Want pr0n? Try .gov domains in general, ones that have been getting the attention of blackhat SEO-ers for a while, just like the most recent related cases where the City of Chetek, Winsonsin, the City of Somerset, Texas and Town of Norwood, Massachusetts got their blackhat SEO injection. The previous attack is related to the one I’ll assess in this post, the blackhat SEO tool is the same given the static subdomains generated, what remains to be answered is how they’ve managed to get access to the control panels of the domains in order to add the subdomains? Let’s look at the facts :
– the targets in this attack are The Virgin Islands Housing Finance Authority (VIHFA), and the City Of Selma, Alabama
– this is the second blackhat SEO operation uncovered during the past couple of months targeting .gov domains
– access to the control panels is somehow obtained so that subdomains pointing to 89.28.13.207 (89-28-13-207.starnet.md) and 89.28.13.195 (89-28-13-195.starnet.md) are added at both domains
– both .gov domains that are targets in this attack are using a shared hosting provider, meaning their IP reputation is in the hands of everyone else’s web activities responding under the same IP
– no malware is served in this incident, compared to the previous one, a combination of malware and blackhat SEO
Subdomains at City of Selma currently hosting around 9000 blackhat SEO pages :
m21.selma-al.govm22.selma-al.gov
m23.selma-al.gov
m24.selma-al.gov
m25.selma-al.gov
m26.selma-al.gov
m27.selma-al.gov
m28.selma-al.gov
m29.selma-al.gov
m30.selma-al.gov
m31.selma-al.gov
m32.selma-al.gov
m33.selma-al.gov
m34.selma-al.gov
Subdomains at the Virgin Islands Housing Finance Authority with constantly changing structure :
a1.a.vihfa.gova2.a.vihfa.gov
a3.a.vihfa.gov
a4.a.vihfa.gov
a5.a.vihfa.gov
a6.a.vihfa.gov
a7.a.vihfa.gov
a8.a.vihfa.gov
a9.a.vihfa.gov
a10.a.vihfa.gov
Related subdomains now no longer responding :
2k110.x.vihfa.gov
2k106.x.vihfa.gov
j11.y.vihfa.gov
j9.y.vihfa.gov
z1.z.vihfa.gov
z1.z.vihfa.gov
Where’s the connection between this blackhat SEO operation and the previous one? It’s not just that both subdomains at the different .gov’s are responding to IPs from the same netblock, but also, 89.28.13.202 is responding to City of Somerset’s subdomains from the previous incident such as : j6.y.somersettx.gov; st9.x.somersettx.gov; x.somersettx.gov.
Looks like someone in Moldova will get spanked for these incidents.
