AI and Emerging Technologies of eDiscovery Days Past, Present and Future

You don’t have to be visited by multiple spirits on Christmas Eve to know the technologies of eDiscovery Days past, present and future have changed and continue to do so at an increasingly rapid pace. In the spirit of eDiscovery Day (see what we did there), TCDI’s Caragh Landry and David York will reflect on […]

The post AI and Emerging Technologies of eDiscovery Days Past, Present and Future appeared first on TCDI.

December 7, 2023
Read More >>

It’s not cricket! Sri Lanka and Bangladesh co-host phishing attack

Sri Lanka and Bangladesh have a successful history of co-hosting the Cricket World Cup, but today the two countries’ governments have found themselves on a sticky wicket by co-hosting a phishing attack that targets UK banking customers.

Victims lured to a certain page on the Lanka Government Network website at lgn2.gov.lk will be swiftly redirected to a phishing site hosted by the Rajshahi Metropolitan Police in Bangladesh (rmp.gov.bd).

The phishing site hosted on a Bangladesh Police website.

It is unlikely that either government is consciously hosting a phishing attack in unison like this, especially on a website belonging to a police force – although this should certainly make the crime easier to investigate.

Many phishing sites and other web-based types of cybercrime are hosted on compromised servers, and that looks likely to be the case in this instance. Last month, the homepage of lgn2.gov.lk was defaced by a group identifying itself as Cyb3r Drag0nz, indicating that they had gained unauthorised access to the web server.

Things seem to have spiralled out of control ever since. The Lanka Government Network website is now heavily compromised and currently hosts multiple web shells in addition to being involved in this phishing attack.

The PHP web shells hosted on lgn2.gov.lk include variants of the mini shell, including 1337 3YP455 and CasperSecurity. These allow files to be uploaded to the web server, which may have been how the phishing content – and other web shells – have been placed on the site.

Other web shells found on the Lanka Government Network site include variants of the WSO web shell (such as YANZ bypass and V3n0m), which let attackers run arbitrary commands on the web server, manage files, and carry out attacks against other servers.

The LGN website promotes a secure government network for Sri

December 7, 2023
Read More >>

Enhancing Patient Outcomes Through Secure, High-Performance Networks: Insights from Healthcare Experts

A new Ponemon report showed the average total cost for the most expensive healthcare cyberattack experienced was $4.4 million, including $1.1 million in lost productivity. As healthcare executives look to protect…

The post Enhancing Patient Outcomes Through Secure, High-Performance Networks: Insights from Healthcare Experts appeared first on Connected.

December 6, 2023
Read More >>

.zip TLD: six months on, and still rollin’

It has been six months since Netcraft first reported on abuse of the new .zip TLD, outlining the fraudulent activity we detected and blocked. Within weeks of its launch, Netcraft had detected many fresh .zip domain registrations designed to exploit confusion between the new TLD and the .zip file extension for ZIP archives.

So, what has changed in the last 6 months? Not much, it seems.

.zip registrations

The rate of new .zip domains registrations has declined since our previous blog post. Despite this, there are now:

  • 16,705 registered .zip domains (a threefold increase since our previous post) 
  • 8,432 .zip domains with A records in total (a fourfold increase) 
  • 4,421 .zip domains with MX records in total, only 619 of which don’t also have A records 
  • 4,196 distinct IP addresses for .zip domains in total (a fivefold increase)
  • 417 .zip domain names that mention ‘installer’ or ‘update’ (a twofold increase) 

Out of these domains, we discovered 5 serving zip bombs. In addition, the larger number of distinct IP addresses (1 for every 4 domains now, compared to 1 for every 6 domains six months ago) suggests that .zip domains are becoming more diverse.

Malicious websites

Netcraft has blocked 50 malicious .zip domains since the previous post on 17 May 2023, bringing the total to 56. These domains mostly impersonate Microsoft, Google, and Steam, as the following figure illustrates:

Other notable attacks include:

  1. Apecoin[.]zip, first seen on 9th August 2023, is a crypto drainer scam impersonating a cryptocurrency platform. It purports to add cryptocurrency to a user’s wallet, but when authorisation is given instead transfers all their assets (cryptocurrency, NFTs, etc) to the criminals operating the site. This same technique is being used by criminals exploiting people’s generosity around the Gaza conflict.

  2. Sledgehammer[.]zip, first seen

November 29, 2023
Read More >>

November 2023 Web Server Survey

In the November 2023 survey we received responses from 1,092,141,942 sites across 269,029,841 domains and 12,483,638 web-facing computers. This reflects a loss of 1.2 million sites, a gain of 1.1 million domains, and a gain of 112,102 web-facing computers.

OpenResty saw the largest gain of 2.4 million sites this month. This gave it a slight increase in market share from 8.14% to 8.37% (+0.23pp). Its market share has remained stable between 7.7% and 8.7% since February 2022.

Meanwhile, nginx suffered the largest loss of 4.5 million sites this month, meaning it now accounts for 22.83% of the market. This continues the decline observed in recent years, with its market share now down 13.71pp since July 2021.

Hosting providers

This month also saw the full effects of Squarespace’s acquisition of Google Domains, which closed on 7th September 2023 after the acquisition was first announced in June 2023. Over 25 million sites, primarily parked domains, moved from Google to Amazon this month – a 20% increase in the number of sites hosted by Amazon.

We also observed sites switching away from DediPath, which abruptly announced its closure on 31st August 2023. Following on from a smaller decline of 10% last month, there was a further exodus this month, with 85% of the remaining 5,403 sites leaving the hosting provider: 34% of these sites switched to Tencent, and 43% were shut down altogether. DediPath’s computer count decreased a further 61%, leaving the company with just 628 web-facing computers. DediPath continues to urge its customers to back up their data and migrate away as soon as possible.

Total number of websites
Web server market share
Developer October 2023 Percent November 2023 Percent Change
nginx 253,876,735 23.22% 249,368,944 22.83% -0.39
Apache 249,833,078 22.85% 248,343,154 22.74% -0.11
Cloudflare 116,314,628 10.64% 115,937,937 10.62% -0.02
OpenResty 88,981,001 8.14% 91,405,835 8.37% 0.23

Web server market share for active sites
Developer October 2023

November 24, 2023
Read More >>