Exploitation List of 130+ Websites Hosted at U.K. Web Host 34SP.com
TOKYO (MacHouse) - In our last article, we reported that the peudo-MP3 music website hosted at blogspot distributes a list of exploited websites hosted at major U.S. web hosting company PowWeb. Sorting the entire list of websites, what we found is a list of possibly exploited websites hosted at U.K. web host 34SP.com. The following list contains 148 domains, of which at least 130 of them are still hosted by 34SP.com. And at least two of them are currently under exploitation. (The domains shown in italic are possibly out of 34SP.com.)
Earlier this week, we obtained a list of websites that were exploited to redirect Internet users to the fake anti-virus scan website of antivirus-scanner.com where a computer virus known as Troj/Dwnldr-HDG awaits them. Some victimized websites are owned by academic institutes including Beacon University, Arizona State University and Flagler College. One exploited website is actually run by a Japanese web hosting company. What a poor company… This web hosting company’s website (cyberbb.com) is still under exploitation.
 Screenshot 01 - Source: 34SP.COM |
 Screenshot 02 - Source: Rackspace Hosting |
 Screenshot 03 - Source: MacHouse |
And some other websites are either hosted by 34SP.com Ltd (See Screenshot 01.) or Rackspace Managed Hosting (See Screenshot 02.) . We don’t know the exact relationship between these two web hosting companies. Running a trace route search on ns.34sp.com takes us to the website of 34SP.com Ltd while running a trace route search on ns2.34sp.com takes us to the website of Rackspace Managed Hosting.
 Screenshot 04 - Source: MacHouse |
 Screenshot 05 - Source: MacHouse |
 Screenshot 06 - Source: MacHouse |
 Screenshot 07 - Source: MacHouse |
 Screenshot 08 - Source: MacHouse |
 Screenshot 09 - Source: MacHouse |
We don’t check the exploitation history of every website in the list above. We know that at least a couple of them including the websites of o2deals.co.uk and meccsa.org.uk are still under exploitation and redirect Internet users to the fake anti-virus scan website. At least one website in the list is so far free of redirection thanks to our kind notification.
We don’t know exactly how they exploited all or some of the websites in the list above. What we know is that they did not use the SQL injection in some of the victimized websites. Shown in Screenshot 03 is a simple PHP file obtained from one of the victimized websites. Again, the referrer matters. So, depending on where you originate, you might not be redirected to the fake anti-virus scan website.
What can the webmaster do if his or her website is in the exploitation list? We have listed up some security tips. Click here for more information.
References:
Exploitation List of 110+ Websites Hosted at PowWeb
The Official Website of British Band Camera Obscura Exploited for Fake Anti-Virus Scan
Warning: Fake Anti-Virus Scan and Common Characteristics Among 4 of Victimized Websites
Sitemap Hack, ANTIVIRUS-SCANNER.COM Invading At Least 10 Websites Including Arizona State University’s Site
ANTIVIRUS-SCANNER.COM and Troj/Dwnldr-HDG
Warning: A New Hack Scheme Discovered Involving Anti-Virus Scan Website
********** ********** ********** ********** ********** ********** ********** **********
MacHouse is not funded by tax payers' money. We have limited resources. We also need time to sleep and eat just as others. So we will not act as the International police to contact all victims of website abuse. All you have to do is to subscribe to spam messages and spam posts. If we can, why don't you?
Leave a Reply
You are prohibited from posting comments merely to advertise your website. Please read Rules and About This Blog at the top menu bar for more information.
Because of spam-comment criminals, we are forced to manually moderate every comment that you may post. Your comment will appear only after we review and then approve it. It will take us several hours at most to review it.
Please note that all one-sentence comments will be automatically rejected as an anti-spam measure.