{"id":18502,"date":"2021-01-29T19:13:10","date_gmt":"2021-01-29T18:13:10","guid":{"rendered":"http:\/\/159.69.82.204\/win\/?p=18502"},"modified":"2022-11-04T11:50:07","modified_gmt":"2022-11-04T10:50:07","slug":"domain-perl-com-gestohlen-ip-wird-fr-malware-kampagnen-genutzt","status":"publish","type":"post","link":"https:\/\/borncity.com\/win\/2021\/01\/29\/domain-perl-com-gestohlen-ip-wird-fr-malware-kampagnen-genutzt\/","title":{"rendered":"Domain Perl[.]com stolen, IP points to a site used for malware campagins"},"content":{"rendered":"

[German<\/a>]Warning to users who are interested in the Perl programming language and have previously accessed the Perl[.]com domain. The domain has been stolen and the IP has been redirected to an address associated with malware campaigns. <\/p>\n

<\/p>\n

\"\"The domain perl[.]com belongs to the Perl Foundation and has been used to publish news and articles about the Perl programming language since 1997. Now the domain has been hijacked. On reddit there is this thread<\/a> where the whole thing is addressed. The domain perl[.]com (without HTTPS) indicates that it is for sale and there would be advertisements. The whois record of January 27, 2021 indicates an unfriendly takeover.  <\/p>\n

\"Reddit.com<\/a><\/p>\n

Here's a screenshot of the sales message in question that someone posted on Twitter<\/a>.<\/p>\n

\"Perl.com<\/a><\/p>\n

A short time later, the unfriendly takeover of the domain perl[.]com by brian d foy was confirmed on Twitte<\/a>. It seems to have hit more domains according to a follow up tweet. <\/p>\n

<\/a><\/p>\n

The colleagues at Bleeping Computer also point out the issue in this tweet<\/a> and have summarized the state of affairs in this article<\/a>. <\/p>\n

\"Perl<\/a><\/p>\n

The log files<\/a> says, that the domain had been hijacked and the recovery process may be ongoing. Here is the excerpt:<\/p>\n

\n

Wednesday, January 27, 2021<\/h4>\n

<\/a> <\/p>\n

perl.com hijacked<\/h5>\n

The perl.com domain was hijacked this morning, and is currently pointing to a parking site.  Work is ongoing to attempt to recover it. <\/p>\n

We encourage you NOT to visit the domain, as there are some signals that it may be related to sites that have distributed malware in the past. <\/p>\n

  Some users may have it selected as their CPAN mirror.  To update your mirror in CPAN.pm use o conf urllist http:\/\/www.cpan.org\/ <\/p>\n

\n

# perl -MCPAN -eshell
cpan shell — CPAN exploration and modules installation (v2.20)
Enter 'h' for help. <\/p>\n

cpan[1]> o conf urllist http:\/\/www.cpan.org\/
Please use 'o conf commit' to make the config permanent!
cpan[2]> o conf commit
commit: wrote '\/root\/.cpan\/CPAN\/MyConfig.pm'<\/p>\n<\/blockquote>\n

Update 2021-01-28: <\/p>\n

  Work is underway to attempt to recover the domain.  If you're looking for the content, you can visit perldotcom.perl.org<\/a>.<\/p>\n<\/blockquote>\n

Bleeping Computer has collected the information<\/a>, that the domain has been hijacked and is under the attacker's control. The IP address points to a page that was used for malware campaigns. Anyway, the recovery may take some time. The Perl Foundation has set up a replacement site at perldotcom.perl.org<\/a>, where content can be retrieved.  <\/p>\n","protected":false},"excerpt":{"rendered":"

[German]Warning to users who are interested in the Perl programming language and have previously accessed the Perl[.]com domain. The domain has been stolen and the IP has been redirected to an address associated with malware campaigns.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[580],"tags":[69],"class_list":["post-18502","post","type-post","status-publish","format-standard","hentry","category-security","tag-security"],"_links":{"self":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/18502","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/comments?post=18502"}],"version-history":[{"count":0,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/18502\/revisions"}],"wp:attachment":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/media?parent=18502"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/categories?post=18502"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/tags?post=18502"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}