The IP is currently blacklisted on SORBS. What a surprise...
suzi | Homepage | 10.24.07 - 1:36 pm | #

Seems like some of these other "reputable" security vendors really like commenting to your blog.
Christian | Homepage | 10.24.07 - 8:09 pm | #

Sure seems to be the case...
Alex Eckelberry | 10.24.07 - 10:34 pm | #

i got a couple of these a week or so ago but since i really didn't have any way to prove it was eeye i didn't bother doing anything about it...

obviously the most straight forward explanation is that eeye is behind it, but i recall back in the day when conventional email spammers were spamming symantec products and symantec were actually trying to get it shut down because it could hurt their reputation...

ultimately symantec made out ok, but eeye is a much smaller organization and as such may be more susceptible to a reputation attack...
kurt wismer | Homepage | 10.25.07 - 12:30 am | #

Kurt -- the link doesn't show an affiliate code, so I don't think it's some some affiliate. The link goes directly to eeye's site. I have asked eeye about this.
alex eckelberry | 10.25.07 - 10:06 am | #

yes, i noticed there was no affiliate code as well... that's why i mentioned a reputation *attack*...

sorry if the symantec reference confused the issue - it was just the earliest example i could think of where a 3rd party was pimping a vendor's wares in an undesirable manner for any reason... clearly in this case if it is a 3rd party and that party knows what they're doing then they aren't doing it for direct financial gain (indirect, perhaps)...

it could also be that eeye contracted out some marketing to a firm that isn't yet aware of what constitutes acceptable practices in this industry (i believe panda got burned by making a similar mistake not too long ago actually)...

hopefully eeye can provide you with a credible answer...
kurt wismer | Homepage | 10.25.07 - 12:14 pm | #

Gotcha...
alex eckelberry | 10.25.07 - 1:22 pm | #

I got some yesterday on my blogpost from Symantec (comment #6):
http://blog.didierstevens.com/20...c000k/ #comments

I confirmed the IP-address. And it's clear from their comment they didn't read my post, just wanted to plug their product.
Didier Stevens | Homepage | 10.30.07 - 9:03 am | #