Tag Info

New answers tagged

2

In addition to the existing answers, I'd like to add: it provides an attack vector. Host flagrantly malicious content at www.evilstuff.com Add to my domain records the IP addresses for: cnn.com IP addresses microsoft.com IP addresses stackexchange.com IP addresses Wait for Google to detect said content on my server and decide to blacklist the domain ...


1

Possibly because once the malware site is booted off its ISP or hosting company, the IP gets recycled to some other perfectly legitimate organisation. The domain name was clearly controlled by the malware owners, whilst the IP is owned by the ISP.


0

Many times (smaller) websites are run on shared servers which uses the same IP address but distinguish by path/URI instead - also, IP addresses change, it's not hard to re-direct what IP address a particular domain name points to, it's just a DNS update away.


1

I don't think they spoofed the domain name. I would say they either compromised the server or found some sort of HTML injection vulnerability that allowed them to just drop in the HTML that they wanted onto a "legitimate" myspace page that existed on their domain.


2

According to the article a user created a user named "login_home_index_html" then they used HTML and CSS to hide stuff on their profile page and make it look like it was the legitimate login page. From what it looks like is MySpace didn't sanitize its user's custom HTML properly.



Top 50 recent answers are included