Tuesday, 7 August 2012

"Your Photos" spam / pussyriotss.ru

There's not much to the recurring "Your Photos" spam apart from some terse text and a link. In this case the spam leads to a malicious payload at [donotclick]pussyriotss.ru:8080/forum/showthread.php?page=5fa58bce769e5c2c (report here).

pussyriotss.ru? Well, if you follow the news in Russia at all then you will have heard of the Pussy Riot case. The IP addresses for pussyriotss.ru are:

190.120.228.92 (Infolink, Panama)
116.12.49.68 (Usonyx , Singapore)

These IPs are also associated with spb-koalitia.ru and a whole bunch of other badness, blocking them would be prudent.

No comments: