Google != Googkle

FYI…

- http://isc.sans.org/diary.php?date=2005-04-26
Updated April 26th 2005 21:02 UTC
"…A malicious site that has registered a domain that might be entered as a typo for google.com. DO NOT VISIT THIS SITE! Visiting this site installs about 49 pieces of spyware, uses the local hosts file to block access to popular anti-virus websites, and offers a link to a website that sells AV and anti-spyware tools with the slogan "We help people"… No comment…
Administrators might want to do a quick check on their DNS cache records to see if any users have resolved anything matching "googkle" lately, and then have field support visit the (likely) infested workstations."

FYI…

- http://isc.sans.org/diary.php?date=2005-04-26
Update 2005-04-27 @ 10:21 UTC
Several readers have written in to add that there are several other sites similar to the Googkle site including:

msnm(dot)com, gfoogle(dot)com, ghoogle(dot)com, googfle(dot)com, luycos(dot)com, msn1(dot)com, passpport(dot)com and xcnn(dot)com.

Did I mention that you should NOT visit these sites?
More information on googkle is available at http://www.f-secure.com/v-descs/googkle.shtml …"

FYI…

Googkle is no more
- http://isc.sans.org/diary.php?date=2005-04-30
Updated May 1st 2005 07:29 UTC
"…Yesterday, the DNS hoster (joker.com in Switzerland) has finally taken action and has suspended DNS services for all the malware zones (ghoogle, googkle, etc). Good news for a change."