Zscaler Blog

Get the latest Zscaler blog updates in your inbox

Security Research

Fake AV Moving From .co.cc To .cz.cc

September 23, 2010 - 1 min read

I've mentioned before that most of the fake AV sites were hosted on the sub-domain of co.cc which offers free DNS services.

It is certainly true that the domain is still hosting most of the fake AV sites, however, they are also doing a lot of cleanup. All the malicious sites we have reported to them have been removed within 24 hours. Many sites I've checked recently have been taken down.

Fake AV domain was taken down

While we're still seing new co.cc fake AV sites, we've seen an increase of such sites hosted on cz.cc. They offer free sub-domains, and free hosting as well.



Attackers take advantage of free hosting services

Attackers will keep changing providers to find a more hospitable home, a place where they are not shut down quickly. It took several months for co.cc registrars to first take actions against attackers abusing their service, certainly enough time to infect plenty of unaware users and we expect the same for cz.cc.

-- Julien



form submtited
Thank you for reading

Was this post useful?

dots pattern

Get the latest Zscaler blog updates in your inbox

By submitting the form, you are agreeing to our privacy policy.