Skip to main content

Spambot aims at targets WordPress sites in World Cup-Themed spam scam


Imperva observed a spambot targeting WordPress sites aimed at tricking victims into clicking on links to sites offering betting services on FIFA World Cup

Security experts from Imperva recently observed a spike in spam activity directed at WordPress websites, attackers aimed at tricking victims into clicking on links to sites offering betting services on the 2018 FIFA World Cup games.

Imperva monitored the activity of a botnet used to spread meaningless text messages generated from a template to comments sections in blogs, news articles, and other web sites that allow people to comment.

“Turns out the attack was launched by a botnet and implemented in the form of comment SPAM – meaningless, generic text generated from a template and posted in the comment sections of blogs, news articles etc; linking to pay-per-click commercial or suspicious sites looking to scam you or phish for your passwords.” reads the report published Imperva.

The spambot was used to post comments to the same Uniform Resource Identifier (URI) across different WordPress sites indiscriminately and without regard for whether the site is has a comments section or is affected by exploitable known issues.

The comments are generated starting from this template that is known since at least 2013. The template allows to automatically create slightly different versions of the same message to use in spam campaigns.

“Our analysis found that the top 10 links advertised by the botnet lead to World Cup betting sites. Interestingly, eight of the top advertised sites contained links to the same betting site, hinting that they might be connected in a way.”

World Cup betting sites 

“We found that the botnet advertised over 1000 unique URLs, most of them appear multiple times. In many cases, the botnet used different techniques such as URL redirection and URL-shortening services to mask the true destination of the advertised link.”
According to the experts, the spambot is still small, it is composed of just 1,200 unique IPs with up to 700 daily unique IPs. The experts discovered that botnet has also been using URL-shortening, URL redirection, and other techniques to masquerade the landing sites of advertised links in its spam messages.

In the weeks before the World Cup, the spambot was being used in remote code execution attacks and other non-SPAM attacks on WordPress sites

Spambot World Cup

Just after the beginning of the 2018 World Cup, the botnet activity was focused on comment spam, a circumstance that suggests the malicious infrastructure is available for hire.

“A possible explanation is that the botnet is for hire. The malicious activity we’ve seen at first was either paid for or simply the botnet’s attempt to grow itself. Then, it was hired by these betting sites to advertise them and increase their SEO.” continues the analysis.

Comment spam is a well-known activity in the threat landscape, the most common countermeasure it to blacklist IPs originating spams messages and also the URLs that they advertise.

WordPress also has several Plug-ins that cuold defeat this boring activity.

“Although comment SPAM has been with us for more than a decade — and doesn’t seem like it’s going away anytime soon — there are numerous solutions ranging from dedicated plugins that block comments that look SPAMmy, to WAF services.”



Comments

Post a Comment

Jarring comments...

Popular posts from this blog

Why Do We Scratch Our Heads When We're Thinking?

Some people believe that certain automatic gestures — like scratching our heads when we're thinking — are natural motions that were passed down to us from our caveman predecessors. JOSE LUIS PELAEZ INC./GETTY IMAGES If you've ever had the distinct pleasure of sourcing stock photos for any reason, you've likely come across a whole lot of laughing women eating salads alone . But you've also probably stumbled upon a truckload of people scratching their heads to symbolize confusion, deep thought and/or perhaps a bad case of seborrheic dermatitis — dandruff. Scalp dryness aside, how exactly did the head scratch come to symbolize intellectual processes? Some people believe that certain automatic gestures are simply natural, expressive motions our caveman predecessors passed down to us. "One popular explanation for any hand-to-head movements is that they're frustrated aggression — a reversion to the natural movements of our rock-throwing ancestors," wrote Sa...
Post a Comment
Read more

Jackie Robinson in Reverse, Eddie Klep Integrated Negro Leagues

WASHINGTON  President Bush presented the Congressional Gold Medal to the family of Jackie Robinson this week, in posthumous honor of the man who broke through major league baseball’s racial barrier in 1947. Unmentioned and unmourned was the late Eddie Klep, who crossed baseball’s color line a year earlier in the opposite direction. Klep was the first white man to play Negro League ball.    A short-lived pioneer, he washed out in his first season as a Cleveland Buckeye. A few years later he was wearing the uniform of the Rockview (Pa.) State Prison baseball team. In talent, character and impact, he was no Jackie Robinson. But Eddie Klep’s exploits, such as they were, serve as a reminder that integration is a two-way street. Beyond the brave tales of celebrated black breakthroughs, the path toward racial progress is also adorned with intriguing stories of white Americans willing to go where others feared to tread, everyday people distinguishing themselves with simpl...
Post a Comment
Read more

How Do You Evict Your Freeloading Friend?

Guest Trisha just told you she's not leaving your house. How can you get her OUT? It was supposed to be just a few weeks. That was the deal. Your college friend Trisha was blindsided by her husband filing for divorce and needed a place to crash until she could find her own apartment. She's always been a bit of a mess, but you couldn't turn your back on a friend in need, right? Now "a few weeks" has turned into eight months. In the beginning, she at least pretended to browse Craigslist for cheap sublets and part-time work, but now she doesn't do much of anything, unless binge-watching Netflix can be considered a full-time job. You finally work up the nerve to ask Trisha to leave. Your place is just too small and your boyfriend thinks she's a leech, eating all your food and never offering a dime for groceries, let alone rent. You break the news gently to Trisha; she has to be out by the end of the month. And then she breaks the news to you: Nope, she...
Post a Comment
Read more