Blog Spam / Phishing / Harvesting

  • Article

Many Blogs are receiving feedback with links to the following URL - DO NOT FOLLOW THIS LINK(that's why I've left off the https:// prefix) "cool12xp.s20.xrea.com".

Typical entries have the title of "Great article" with text along the following lines:

"Great Site! Keep it up!Great site,keep it up, thanks !Here is my site, you can found some resource at there"

The major search engines come up with hundreds of hits when searching for the URL. This looks more like time wasting to me rather than something malicious as upon first (very brief inspection) the site doesn't appear to execute hostile code though it is full of none ASCII characters.

Rumour has it that the site is malicious in that it harvests information from your blog and uses that to propogate SPAM to the email addresses of all those who posted feedback to your site.

I've searched the usual security sites and news sites and haven't found any articles or alerts on this. I'll spend more time checking it out and report back. If anyone out there knows more then please hit the "feedback" button and share!