Spam Alert
 
 Full Report: /Geocities_redirect_spam195918.html
 
 Yahoo! Geocities redirection abuse, see http://www.spamtrackers.eu/wiki/index.php?title=Geocities
Obfuscated Java Script has a recognizable pattern
var lrhiu='fnhoocgqomibkrytvjad';var rrrpeo=0;var btvwbqe, bjevajh, rtpcqrv='5A1D0B1D06131351030C07051E131E114B482B05100F3B0C1D0A17054D531E0B05161603581E0E144802070C0E170E1E014301100E145949564D0910121E5240400008101B140C114511161951515D4B150D1A061F1759';bjevajh='';var oomv;for( btvwbqe=0;btvwbqe < rtpcqrv.length;btvwbqe+=2){oomv = unescape( '%' + rtpcqrv.substr( btvwbqe,2));bjevajh += String.fromCharCode( oomv.charCodeAt(0) ^ lrhiu.charCodeAt(rrrpeo++) );if ( rrrpeo >= lrhiu.length ) rrrpeo = 0;}document.write(bjevajh);
This decodes to
<script language="JavaScript">window.top.location.href = 'http://coatyes.com';</script>

ACTION YAHOO! / GEOCITIES
Scan every Geocities page, matching on the obfuscated redirection code pattern, Remove every one that matches, continuing until the abuse ceases.Criminal Evidence
See the Spam Wiki entry at http://www.spamtrackers.eu/wiki/index.php?title=Canadian_Pharmacy
or from China: http://www.spamtrackers.hk/wiki/index.php?title=Canadian_Pharmacy
See the McAfee Site Advisor information at http://siteadvisor.com/sites/coatyes.com


> Registrar: HICHINA WEB SOLUTIONS (HONG KONG) LIMITED
REGISTRATION OF THE WEB SITE: coatyes.com
ACTION: To suspend this criminal site which breaks your terms of service, set the domain status to clientHold


> BEIJING INNOVATIVE LINKAGE TECHNOLOGY LTD. DBA DNS.COM.CN
REGISTRATION OF THE NAME SERVERS
These name servers are registered by criminals to resolve only illegal web sites. This breaks your terms of service. You can safely suspend them:
NS1.JUSTLIKETODAY.COM NS2.JUSTLIKETODAY.COM NS3.JUSTLIKETODAY.COM NS4.JUSTLIKETODAY.COM

ACTION: To suspend these name servers successfully, follow these steps.
1. set the ns Address records to a non-routable address, such as 127.0.0.1 or 61.61.61.61.
2. Set the domain status to clientUpdateProhibited, clientTransferProhibited, clientDeleteProhibited, and clientHold

> ISTANBUL-TELEKOM noc@istanbultelecom.net
IP ADDRESS OF HOST: coatyes.com has address 79.135.167.69
The IP address of this criminal site is within your allocated address space.
ACTION: Black-hole the route to this address to prevent further criminal activityChanged status to confirmed spam.

All times are GMT