Beware How You Google

[shichiru]

---

Beware How You Google
By Ryan Naraine
April 27, 2005

Security researchers warn that a one-letter typo in Google's domain name could lead to a massive virus- and spyware-infection attack.

A simple misspelling of Google's domain name could lead to a Web surfer's worst nightmare.

In a new twist to the old practice of "typosquatting," virus writers have registered a slight variation of Google Inc.'s popular search-engine site to take advantage of any users who botch the spelling of the google.com URL.

The malicious site, www.googkle.com, is infested with Trojan droppers, downloaders, backdoors and spyware, and an unsuspecting user only has to visit the page to be at risk of computer hijack attacks, according to a warning from Finnish anti-virus vendor F-Secure Corp.

When googkle.com is opened in a browser, two pop-up windows are immediately launched with redirects to third-party sites loaded with scripts. One of the sites, ntsearch.com, downloads and runs a "pop.chm" file, and the other, toolbarpartner.com, downloads and runs a "ddfs.chm" file, F-Secure said.

"Both files are downloaded using exploits and they contain exploits themselves to run embedded executable files. One of the Web pages of the 'toolbarpartner.com' website downloads a file named 'pic10.jpg' using an exploit. This JPG file is actually an executable that replaces [the] Windows Media Player application," the warning reads.

Dare if you can...

[AMD_infinium05]

tried opening the site http://www.googkle.com while firewall (high) and Panda Internet Security (high security) is on... wla man notifications. the server is unavailable ra man.

[blank]

same here. I didn't see anything it just says "the site could not be found......."

[jobhim23]

mo infect pud ni mac bro? i guess dili.

[dropbox]

down mana nga site..cguro their spywares are running on their own systems :P

[grss1982]

tried opening the site http://www.googkle.com while firewall (high) and Panda Internet Security (high security) is on... wla man notifications. the server is unavailable ra man.

guys that report was pulished on the 27 of april, thats almost a month already. It is possible that google had the site shut down permanently. Just my $0.02 worth though.

[rvyne]

Your Target: http://googkle.com
ns1.google.com and ns2.google.com <--- sa google man iya server


NETCRAFT :
Site http://googkle.com Last reboot 0 days ago
Domain googkle.com Netblock owner Everyones Internet, Inc.
IP address unknown Site rank 260902
Country US Nameserver unknown
Date first seen February 2001 DNS admin unknown
Domain Registry unknown Reverse DNS unknown
Organisation unknown Nameserver Organisation
-----------------------------------------------------------------
Domain info:

domain: googkle.com
status: lock
owner: Sergey Gridasov
email: umsoft@yahoo.com
address: Salnevostochny pr., d46, kv410
city: St.-Petersburg
state: Spb
postal-code: 193230
country: RU
phone: +7 812 586-00-21
admin-c: umsoft@yahoo.com#1
tech-c: umsoft@yahoo.com#1
billing-c: umsoft@yahoo.com#3
nserver: ns2.google.com
nserver: ns1.google.com
created: 2000-12-30 09:29:18 UTC
modified: 2005-04-28 18:56:16 UTC
expires: 2005-12-30 09:29:18 UTC
source: joker.com live whois service
query-time: 0.059531
db-updated: 2005-05-25 10:04:52

Registry Status: REGISTRAR-LOCK

------------------------------------------------------------------------
while google.com


Registrant:
Google Inc. (DOM-258879)
2400 E. Bayshore Pkwy
Mountain View CA 94043
US

Domain Name: google.com

Registrar Name: Alldomains.com
Registrar Whois: whois.alldomains.com
Registrar Homepage: http://www.alldomains.com

Administrative Contact:
DNS Admin (NIC-1340142) Google Inc.
2400 E. Bayshore Pkwy
Mountain View CA 94043
US
dns-admin@google.com
+1.6503300100
Fax- +1.6506181499
Technical Contact, Zone Contact:
DNS Admin (NIC-1340144) Google Inc.
2400 E. Bayshore Pkwy
Mountain View CA 94043
US
dns-admin@google.com
+1.6503300100
Fax- +1.6506181499

Created on..............: 1997-Sep-15.
Expires on..............: 2011-Sep-14.
Record last updated on..: 2003-Apr-07 10:42:46.

Domain servers in listed order:

NS3.GOOGLE.COM
NS4.GOOGLE.COM
NS1.GOOGLE.COM
NS2.GOOGLE.COM

MarkMonitor.com - The Leader in Corporate Domain Management
----------------------------------------------------------


i think there would be no problem... same server...

[chitgoks]

grss1982 is right. since 's been a month old, google should have already taken action against that site since it does nothing but bring problems to the user.

[grss1982]

grss1982 is right. since 's been a month old, google should have already taken action against that site since it does nothing but bring problems to the user.

thanks for backing me up, bai.

[dark_humbz]

sigh.... sayang.................