WebFusion “nosferatu” SEO/FakeAV Campaign
ID: d920f0ec-4bfc-598d-9716-d7fa42bdaac6
STIX ID: report--d920f0ec-4bfc-598d-9716-d7fa42bdaac6
Feed Name: Zscaler Security Research Blog
Threat Score
**SEO poisoning "nosferatu" campaign:** Compromised sites (≈300 on IP 81.21.75.87) hosted SEO spam pages generated by lndex.php/template.tpl and stored in .xcache; a C2 (dirtysexgallery.com → 213.174.131.136) supplies redirect targets written to data.dat which point to FakeAV affiliate landing pages using id `06abQDY3` for monetization.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.