The Websense® ThreatSeeker® network has uncovered a typosquat hive hosting hundreds of hosts targeting
well-known brands. This hive constantly moves around to evade detection. Numerous popular brands are being abused –
can you spot the difference between these scam URLs and the real ones?
Upon further analysis we discovered a connection between those hosts:
- Most of them are hosted on the same IP address, 208.73.210.128.
- They lead to scam survey websites and spam websites.
- They attempt to circumvent detection and lie low by periodically
shifting from serving threats to serving default parking pages without
threats.
…(read more)