www.adsensewatchdog.com
  • https://www.virustotal.com/de/url/921112e01ece904b7e24283c7ec7ef528e7a3dc1ac245b8f587e6433436ce107/analysis/1389090321/
  • http://zulu.zscaler.com/submission/show/fe117411f30d42cb7739f297064075f2-1389090365
  • https://www.mywot.com/en/scorecard/adsensewatchdog.com
  • http://www.urlvoid.com/scan/adsensewatchdog.com/
adsensewatchdog also LINKS TO MALICIOUS DOMAIN:
g.ateway.net/scripts/js3caf.js
  • https://www.virustotal.com/de/url/0b99952398ba93d977c9cc1e2643ceafe173bfabe3457b2ab3e625458dbc983e/analysis/1389090678/
*************************************
IP:
www.adsensewatchdog.com = 62.116.143.21
  • https://www.virustotal.com/de/url/39f28e85728fbfeaa15bee84c353657140821d8e8b77585f1e57bbd8628ebf60/analysis/1389091150/
  • http://www.urlvoid.com/ip/62.116.143.21
Web Reputation: Poor
  • http://www.senderbase.org/lookup/?search_string=62.116.143.21
  • https://www.virustotal.com/de/ip-address/62.116.143.21/information/
 
RELATED POST: 

12/08/2013

Category SUSPICIOUS IP: 17.158.8.111 - HELOs as 17.158.8.111 for 185.5.99.21 - RFC 2821, section 4.1.1.1

In the Latest CBL Statement (in Relation to this MALICIOUS IP-Posting) the following has been analysed:

It was last detected at 2013-12-08 03:00 GMT (+/- 30 minutes), approximately 3 hours, 30 minutes ago. 
The listing of this IP is because it HELLOs as (IP) 17.158.8.111. Not only is this a violation of RFC2821/5321 section 4.1.1.1, it's even more frequently a sign of infection. (RFC 2821, section 4.1.1.1 Extended HELLO (EHLO) or HELLO (HELO))
These listings are often a sign of a compromised SSH account. If you are running a SSH service (especially on Linux), please check your ssh server logs (often /var/log/auth.log) for logins from this IP. If you find any, secure the associated account. This usually means changing the password or disabling the account. 
If it's a mail server, see naming problems for details on how to diagnose and fix the problem. 
If IP address 17.158.8.111 is or is NATing for a Symantec Protection Center instance, this appears to be a known issue. See this Knowlege Base item. We are attempting to work through this issue with them. Their KB item was updated October 18, 2010 to indicate that they now understand the issue. 
The KB item indicates that the problem will be resolved in a "future build", but no ETA is provided. If you have SPC's email notification feature turned on, we recommend turning it off before delisting your IP address as a temporary workaround. 
This IP is infected (or NATting for a computer that is infected) with a spam-sending infection. In other words, it's participating in a botnet. If you simply remove the listing without ensuring that the infection is removed (or the NAT secured), it will probably relist again.

CBL-LINK:  http://cbl.abuseat.org/lookup.cgi?ip=185.5.99.21

Network Owner on this IP: Apple