SANS: Coolwebsearch / Trafficadvance got a new home...

Looks like our long time "friends" from the Coolwebsearch/Trafficadvance malware department have moved shop to a new hoster. If you've followed our earlier suggestions and zapped their old netblock (81.9.5.x), well, then you might want to consider banning their new sites as well.

They all seem reside under 85.249.23.x now, again in St.Petersburg, Russia. If you prefer to block their domains, here's a list. SANS - Internet Storm Center - Cooperative Cyber Threat Monitor And Alert System

Linked by shanmuga Thursday, 6th April 2006 7:37AM