[funsec] Funsec if your an MMA fan..watch for bad links!
nick at virus-l.demon.co.uk
Sun Nov 8 17:44:11 CST 2009
> Open the UrL on a VMstation and this time the file came from:
> "SearchglobalSecurity.com"..where as before it was from ""GuardSytem-scanner"
Changing target domains is nothing to do with FF, which is more about
changing/revolving the IPs returned as A records for a specific domain.
Changing the domains that the blackhat SEO, search-engine-referer-
checking redirects use is common in these Rogue AV, etc, etc scams,
typically happening once to several times a day (though that can be
tricky to trace informally because at least some of them use IP
tracking and after "a few" hits they will eventually redirect you to
some other page, such as an apparent search results page, etc).
More information about the funsec