Interesting Attack from an Anonymous Russian “Friend”, Ha Ha!

I hope everyone is fully aware by now about my opinions on anonymous commentary and spammers.  Er.. yes… they’re shit.  And what I do is fully explained in my site privacy policy, here.

Anyway, my Russian friend left a little note, which I’ll leave, here, because in itself, it’s pretty innocuous.  However, visitors to my site don’t see the whole picture.  Here’s the bits you missed, below.  I’ve deliberately not hyper-linked to anything.  Copy and paste at your own peril.  If you have an un-patched Windows machine on a network, you may have some interesting happenings…Tough shit in that case.

• Name:  anonymous
• Website: http://fufubitch.ru/
• Time of comment: 2008/10/24 at 1:44 PM
• Email address: email hidden; JavaScript is required this link is included to enable email bot harvesters!
• IP Address:  88.201.128.162

Now, the IP address is a part of a standard Russian Federation IP address block, Skynet.  The email address, probably dead or spoofed, I’m hardly likely to reply :-?  It’s a bit sad though that I’m now considering blocking all of Russia because of some twat gangster robber types.

Bizarrely, or by design, isn’t Skynet the fictional computer company that goes mad and takes over the world with machines in Terminator?   !!

The good bit happens if you enter the IP Address 88.201.128.162 into your browser address bar….It instantly redirects!

However, it redirects to http://10.12.14.5/cgi-bin/utm5/aaa5

This of course, is part of the block of addresses designated for the use of local networks.  There are three blocks, A,B & C.  I use C internally as do most home routers.

So what the page is trying to do is run locally some pre-installed code which it’s expecting to find in some sub-folders.  Of course, you have to ask yourself how such code could be installed on your local network or PC?  And that’s when I laughed, oh how I laughed and laughed.  I remember how I’ve had a bit of a spam spike recently (see screen dump).

Surely the two events are connected?  And if they are, it’s a good example of keeping on top of your updates and security.  Maybe it’s connected to the panicky windows alert yesterday?  This update is to do with something called a “Remote Procedue Call” which sounds like this twattish effort from my new Russian friend.  I’m not an expert;  I’m just commenting on the effects of actions I see and their probable causes.

Related posts:

1. Combatting WordPress Trackback Comment Spam Two WordPress trackback spams lead our hero to investigate their...
2. Email Spam Trojan Changes Slightly My recent post email-spam-trojans-hiding-on-websites-as-msnbc-breaking-news-items led with the effect and infection...
3. WordPress User Registration Spam I’ve had quite a few search enquiries and hits for...
4. Google Security to Crawling Chaos and Morals Google Security Spotlight: July Virus Attacks My last few posts...
5. Spoofed Emails Make Me Look Like Dodgy Software Saleman Less than a week ago, Virgin suffered an email outage...

Related posts brought to you by Yet Another Related Posts Plugin.