Blog:
http://ddanchev.blogspot.com/2009/10/koobface-botnet-redirects-facebooks-ip.html
WEDNESDAY, OCTOBER 21, 2009
“Koobface Botnet Redirects Facebook’s IP Space to my Blog”
(Posted by Dancho Danchev at Wednesday, October 21, 2009)
SNIPPET: “The result? Earlier this morning, I’ve noticed over 7,000 unique visits coming from Facebook Inc’s IP space using active and automatically blogspot accounts part of the Koobface botnet as http referrers (New Koobface campaign spoofs Adobe’s Flash updater), which is now officially relying on already infected hosts for the CAPTCHA recognition process.”
SNIPPET: “A representative from Facebook’s Security Incident Response Team just confirmed the development, and commented...”
Blog:
http://ddanchev.blogspot.com/2009/11/koobface-botnets-scareware-business.html
WEDNESDAY, NOVEMBER 11, 2009
“Koobface Botnet’s Scareware Business Model - Part Two”
(Posted by Dancho Danchev at Wednesday, November 11, 2009)
SNIPPET: “UPDATED - Tuesday, November 17, 2009: Koobface is resuming scareware (Inst_312s2.exe) operations at 91.212.107.103 which was taken offline for a short period of time. ISP has been notified again, action should be taken shortly. The current domain portfolio including new ones parked there:”