s0tet
join:2005-06-08
1 edit | reply to nwrickert
Re: Rock phish report Jun 29, 2007
Yea, I think most people who post on this forum understand and would support Spamhaus overall. It is the people who posted to those nic.AT stories that astound me (as I said many posted AGAINST Spamhaus.)
Anyway, a couple of newer nic.at rockphish domains
ksioes.at 20070628
kioes.at 20070628
.hk domains are used for pill spam and malware downloads, so probably a number of spamgangs purchase .hk domains, still. I thought purchasing .hk domains fraudulently had let up some, but I was definitely wrong there to make that assumption. |
|
nwrickert
sand groper
Premium,MVM
join:2004-09-04
Geneva, IL
 ·AT&T U-Verse
 ·AT&T Midwest
| reply to nwrickert
Rock phish report Jun 30, 2007
The report for Saturday:
Domain registration info
--
AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.4 |
|
nwrickert
sand groper
Premium,MVM
join:2004-09-04
Geneva, IL
·AT&T U-Verse
·AT&T Midwest
| reply to nwrickert
Rock phish report Jul 01, 2007
The Sunday report:
Domain registration info
--
AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.4 |
|
nwrickert
sand groper
Premium,MVM
join:2004-09-04
Geneva, IL
·AT&T U-Verse
·AT&T Midwest
| reply to nwrickert
Rock phish report Jul 02, 2007
The report for Monday:
Domain registration info
--
AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.4 |
|
nwrickert
sand groper
Premium,MVM
join:2004-09-04
Geneva, IL
·AT&T U-Verse
·AT&T Midwest
1 edit | reply to nwrickert
Rock phish report Jul 03, 2007
The Tuesday report:
Domain registration info
(edit to fix subtitle)
--
AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.4 |
|
nwrickert
sand groper
Premium,MVM
join:2004-09-04
Geneva, IL
·AT&T U-Verse
·AT&T Midwest
| reply to nwrickert
Rock phish report Jul 04, 2007
The report for Wednesday:
Domain registration info
--
AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.4 |
|
nwrickert
sand groper
Premium,MVM
join:2004-09-04
Geneva, IL
·AT&T U-Verse
·AT&T Midwest
| reply to nwrickert
Rock phish report Jul 05, 2007
The Thursday report:
Domain registration info
--
AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.4 |
|
nwrickert
sand groper
Premium,MVM
join:2004-09-04
Geneva, IL
·AT&T U-Verse
·AT&T Midwest
| reply to nwrickert
Rock phish report Jul 06, 2007
The report for Friday:
Domain registration info
--
AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.4 |
|
nwrickert
sand groper
Premium,MVM
join:2004-09-04
Geneva, IL
·AT&T U-Verse
·AT&T Midwest
| reply to nwrickert
Rock phish report Jul 07, 2007
Report for Saturday:
Domain registration info
--
AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.4 |
|
nwrickert
sand groper
Premium,MVM
join:2004-09-04
Geneva, IL
·AT&T U-Verse
·AT&T Midwest
1 edit | reply to nwrickert
Rock phish report Jul 08, 2007
The Sunday report:
Domain registration info
--
AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.4 |
|
MGD
Premium,MVM
join:2002-07-31
Fort Lauderdale, FL
| Well as you predicted they now have a full court press running on North Fork Bank »North Fork Bank, and Bank of the West has joined the growing list. I suspect it will not be long until they really target the smaller regional institutions.
Also appears that they are stashing domanins, several that first crop up two weeks or more after registration, and hitting Register.com heavy again.
MGD |
|
nwrickert
sand groper
Premium,MVM
join:2004-09-04
Geneva, IL
·AT&T U-Verse
·AT&T Midwest
| They seem to be a bit selective. Presumably if a bank has strong procedures that make phishing difficult, they don't try. There were a couple of phish for Capital One bank (see the Jul 04 report). But then they stopped. I'm guessing that those didn't work out very well.
Yes, they seem to keep a few domains available that they can use if others are suspended. But it's hard to be sure, because our sample is not complete enough.
The firefox phish filter seems more effective against rockphish than is the IE7 filter. It seems that the firefox filter can block all urls in the domain. But probably not enough people are using these filters for them to have much effect.
--
AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.4 |
|
nwrickert
sand groper
Premium,MVM
join:2004-09-04
Geneva, IL
·AT&T U-Verse
·AT&T Midwest
| reply to nwrickert
Rock phish report Jul 09, 2007
The Monday report:
Domain registration info
--
AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.4 |
|
nwrickert
sand groper
Premium,MVM
join:2004-09-04
Geneva, IL
·AT&T U-Verse
·AT&T Midwest
| reply to nwrickert
Rock phish report Jul 10, 2007
The rock phish group seem to be testing SunTrust.
Here is the report for Tuesday:
Domain registration info
--
AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.4 |
|
nwrickert
sand groper
Premium,MVM
join:2004-09-04
Geneva, IL
·AT&T U-Verse
·AT&T Midwest
| reply to nwrickert
Rock phish report Jul 11, 2007
The report for Wednesday:
Domain registration info
--
AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.4 |
|
nwrickert
sand groper
Premium,MVM
join:2004-09-04
Geneva, IL
·AT&T U-Verse
·AT&T Midwest
| reply to nwrickert
Rock phish report Jul 12, 2007
Here is the Thursday report:
Domain registration info
--
AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.4 |
|
nwrickert
sand groper
Premium,MVM
join:2004-09-04
Geneva, IL
·AT&T U-Verse
·AT&T Midwest
| reply to nwrickert
Rock phish report Jul 13, 2007
A large collection of phish emails in today's report. They were submitted to phishtracker today, but they were received over a longer time period.
Here is the Friday report:
Domain registration info
Phish domain Registrar
DNS server domain Registrar
--
AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.4 |
|
nwrickert
sand groper
Premium,MVM
join:2004-09-04
Geneva, IL
·AT&T U-Verse
·AT&T Midwest
| reply to nwrickert
Rock phish report Jul 14, 2007
The report for Saturday:
Domain registration info
Phish domain Registrar
--
AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.4 |
|
nwrickert
sand groper
Premium,MVM
join:2004-09-04
Geneva, IL
·AT&T U-Verse
·AT&T Midwest
| reply to nwrickert
Rock phish report Jul 15, 2007
Another large collection, due to our contributors catching up on a backlog over a longer period of time.
At present the rockphishers appear to be actively targetting National City and SunTrust. They may be experimenting with Royal Bank of Scotland. They appear to have scaled back or discontinued their targetting of Regions Bank, North Fork Bank and perhaps Bank of the West.
Here is the report for today (Sunday):
Domain registration info
Phish domain Registrar
DNS server domain Registrar
--
AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.4 |
|
nwrickert
sand groper
Premium,MVM
join:2004-09-04
Geneva, IL
·AT&T U-Verse
·AT&T Midwest
| reply to nwrickert
Rock phish report Jul 16, 2007
Here is the report for Monday:
Domain registration info
Phish domain Registrar
golcowd.biz REGISTER.COM 7/13/2007 (cancelled)
neparauser.hk HKDNR 7/13/2007
pell.cc REGISTER.COM 7/14/2007 (cancelled)
standyon.com REGISTER.COM 7/13/2007 (cancelled)
DNS server domain Registrar
ghbdtn.hk HKDNR 7/11/2007
webgooler.net REGISTER.COM 7/14/2007 (cancelled)
--
AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.4 |
|
