[Dshield] Site suspect

John Hardin johnh at aproposretail.com
Thu Oct 23 22:04:12 GMT 2003

On Thu, 2003-10-23 at 11:55, john beck wrote:
> I have been alerted to a website that someone was going to book a room at 
> Hyatt Regency and they went to www.hyattregency.com and there it, will give 
> a popup that says you have the rpc virus and it wants you to click ok to 
> scan your machine, I am now blocking the site and have not begun to check 
> out what it is doing or planting but wanted to let everyone know, if anyone 
> checks this or has info on it, please post or send to me off list.

Javascript popup. It looks like somebody (zendmedia? vipfares?) cracked
their webserver or hijacked their DNS, as the web page definitely does
not look professional... (assuming the Big Name Hotel Chain does indeed
own this domain :)

< html>< head>
< title>Cheap airline tickets Discount Hotels and Car Rental Travel<
< /head>
< BODY onload="confirmGoto()">
 var exit=true;
 function confirmGoto() {
 if (exit) {
 if (confirm("W32 RPC Virus Warning !!!\n\n Your PC may be Infected     
\n\n        CLICK on OK\n    to Scan and Clean !")) {
} else {
< font color="#FCFCFC">
Airline tickets: cheap tickets, plane tickets, priceline ticket air.
< br>us travel discount travel and tourism, adventure travel agency
< br>las vegas hotel london paris new york orlando marriott discount
hotel hilton chicago new orleans hotels vancouver radisson vegas hotel
reservation sheraton san francisco san diego new york city reno expedia
travelocity hotwire orbitz
< H1>Cheap airlines tickets travel rent a car discount hotels and
tours.< /H1>
Lasminute lastminite lastminuet lastminuit lastminuite lastminut
lastminute lastminuteair lastminuteairfare, lastminuteairfares
lastminuteairlinetickets lastminuteairtickets lastminuteclub
lastminutecruise lastminutecruises lastminutedeals lastminutefare
lastminutefares lastminuteflights .
< br>
Lastminuteholidays lastminutehotels lastminutes lastminuteticket
lastminutetickets lastminutetour lastminutetravel lastminutetraveldeals
lastminutevacation lastminutevacations Lateescape Lateescapes Latescapes
lowestairfair, lowestairfare lowestairfares lowticket lowtickets
netcasino obitz obritz oebitz oorbitz orbbitz orbetz orbiitz orbirz
orbis orbit orbita orbitez orbitiz orbits orbitsz orbittravel orbittz
orbitx orbitzs orbitztravel orbitzz orbiyz orbiz orbizt orblitz orbot
orbotz orbtiz orbtz orbutz oribtz. oritz ornitz orrbitz ortbitz orvits
orvitz otbitz piceline pirceline prbitz prceline pricceline priceine
pricelane pricelie priceliine pricelime pricelin pricelinee priceliner
pricelines pricelinr pricelinre pricelinw pricelline.
< br>
Pricelne pricelone pricelune pricesline pricline pricrline pricwline
prideline priecline prieline priseline priveline prixeline prizeline
proceline pruceline rbitz riceline robitz sheaptickets tarvelocity
tavelcity tavelocity tavelosity teavelocity thelastminuteclub
traavelocity trabelocity tracelocity traelocity trasvelocity
travaelocity travalocity travalosity traveelocity travekocity
travel0city travelacity, travelasity TravelChoice travelecity
traveleocity travelicity traveliocity travelisity travellastminute
travellocity travellosity traveloc traveloccity travelocety traveloci
travelocidy travelociety, travelociity travelociry travelocite
travelociti travelocitie travelocities travelocitiy travelocitry
travelocitty travelocityy travelocoity travelocoty traveloctiy
travelocuty travelogic travelogity traveloicity traveloicty travelolcity
travelolocity traveloocity traveloscity.
< br>
Travelosite travelosity travelossity travelosty travelovity traveloxity
travelpcity travelsite travelsites travelsity. Travelwisconsin
traveolcity traverlocity traverocity travilocity travilosity
travlelocity travleocity travleosity travlocity travlosity travocity
travolocity travrlocity travvelocity travwlocity, treavelocity
trevelocity trqvelocity trravelocity trsvelocity trtavelocity
trvaelocity ttravelocity, wwwcheapfares wwwcheapflights wwwcheapticket
wwwcheaptickets wwwlastminute wwwlastminutetravel wwworbit wwworbits
wwworbitz wwwtravelosity.
< /body>
< /html>

John Hardin  KA7OHZ                           
Internal Systems Administrator                    voice: (425) 672-1304
Apropos Retail Management Systems, Inc.             fax: (425) 672-0192
  Failure to plan ahead on someone else's part does not constitute an
  emergency on my part.
                                  - David W. Barts in a.s.r
 3 days until Daylight Savings Time ends - Fall Back

More information about the list mailing list