<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Free Youtube Grabber Blog &#187; im-threats</title>
	<atom:link href="http://freeyoutubegrabber.com/blog/tag/im-threats/feed/" rel="self" type="application/rss+xml" />
	<link>http://freeyoutubegrabber.com/blog</link>
	<description></description>
	<lastBuildDate>Sat, 11 Feb 2012 19:03:48 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.2.1</generator>
		<item>
		<title>YouTube typo delivers IRC Bot</title>
		<link>http://freeyoutubegrabber.com/blog/youtube-typo-delivers-irc-bot/</link>
		<comments>http://freeyoutubegrabber.com/blog/youtube-typo-delivers-irc-bot/#comments</comments>
		<pubDate>Wed, 24 Jun 2009 23:22:50 +0000</pubDate>
		<dc:creator>firebeastm</dc:creator>
				<category><![CDATA[Uncategorized]]></category>
		<category><![CDATA[youtube]]></category>
		<category><![CDATA[analysis]]></category>
		<category><![CDATA[exploits]]></category>
		<category><![CDATA[fake-codecs]]></category>
		<category><![CDATA[im-threats]]></category>
		<category><![CDATA[internet]]></category>
		<category><![CDATA[jerome-segura]]></category>
		<category><![CDATA[mac-security]]></category>
		<category><![CDATA[phishing]]></category>
		<category><![CDATA[wireless]]></category>
		<category><![CDATA[words]]></category>

		<guid isPermaLink="false">http://freeyoutubegrabber.com/blog/youtube-typo-delivers-irc-bot/</guid>
		<description><![CDATA[Fresh from our HoneyPot we discovered a malware site using a typo in its domain name. The site youtorube.com will push a fake video codec, on what appears to be a YouTube page (in Italian). The domain is registered to: Pretty soon after running the fake codec, I observed IRC traffic with the same IP address: This lets me know that I am part of an IRC channel: The IRC server’s IP (87.98.184.231) has some interesting connections, including a “p0nwed.de” domain]]></description>
			<content:encoded><![CDATA[<p>Fresh from our HoneyPot we discovered a malware site using a typo in its domain name. The site youtorube.com will push a fake video codec, on what appears to be a YouTube page (in Italian). The domain is registered to: Pretty soon after running the fake codec, I observed IRC traffic with the same IP address: This lets me know that I am part of an IRC channel: The IRC server’s IP (87.98.184.231) has some interesting connections, including a “p0nwed.de” domain</p>
<p><img src="http://freeyoutubegrabber.com/blog/wp-content/uploads/2009/06/logo_sm73.gif" /></p>
<p>View original post here: <br />
<a target="_blank" href="http://blogs.paretologic.com/malwarediaries/index.php/2009/06/24/youtube-typo-delivers-irc-bot/" title="YouTube typo delivers IRC Bot">YouTube typo delivers IRC Bot</a></p>
]]></content:encoded>
			<wfw:commentRss>http://freeyoutubegrabber.com/blog/youtube-typo-delivers-irc-bot/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>

