nwrickert
sand groper
Premium,MVM
join:2004-09-04
Geneva, IL
 ·AT&T U-Verse
 ·AT&T Midwest
1 edit | reply to nwrickert
Rock phish report Jul 26, 2007
The Thursday report:
Domain registration info
Phish domain Registrar
buhank.info REGISTER.COM 7/25/2007 (cancelled)
buhank.ws unknown 7/25/2007 (suspended)
cordchi.cc eNom 7/24/2007 (suspended)
floher.biz GKG.NET 7/25/2007 (suspended)
kgs.kg www.domain.kg 7/19/2007
klinher.com REGISTER.COM 7/25/2007
kolobokid.hk HKDNR 7/24/2007 (suspended)
m1.kg www.domain.kg 7/19/2007 (suspended)
mulity.st ST Registry 7/26/2006
pachuser.hk HKDNR 7/24/2007 (suspended)
port.kg www.domain.kg 7/19/2007 (suspended)
stack.kg www.domain.kg 7/16/2006
toptenret.us unknown 7/??/2007
troniek.com REGISTER.COM 7/25/2007
tryret.biz REGISTER.COM 7/25/2007
DNS server domain Registrar
jumpmo.com REGISTER.COM 6/21/2007
mainvg.com REGISTER.COM 7/11/2007
nsduit.com REGISTER.COM 7/25/2007? (cancelled)
sertwer.com GKG.NET 7/25/2007 (suspended)
troniek.com REGISTER.COM 7/25/2007
--
AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.5 |
|
nwrickert
sand groper
Premium,MVM
join:2004-09-04
Geneva, IL
·AT&T U-Verse
·AT&T Midwest
| reply to nwrickert
Rock phish report Jul 25, 2007
The report for Wednesday:
Domain registration info
Phish domain Registrar
cordet.cc eNom 7/24/2007 (suspended)
hrugor.ws unknown 7/??/2007 (cancelled?)
tyhsa.us REGISTER.COM 7/25/2007
DNS server domain Registrar
cordchi.cc eNom 7/24/2007 (suspended)
laninform.com REGISTER.COM 7/25/2007
--
AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.4 |
|
nwrickert
sand groper
Premium,MVM
join:2004-09-04
Geneva, IL
·AT&T U-Verse
·AT&T Midwest
| reply to nwrickert
Rock phish report Jul 24, 2007
The Tuesday report:
Domain registration info
Phish domain Registrar
gfhdmode.hk HKDNR 7/18/2007 (suspended)
hobotid.hk HKDNR 7/24/2007
kgs.kg www.domain.kg 7/19/2007
lorii.hk HKDNR 7/23/2007 (suspended)
m1.kg www.domain.kg 7/19/2007 (suspended)
port.kg www.domain.kg 7/19/2007 (suspended)
DNS server domain Registrar
jumpmo.com REGISTER.COM 6/21/2007
mainvg.com REGISTER.COM 7/11/2007
mimoservice.hk HKDNR 7/06/2007 (suspended)
--
AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.4 |
|
nwrickert
sand groper
Premium,MVM
join:2004-09-04
Geneva, IL
·AT&T U-Verse
·AT&T Midwest
| reply to nwrickert
Rock phish report Jul 23, 2007
Here is the report for Monday:
Domain registration info
Phish domain Registrar
ab.kg www.domain.kg 7/19/2007
brolok.biz unknown 7/19/2007? (cancelled)
dlo.st ST Registry 7/17/2007
kgs.kg www.domain.kg 7/19/2007
kkl.kg www.domain.kg 7/17/2007
lhot.nu www.nunames.nu 7/23/2007
mimocorp.hk HKDNR 7/06/2007
mod.kg www.domain.kg 7/19/2007
olfor.hk HKDNR 7/23/2007
stack.kg www.domain.kg 7/16/2006
DNS server domain Registrar
bonterson.st ST Registry 7/??/2007 (suspended)
jumpmo.com REGISTER.COM 6/21/2007
mainvg.com REGISTER.COM 7/11/2007
mimoservice.hk HKDNR 7/06/2007
modernid.hk HKDNR 7/18/2007 (suspended)
--
AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.4 |
|
nwrickert
sand groper
Premium,MVM
join:2004-09-04
Geneva, IL
·AT&T U-Verse
·AT&T Midwest
| reply to nwrickert
Rock phish report Jul 22, 2007
It has been a week since we last saw a National City phish. It has been several days since we last saw SunTrust. NorthFork Bank is still being actively targetted. And there have been a couple aimed at eBay.
Here is the Sunday report:
Domain registration info
Phish domain Registrar
dlo.st ST Registry 7/17/2007
kkl.kg www.domain.kg 7/17/2007
stack.kg www.domain.kg 7/16/2006
DNS server domain Registrar
jumpmo.com REGISTER.COM 6/21/2007
--
AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.4 |
|
nwrickert
sand groper
Premium,MVM
join:2004-09-04
Geneva, IL
·AT&T U-Verse
·AT&T Midwest
| reply to nwrickert
Rock phish report Jul 21, 2007
The report for Saturday:
Domain registration info
Phish domain Registrar
mimosend.hk HKDNR 7/06/2007
morpas.st ST Registry 7/20/2007
DNS server domain Registrar
mimoservice.hk HKDNR 7/06/2007
--
AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.4 |
|
nwrickert
sand groper
Premium,MVM
join:2004-09-04
Geneva, IL
·AT&T U-Verse
·AT&T Midwest
| reply to nwrickert
Rock phish report Jul 20, 2007
Here is the report for Friday:
Domain registration info
Phish domain Registrar
cattyl.us REGISTER.COM 7/19/2007 (cancelled)
dlo.st ST Registry 7/17/2007
kkl.kg www.domain.kg 7/17/2007
roikevr.info REGISTER.COM 7/19/2007 (cancelled)
DNS server domain Registrar
baroner.com REGISTER.COM 7/19/2007 (cancelled)
hkxeop.com REGISTER.COM 7/19/2007 (cancelled)
jumpmo.com REGISTER.COM 6/21/2007
--
AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.4 |
|
nwrickert
sand groper
Premium,MVM
join:2004-09-04
Geneva, IL
·AT&T U-Verse
·AT&T Midwest
| reply to nwrickert
Rock phish report Jul 19, 2007
The Thursday report:
Domain registration info
Phish domain Registrar
dlo.st ST Registry 7/17/2007
kkl.kg www.domain.kg 7/17/2007
stack.kg www.domain.kg 7/16/2006
DNS server domain Registrar
jumpmo.com REGISTER.COM 6/21/2007
--
AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.4 |
|
nwrickert
sand groper
Premium,MVM
join:2004-09-04
Geneva, IL
·AT&T U-Verse
·AT&T Midwest
| reply to nwrickert
Rock phish report Jul 18, 2007
The report for Wednesday:
Domain registration info
Phish domain Registrar
dlo.st ST Registry 7/17/2007
fri.hk HKDNR 7/17/2007
kkl.kg www.domain.kg 7/17/2007
uqq.hk HKDNR 7/17/2007
utr.hk HKDNR 7/17/2007
DNS server domain Registrar
jumpmo.com REGISTER.COM 6/21/2007
mainvg.com REGISTER.COM 7/11/2007
--
AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.4 |
|
nwrickert
sand groper
Premium,MVM
join:2004-09-04
Geneva, IL
·AT&T U-Verse
·AT&T Midwest
| reply to nwrickert
Rock phish report Jul 17, 2007
The report for Tuesday:
Domain registration info
Phish domain Registrar
fri.hk HKDNR 7/17/2007
highpont.hk HKDNR 7/13/2007 (suspended)
kkl.kg www.domain.kg 7/17/2007
DNS server domain Registrar
ghbdtn.hk HKDNR 7/11/2007
jumpmo.com REGISTER.COM 6/21/2007
mainvg.com REGISTER.COM 7/11/2007
--
AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.4 |
|
nwrickert
sand groper
Premium,MVM
join:2004-09-04
Geneva, IL
·AT&T U-Verse
·AT&T Midwest
| reply to nwrickert
Rock phish report Jul 16, 2007
Here is the report for Monday:
Domain registration info
Phish domain Registrar
golcowd.biz REGISTER.COM 7/13/2007 (cancelled)
neparauser.hk HKDNR 7/13/2007
pell.cc REGISTER.COM 7/14/2007 (cancelled)
standyon.com REGISTER.COM 7/13/2007 (cancelled)
DNS server domain Registrar
ghbdtn.hk HKDNR 7/11/2007
webgooler.net REGISTER.COM 7/14/2007 (cancelled)
--
AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.4 |
|
nwrickert
sand groper
Premium,MVM
join:2004-09-04
Geneva, IL
·AT&T U-Verse
·AT&T Midwest
| reply to nwrickert
Rock phish report Jul 15, 2007
Another large collection, due to our contributors catching up on a backlog over a longer period of time.
At present the rockphishers appear to be actively targetting National City and SunTrust. They may be experimenting with Royal Bank of Scotland. They appear to have scaled back or discontinued their targetting of Regions Bank, North Fork Bank and perhaps Bank of the West.
Here is the report for today (Sunday):
Domain registration info
Phish domain Registrar
DNS server domain Registrar
--
AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.4 |
|
nwrickert
sand groper
Premium,MVM
join:2004-09-04
Geneva, IL
·AT&T U-Verse
·AT&T Midwest
| reply to nwrickert
Rock phish report Jul 14, 2007
The report for Saturday:
Domain registration info
Phish domain Registrar
--
AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.4 |
|
nwrickert
sand groper
Premium,MVM
join:2004-09-04
Geneva, IL
·AT&T U-Verse
·AT&T Midwest
| reply to nwrickert
Rock phish report Jul 13, 2007
A large collection of phish emails in today's report. They were submitted to phishtracker today, but they were received over a longer time period.
Here is the Friday report:
Domain registration info
Phish domain Registrar
DNS server domain Registrar
--
AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.4 |
|
nwrickert
sand groper
Premium,MVM
join:2004-09-04
Geneva, IL
·AT&T U-Verse
·AT&T Midwest
| reply to nwrickert
Rock phish report Jul 12, 2007
Here is the Thursday report:
Domain registration info
--
AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.4 |
|
nwrickert
sand groper
Premium,MVM
join:2004-09-04
Geneva, IL
·AT&T U-Verse
·AT&T Midwest
| reply to nwrickert
Rock phish report Jul 11, 2007
The report for Wednesday:
Domain registration info
--
AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.4 |
|
nwrickert
sand groper
Premium,MVM
join:2004-09-04
Geneva, IL
·AT&T U-Verse
·AT&T Midwest
| reply to nwrickert
Rock phish report Jul 10, 2007
The rock phish group seem to be testing SunTrust.
Here is the report for Tuesday:
Domain registration info
--
AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.4 |
|
nwrickert
sand groper
Premium,MVM
join:2004-09-04
Geneva, IL
·AT&T U-Verse
·AT&T Midwest
| reply to nwrickert
Rock phish report Jul 09, 2007
The Monday report:
Domain registration info
--
AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.4 |
|
nwrickert
sand groper
Premium,MVM
join:2004-09-04
Geneva, IL
·AT&T U-Verse
·AT&T Midwest
| reply to MGD
Re: Rock phish report Jul 08, 2007
They seem to be a bit selective. Presumably if a bank has strong procedures that make phishing difficult, they don't try. There were a couple of phish for Capital One bank (see the Jul 04 report). But then they stopped. I'm guessing that those didn't work out very well.
Yes, they seem to keep a few domains available that they can use if others are suspended. But it's hard to be sure, because our sample is not complete enough.
The firefox phish filter seems more effective against rockphish than is the IE7 filter. It seems that the firefox filter can block all urls in the domain. But probably not enough people are using these filters for them to have much effect.
--
AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.4 |
|
MGD
Premium,MVM
join:2002-07-31
Fort Lauderdale, FL
| reply to nwrickert
Well as you predicted they now have a full court press running on North Fork Bank »North Fork Bank, and Bank of the West has joined the growing list. I suspect it will not be long until they really target the smaller regional institutions.
Also appears that they are stashing domanins, several that first crop up two weeks or more after registration, and hitting Register.com heavy again.
MGD |
|
