Rock phish report Sep 13, 2007

Author	All Replies
nwrickert sand groper Premium,MVM join:2004-09-04 Geneva, IL kudos:7 Reviews: ·AT&T U-Verse	reply to nwrickert Rock phish report Sep 13, 2007 Here is the report for Thursday: 17300 60.12.130.112 moneymanagergps-id34525235.citizensbank.com.po5p1209.cn 17319 74.13.159.227(10) bancorpsouthonline.inview.77810295-login.corporate.challenge709.com 17321 64.131.251.173(5) moneymanagergps-id626856504.citizensbank.com.tech.kg 17322 74.13.159.227(10) bancorpsouthonline.inview.97775598-login.corporate.challenge739.com 17331 62.43.141.71(5) moneymanagergps-id072109853.citizensbank.com.md.kg 17332 60.12.130.112 moneymanagergps-id3007178463.citizensbank.com.dj4poison.cn 17333 62.43.141.71(5) moneymanagergps-id826897573.citizensbank.com.techs.ec 17334 74.13.159.227(10) moneymanagergps-id17823492.citizensbank.com.miho98.com 17335 62.43.141.71(5) moneymanagergps-id1943365.citizensbank.com.rt.kg 17336 62.43.141.71(5) moneymanagergps-id13432216.citizensbank.com.tech.kg 17737 62.43.141.71(5) moneymanagergps-id93330102.citizensbank.com.tech.kg 17339 60.12.130.112 moneymanagergps-id0376987.citizensbank.com.g0t1109.zj.cn 17340 NXDOMAIN bancorpsouthonline.inview.04121519-login.corporate.passmark278.com 17341 NXDOMAIN bancorpsouthonline.inview.23556185-login.corporate.challenge932.com 17343 NXDOMAIN bancorpsouthonline.inview.77969731-login.corporate.filed320.com 17344 temp_dns_fail moneymanagergps-id41099154.citizensbank.com.gps428.com 17345 NXDOMAIN bancorpsouthonline.inview.83048244-login.corporate.passmark777.com 17350 60.12.130.112 moneymanagergps-id695018590.citizensbank.com.norufild6.xj.cn 17356 62.43.141.71(5) moneymanagergps-id92411.citizensbank.com.techs.ec 17357 69.55.249.54(10) moneymanagergps-id04703527.citizensbank.com.pasw21.com 17358 62.43.141.71(5) moneymanagergps-id4007701.citizensbank.com.tech.kg 17359 60.12.130.112 moneymanagergps-id147497.citizensbank.com.member45.cn 17360 69.55.249.54(10) moneymanagergps-id00933257.citizensbank.com.onln37.com 17362 24.122.237.105(5) moneymanagergps-id17609.citizensbank.com.md.kg 17364 24.137.71.198(10) moneymanagergps-id77008978.citizensbank.com.passw9.com Domain registration info Phish domain Registrar challenge709.com REGISTER.COM 9/11/2007 challenge739.com REGISTER.COM 9/11/2007 challenge932.com unknown 9/11/2007? (cancelled?) dj4poison.cn www.cnnic.net.cn 9/13/2007 filed320.com unknown 9/11/2007? (cancelled?) g0t1109.zj.cn www.cnnic.net.cn 9/12.2007 gps428.com REGISTER.COM 9/09/2007 md.kg www.domain.kg 7/19/2007 member45.cn www.cnnic.net.cn 9/05/2007 miho98.com REGISTER.COM 9/12/2007 norufild6.xj.cn www.cnnic.net.cn 9/10/2007 onln37.com REGISTER.COM 9/12/2007 passmark278.com unknown 9/10/2007? (cancelled?) passmark777.com unknown 9/10/2007? (cancelled?) passw9.com REGISTER.COM 9/12/2007 pasw21.com REGISTER.COM 9/12/2007 po5p1209.cn unknown 9/11/2007? (cancelled) rt.kg www.domain.kg 7/19/2007 tech.kg www.domain.kg 7/19/2007 techs.ec nic.ec 8/11/2007? DNS server domain Registrar for-nx-rec.com REGISTERNAMES 9/10/2007 lopata.ch www.switch.ch 9/05/2007? (cancelled) loverting.com ESTDOMAINS 8/14/2007 (cancelled) mc-domain.com TUCOWS 6/27/2007 mcolorbn.com INFO AVENUE 8/07/2007 nixt-nx.tv BIZCN.COM 9/01/2007 nnborder.com REGISTER.COM 8/24/2007 nt-wuser.com INFO AVENUE 5/30/2007 vilopr.cn www.cnnic.net.cn 8/16/2007 -- AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.5
	to forum · permalink · 2007-09-13 23:57:31 ·
nwrickert sand groper Premium,MVM join:2004-09-04 Geneva, IL kudos:7 Reviews: ·AT&T U-Verse	Rock phish report Sep 14, 2007 The Friday report: 17401 69.230.196.247(5) moneymanagergps-id7156718602.citizensbank.com.techs.ec 17402 69.230.196.247(5) moneymanagergps-id514366.citizensbank.com.rt.kg 17403 200.77.213.15 moneymanagergps-id662106477.citizensbank.com.dj2poison.cn 17404 74.13.159.227(10) moneymanagergps-id95366696.citizensbank.com.brot27.com 17407 69.230.196.247(5) moneymanagergps-id593834.citizensbank.com.tech.kg 17409 200.77.213.15 moneymanagergps-id08631736.citizensbank.com.vicont5.zj.cn 17410 74.13.159.227(10) moneymanagergps-id26957884.citizensbank.com.paym87.com 17411 74.13.159.227(10) moneymanagergps-id17551682.citizensbank.com.passw9.com 17414 69.212.246.252(5) moneymanagergps-id0891815.citizensbank.com.rt.kg 17415 69.212.246.252(5) moneymanagergps-id290984747.citizensbank.com.tech.kg 17422 79.2.231.28(10) moneymanagergps-id94350763.citizensbank.com.grin65.com 17424 69.209.74.94(5) moneymanagergps-id56897.citizensbank.com.tech.kg 17437 24.69.217.190(10) moneymanagergps-id83626309.citizensbank.com.filed12.com Domain registration info Phish domain Registrar brot27.com REGISTER.COM 9/12/2007 dj2poison.cn www.cnnic.net.cn 9/13/2007 filed12.com REGISTER.COM 9/12/2007 grin65.com REGISTER.COM 9/12/2007 passw9.com REGISTER.COM 9/12/2007 paym87.com REGISTER.COM 9/12/2007 rt.kg www.domain.kg 7/19/2007 tech.kg www.domain.kg 7/19/2007 techs.ec nic.ec 8/11/2007? vicont5.zj.cn www.cnnic.net.cn 9/13/2007 DNS server domain Registrar carapicho.net BIZCN.COM 9/12/2007 mcolorbn.com INFO AVENUE 8/07/2007 nixt-nx.tv BIZCN.COM 9/01/2007 nnborder.com REGISTER.COM 8/24/2007 nt-wuser.com INFO AVENUE 5/30/2007 -- AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.5
	to forum · permalink · 2007-09-15 00:20:24 ·
nwrickert sand groper Premium,MVM join:2004-09-04 Geneva, IL kudos:7 Reviews: ·AT&T U-Verse	Rock phish report Sep 15, 2007 The report for Saturday: 17440 200.77.213.15 moneymanagergps-id99236287.citizensbank.com.ca1apicho.cn 17449 75.5.233.37(5) moneymanagergps-id23380033.citizensbank.com.md.kg 17450 75.5.233.37(5) moneymanagergps-id74528.citizensbank.com.md.kg 17451 NXDOMAIN moneymanagergps-id8488680.citizensbank.com.carapi2ho.cn 17452 75.5.233.37(5) moneymanagergps-id0865599.citizensbank.com.rt.kg 17453 200.77.213.15 moneymanagergps-id066969.citizensbank.com.abr5aciv1.hi.cn 17454 75.5.233.37(5) moneymanagergps-id6515914.citizensbank.com.md.kg 17455 75.5.233.37(5) moneymanagergps-id5284553.citizensbank.com.md.kg 17458 NXDOMAIN moneymanagergps-id6079635.citizensbank.com.nano1ver.cn 17459 NXDOMAIN moneymanagergps-id933948.citizensbank.com.member49.cn 17463 74.78.118.52(5) moneymanagergps-id1024187929.citizensbank.com.md.kg 17464 74.78.118.52(5) moneymanagergps-id5758673423.citizensbank.com.rt.kg 17465 74.78.118.52(5) moneymanagergps-id58676.citizensbank.com.rt.kg 17466 68.60.56.24(10) moneymanagergps-id30649055.citizensbank.com.grin65.com 17470 200.77.213.15 moneymanagergps-id701157.citizensbank.com.ce1r4tr3.cn 17495 200.77.213.15 moneymanagergps-id77355.citizensbank.com.carilo6.zj.cn Domain registration info Phish domain Registrar abr5aciv1.hi.cn www.cnnic.net.cn 9/11/2007 ca1apicho.cn www.cnnic.net.cn 9/13/2007 carapi2ho.cn www.cnnic.net.cn 9/13/2007 carilo6.zj.cn www.cnnic.net.cn 9/12/2007 ce1r4tr3.cn www.cnnic.net.cn 9/15/2007 grin65.com REGISTER.COM 9/12/2007 md.kg www.domain.kg 7/19/2007 member49.cn www.cnnic.net.cn 9/05/2007 nano1ver.cn unknown 9/14/2007? (cancelled?) rt.kg www.domain.kg 7/19/2007 DNS server domain Registrar carapicho.net BIZCN.COM 9/12/2007 musicbbx.com REGISTER.COM 8/31/2007 nixt-nx.tv BIZCN.COM 9/01/2007 (suspended) nt-wuser.com INFO AVENUE 5/30/2007 soldofo.com TODAYNIC.COM 9/06/2007 -- AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.5
	to forum · permalink · 2007-09-15 23:58:00 ·
nwrickert sand groper Premium,MVM join:2004-09-04 Geneva, IL kudos:7 Reviews: ·AT&T U-Verse	Rock phish report Sep 16, 2007 The Sunday report: 17510 68.60.56.24(10) moneymanagergps-id77075757.citizensbank.com.gpc35.com 17511 68.60.56.24(10) moneymanagergps-id39885891.citizensbank.com.onln37.com 17512 200.77.213.15 moneymanagergps-id0932815001.citizensbank.com.morefu1n1.cn 17513 200.77.213.15 moneymanagergps-id22685.citizensbank.com.palvica1q1.cn 17514 74.78.118.52(5) moneymanagergps-id4188620.citizensbank.com.rt.kg 17515 74.78.118.52(5) moneymanagergps-id46154.citizensbank.com.rt.kg 17516 200.77.213.15 moneymanagergps-id01017.citizensbank.com.palvica161.cn 17517 200.77.213.15 moneymanagergps-id092308.citizensbank.com.palvica141.cn 17518 74.78.118.52(5) moneymanagergps-id245264622.citizensbank.com.rt.kg 17519 200.77.213.15 moneymanagergps-id316878862.citizensbank.com.palvica111.cn 17520 200.77.213.15 moneymanagergps-id244909.citizensbank.com.1ixhonod.cn 17521 200.77.213.15 moneymanagergps-id649033.citizensbank.com.soldofo.xz.cn 17522 62.163.124.158(10) moneymanagergps-id21521036.citizensbank.com.mark09.com 17523 200.77.213.15 moneymanagergps-id3511018.citizensbank.com.ce1r4tr3.cn 17525 200.77.213.15 moneymanagergps-id205817235.citizensbank.com.dj-ice2.cn 17526 200.77.213.15 moneymanagergps-id66031.citizensbank.com.dj2poison.cn 17527 200.77.213.15 moneymanagergps-id2084172210.citizensbank.com.dj0poison.cn 17528 200.77.213.15 moneymanagergps-id76323.citizensbank.com.dj9poison.cn 17529 80.133.240.130(10) moneymanagergps-id65591567.citizensbank.com.brih43.com 17530 68.60.56.24(5) moneymanagergps-id4835556.citizensbank.com.rt.kg 17544 200.77.213.15 moneymanagergps-id64901429.citizensbank.com.morefu1n1.cn 17551 60.12.130.112 moneymanagergps-id77752.citizensbank.com.elephunk1.gx.cn 17552 60.12.130.112 moneymanagergps-id02200287.citizensbank.com.abr3aciv1.hi.cn 17556 60.12.130.112 moneymanagergps-id735466.citizensbank.com.ce1r4tr3.cn Domain registration info Phish domain Registrar 1ixhonod.cn www.cnnic.net.cn 9/14/2007 abr3aciv1.hi.cn www.cnnic.net.cn 9/11/2007 brih43.com REGISTER.COM 9/12/2007 ce1r4tr3.cn www.cnnic.net.cn 9/15/2007 dj0poison.cn www.cnnic.net.cn 9/13/2007 dj2poison.cn www.cnnic.net.cn 9/13/2007 dj9poison.cn www.cnnic.net.cn 9/13/2007 dj-ice2.cn www.cnnic.net.cn 9/07/2007 elephunk1.gx.cn www.cnnic.net.cn 9/07/2007 gpc35.com REGISTER.COM 9/12/2007 mark09.com REGISTER.COM 9/12/2007 morefu1n1.cn www.cnnic.net.cn 9/15/2007 onln37.com REGISTER.COM 9/12/2007 palvica111.cn www.cnnic.net.cn 9/15/2007 palvica141.cn www.cnnic.net.cn 9/15/2007 palvica161.cn www.cnnic.net.cn 9/15/2007 palvica1q1.cn www.cnnic.net.cn 9/15/2007 rt.kg www.domain.kg 7/19/2007 soldofo.xz.cn www.cnnic.net.cn 9/06/2007 DNS server domain Registrar carapicho.net BIZCN.COM 9/12/2007 lo1-prt.com BIZCN.COM 9/05/2007 (suspended) musicbbx.com REGISTER.COM 8/31/2007 nixt-nx.tv BIZCN.COM 9/01/2007 (suspended) nnborder.com REGISTER.COM 8/24/2007 nt-wuser.com INFO AVENUE 5/30/2007 soldofo.com TODAYNIC.COM 9/06/2007 -- AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.5
	to forum · permalink · 2007-09-16 23:57:04 ·
nwrickert sand groper Premium,MVM join:2004-09-04 Geneva, IL kudos:7 Reviews: ·AT&T U-Verse	Rock phish report Sep 17, 2007 The rock phishers have had a bad day today. The domain "carapicho.net" was suspended by the registrar, and most of their phish depended on that domain for DNS services. I was still able to find IP addresses for the phish pages, because I happened to have the IP address of their DNS server from the previous day. But a fresh DNS lookup of most of today's rock phish domains would give a temp fail error. The Monday report: 17577 60.12.130.112 moneymanagergps-id71501616.citizensbank.com.carilo1.zj.cn 17595 dns_temp_fail moneymanagergps-id88667103.citizensbank.com.miho98.com 17598 60.12.130.112 moneymanagergps-id162268674.citizensbank.com.r-n1x-rec.cn 17599 60.12.130.112 moneymanagergps-id174692443.citizensbank.com.dj2poison.cn 17600 60.12.130.112 moneymanagergps-id768837.citizensbank.com.mo1refun1.cn 17601 60.12.130.112 moneymanagergps-id7347010168.citizensbank.com.r-n3x-rec.cn 17602 60.12.130.112 moneymanagergps-id320415026.citizensbank.com.palvica141.cn 17604 24.122.237.105(10) moneymanagergps-id74979216.citizensbank.com.pink76.com 17605 60.12.130.112 moneymanagergps-id011993.citizensbank.com.ardobn1.cn 17606 60.12.130.112 moneymanagergps-id21844.citizensbank.com.palvica171.cn 17607 60.12.130.112 moneymanagergps-id408531848.citizensbank.com.argdon1.cn Domain registration info Phish domain Registrar ardobn1.cn www.cnnic.net.cn 9/16/2007 argdon1.cn www.cnnic.net.cn 9/16/2007 carilo1.zj.cn www.cnnic.net.cn 9/12/2007 dj2poison.cn www.cnnic.net.cn 9/13/2007 miho98.com REGISTER.COM 9/12/2007 mo1refun1.cn www.cnnic.net.cn 9/15/2007 palvica141.cn www.cnnic.net.cn 9/15/2007 palvica171.cn www.cnnic.net.cn 9/15/2007 pink76.com REGISTER.COM 9/16/2007 r-n1x-rec.cn www.cnnic.net.cn 9/16/2007 r-n3x-rec.cn www.cnnic.net.cn 9/16/2007 DNS server domain Registrar carapicho.net BIZCN.COM 9/12/2007 (suspended) nixt-nx.tv BIZCN.COM 9/01/2007 (suspended) nt-wuser.com INFO AVENUE 5/30/2007 -- AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.5
	to forum · permalink · 2007-09-17 23:48:20 ·
nwrickert sand groper Premium,MVM join:2004-09-04 Geneva, IL kudos:7 Reviews: ·AT&T U-Verse	Rock phish report Sep 18, 2007 The Tuesday report: 17628 24.122.237.105(10) moneymanagergps-id96798529.citizensbank.com.depz10.com 17629 60.12.130.112 moneymanagergps-id41301060.citizensbank.com.palvica111.cn 17630 60.12.130.112 moneymanagergps-id7845433523.citizensbank.com.dancrk1.xz.cn 17631 60.12.130.112 moneymanagergps-id8589019202.citizensbank.com.elephunk3.gx.cn 17632 60.12.130.112 moneymanagergps-id24138.citizensbank.com.elephunk2.gx.cn 17640 dns_temp_fail moneymanagergps-id96985392.citizensbank.com.pink76.com 17645 dns_temp_fail moneymanagergps-id08528758.citizensbank.com.whis87.com 17646 dns_temp_fail moneymanagergps-id53143238.citizensbank.com.moref1un1.cn 17647 79.22.190.38(10) moneymanagergps-id89146198.citizensbank.com.didj87.com 17648 79.22.190.38(10) moneymanagergps-id76441821.citizensbank.com.didj87.com 17649 79.22.190.38(10) moneymanagergps-id42901646.citizensbank.com.didj87.com 17650 79.22.190.38(10) moneymanagergps-id55760817.citizensbank.com.kips98.com 17668 60.12.130.112 moneymanagergps-id6883246267.citizensbank.com.day17v.cn 17669 60.12.130.112 moneymanagergps-id1838546.citizensbank.com.norde4c1.gx.cn 17671 67.38.42.44(10) moneymanagergps-id28654292.citizensbank.com.yrrsa9.com 17681 82.200.140.134 moneymanagergps-id741530.citizensbank.com.nordec31.gx.cn Domain registration info Phish domain Registrar dancrk1.xz.cn www.cnnic.net.cn 9/18/2007 day17v.cn www.cnnic.net.cn 9/18/2007 depz10.com REGISTER.COM 9/16/2007 didj87.com REGISTER.COM 9/17/2007 elephunk2.gx.cn www.cnnic.net.cn 9/07/2007 elephunk3.gx.cn www.cnnic.net.cn 9/07/2007 kips98.com REGISTER.COM 9/17/2007 moref1un1.cn www.cnnic.net.cn 9/15/2007 norde4c1.gx.cn www.cnnic.net.cn 9/18/2007 nordec31.gx.cn www.cnnic.net.cn 9/18/2007 palvica111.cn www.cnnic.net.cn 9/15/2007 pink76.com REGISTER.COM 9/16/2007 whis87.com REGISTER.COM 9/16/2007 yrrsa9.com REGISTER.COM 9/17/2007 DNS server domain Registrar aruba-nx.com BIZCN.COM 9/08/2007 (suspended) bar-bar-com.com BIZCN.COM 9/18/2007 carapicho.net BIZCN.COM 9/12/2007 (suspended) lo1-prt.com BIZCN.COM 9/05/2007 (suspended) nixt-nx.tv BIZCN.COM 9/01/2007 (suspended) nnborder.com REGISTER.COM 8/24/2007 nt-wuser.com INFO AVENUE 5/30/2007 vilopr.cn www.cnnic.net.cn 8/16/2007 -- AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.5
	to forum · permalink · 2007-09-18 23:51:52 ·
nwrickert sand groper Premium,MVM join:2004-09-04 Geneva, IL kudos:7 Reviews: ·AT&T U-Verse 1 edit	Rock phish report Sep 19, 2007 The Wednesday report: 17687 209.62.20.175 moneymanagergps-id61219548.citizensbank.com.dfbb55.com 17695 60.12.130.112 moneymanagergps-id3396113.citizensbank.com.tron2off1.xz.cn 17696 NXDOMAIN moneymanagergps-id263044910.citizensbank.com.nordec11.xz.cn 17697 60.12.130.112 moneymanagergps-id75356.citizensbank.com.voma1d.cn 17698 209.62.20.175 moneymanagergps-id05479601.citizensbank.com.cars98.com 17699 NXDOMAIN moneymanagergps-id6648101507.citizensbank.com.dancrk1.xz.cn 17700 dns_temp_fail moneymanagergps-id86271467.citizensbank.com.cars98.com 17701 209.62.20.175 moneymanagergps-id83312749.citizensbank.com.gffs998.com 17713 60.12.130.112 moneymanagergps-id915097982.citizensbank.com.nordec61.gz.cn 17714 60.12.130.112 moneymanagergps-id52969.citizensbank.com.tronoff1.hi.cn 17715 24.122.237.105(10) session-12345678.paylinks.cunet.org.pis95.com 17716 60.12.130.112 moneymanagergps-id748385.citizensbank.com.vira2d1.cn 17722 24.122.237.105(10) session-12345678.paylinks.cunet.org.nhd48.com 17723 60.12.130.112 moneymanagergps-id873409.citizensbank.com.v6irad1.cn 17725 24.122.237.105(10) session-12345678.paylinks.cunet.org.piv63.com 17731 60.12.130.112 moneymanagergps-id8033592.citizensbank.com.norde4c1.xz.cn 17732 24.122.237.105(10) session-11748854.paylinks.cunet.org.pwd85.com 17733 24.122.237.105(10) session-18903230.paylinks.cunet.org.bst81.com 17734 24.122.237.105(10) session-12345678.paylinks.cunet.org.psw83.com 17737 60.12.130.112 moneymanagergps-id832885.citizensbank.com.mit4ac.cn 17738 NXDOMAIN moneymanagergps-id51069526.citizensbank.com.fris34.com 17748 60.12.130.112 moneymanagergps-id05708573.citizensbank.com.carilo2.zj.cn 17754 session-13405237.paylinks.cunet.org.rex91.com 17755 60.12.130.112 moneymanagergps-id800891520.citizensbank.com.nordec31.gx.cn 17756 60.12.130.112 moneymanagergps-id96768245.citizensbank.com.durdom1.gz.cn 17757 60.12.130.112 moneymanagergps-id605459495.citizensbank.com.member48.cn Domain registration info Phish domain Registrar bst81.com REGISTER.COM 9/18/2007 carilo2.zj.cn www.cnnic.net.cn 9/12/2007 cars98.com REGISTER.COM 9/17/2007 dancrk1.xz.cn www.cnnic.net.cn 9/18/2007 dfbb55.com REGISTER.COM 9/17/2007 durdom1.gz.cn www.cnnic.net.cn 9/18/2007 fris34.com REGISTER.COM 9/18/2007? (cancelled) gffs998.com REGISTER.COM 9/17/2007 member48.cn www.cnnic.net.cn 9/05/2007 mit4ac.cn www.cnnic.net.cn 9/18/2007 nhd48.com REGISTER.COM 9/18/2007 norde4c1.xz.cn www.cnnic.net.cn 9/18/2007 nordec11.xz.cn www.cnnic.net.cn 9/18/2007 nordec31.gx.cn www.cnnic.net.cn 9/18/2007 nordec61.gz.cn www.cnnic.net.cn 9/18/2007 pis95.com REGISTER.COM 9/18/2007 piv63.com REGISTER.COM 9/18/2007 psw83.com REGISTER.COM 9/18/2007 pwd85.com REGISTER.COM 9/18/2007 rex91.com REGISTER.COM 9/18/2007 tron2off1.xz.cn www.cnnic.net.cn 9/14/2007 tronoff1.hi.cn www.cnnic.net.cn 9/14/2007 v6irad1.cn www.cnnic.net.cn 9/19/2007 vira2d1.cn www.cnnic.net.cn 9/19/2007 voma1d.cn www.cnnic.net.cn 9/18/2007 DNS server domain Registrar bar-bar-com.com BIZCN.COM 9/18/2007 lo1-prt.com BIZCN.COM 9/05/2007 (suspended) nnborder.com REGISTER.COM 8/24/2007 nt-wuser.com INFO AVENUE 5/30/2007 polo456.com TODAYNIC.COM 9/17/2007 themailworld.com INFO AVENUE 8/24/2007 vilopr.cn www.cnnic.net.cn 8/16/2007 (edit - inserted missing entry) -- AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.5
	to forum · permalink · 2007-09-19 23:58:35 ·
nwrickert sand groper Premium,MVM join:2004-09-04 Geneva, IL kudos:7 Reviews: ·AT&T U-Verse	Rock phish report Sep 20, 2007 The Thursday report: 17780 phish_is_down moneymanagergps-id2632683.citizensbank.com.ard4on1.cn 17781 dns_temp_fail session-99170769.paylinks.cunet.org.nhd48.com 17782 60.12.130.112 moneymanagergps-id1064170.citizensbank.com.carilo2.zj.cn 17783 60.12.130.112 moneymanagergps-id0436012098.citizensbank.com.nordec61.gx.cn 17786 60.12.130.112 moneymanagergps-id143678.citizensbank.com.member49.cn 17807 60.12.130.112 moneymanagergps-id130178916.citizensbank.com.polo8789.tw 17815 24.122.237.105(10) securelogin-05857476.citizensbank.com.str95.com 17819 60.12.130.112 moneymanagergps-id8891670.citizensbank.com.danc2rk1.gz.cn 17821 NXDOMAIN moneymanagergps-id50299840.citizensbank.com.norde4c1.gx.cn 17822 NXDOMAIN moneymanagergps-id201862523.citizensbank.com.palvica111.cn 17823 dns_temp_fail session-58701725.paylinks.cunet.org.bst81.com 17832 24.226.197.117(10) securelogin-10845498.citizensbank.com.int72.com 17833 60.12.130.112 moneymanagergps-id3945452929.citizensbank.com.fador3.cn 17834 60.12.130.112 moneymanagergps-id14262592.citizensbank.com.member47.cn 17835 60.12.130.112 moneymanagergps-id8470533.citizensbank.com.vall3.cn Domain registration info Phish domain Registrar ard4on1.cn www.cnnic.net.cn 9/16/2007 bst81.com REGISTER.COM 9/18/2007 carilo2.zj.cn www.cnnic.net.cn 9/12/2007 danc2rk1.gz.cn www.cnnic.net.cn 9/18/2007 fador3.cn www.cnnic.net.cn 9/21/2007 int72.com REGISTER.COM 9/19/2007 member47.cn www.cnnic.net.cn 9/05/2007 member49.cn www.cnnic.net.cn 9/05/2007 nhd48.com REGISTER.COM 9/18/2007 norde4c1.gx.cn www.cnnic.net.cn 9/18/2007 nordec61.gx.cn www.cnnic.net.cn 9/18/2007 palvica111.cn www.cnnic.net.cn 9/15/2007 polo8789.tw SEEDNET 9/18/2007 str95.com REGISTER.COM 9/19/2007 vall3.cn www.cnnic.net.cn 9/21/2007 DNS server domain Registrar bar-bar-com.com BIZCN.COM 9/18/2007 (suspended) carapicho.net BIZCN.COM 9/12/2007 (suspended) lo1-prt.com BIZCN.COM 9/05/2007 (suspended) nt-wuser.com INFO AVENUE 5/30/2007 polo456.com TODAYNIC.COM 9/17/2007 themailworld.com INFO AVENUE 8/24/2007 vilopr.cn www.cnnic.net.cn 8/16/2007 -- AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.5
	to forum · permalink · 2007-09-21 00:01:16 ·
nwrickert sand groper Premium,MVM join:2004-09-04 Geneva, IL kudos:7 Reviews: ·AT&T U-Verse	Rock phish report Sep 21, 2007 The Friday report: 17841 60.12.130.112 moneymanagergps-id356785919.citizensbank.com.carilo1.zj.cn 17845 76.23.254.69(10) securelogin-22416284.citizensbank.com.kst83.com 17855 dns_temp_fail session-{dig}{dig}{dig}{dig}{dig}{dig}{dig}{dig}.paylinks.cunet.org.edg58.com 17861 NXDOMAIN moneymanagergps-id98119.citizensbank.com.fj6ruut.cn 17862 76.23.254.69(10) securelogin-21778036.citizensbank.com.kdp69.com 17885 219.253.140.172 moneymanagergps-id9210632023.citizensbank.com.jovag5o1.cn Domain registration info Phish domain Registrar carilo1.zj.cn www.cnnic.net.cn 9/12/2007 edg58.com REGISTER.COM 9/18/2007 fj6ruut.cn unknown 9/20/2007? (cancelled?) jovag5o1.cn www.cnnic.net.cn 9/21/2007 kdp69.com REGISTER.COM 9/19/2007 kst83.com REGISTER.COM 9/19/2007 DNS server domain Registrar bar-bar-com.com BIZCN.COM 9/18/2007 (suspended) nt-wuser.com INFO AVENUE 5/30/2007 themailworld.com INFO AVENUE 8/24/2007 vot-tov.net BIZCN.COM 9/21/2007 -- AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.5
	to forum · permalink · 2007-09-21 23:54:29 ·
nwrickert sand groper Premium,MVM join:2004-09-04 Geneva, IL kudos:7 Reviews: ·AT&T U-Verse	Rock phish report Sep 22, 2007 The Saturday report: 17893 219.253.140.172 moneymanagergps-id842548.citizensbank.com.kkdio3.gx.cn 17894 219.253.140.172 moneymanagergps-id1074537.citizensbank.com.xiloex.cn 17895 219.253.140.172 moneymanagergps-id126151816.citizensbank.com.varian2.xz.cn 17896 219.253.140.172 moneymanagergps-id334155692.citizensbank.com.kroitkg.cn 17897 219.253.140.172 moneymanagergps-id01331.citizensbank.com.jovago31.xz.cn 17898 219.253.140.172 moneymanagergps-id134081708.citizensbank.com.lo2prt.hi.cn 17899 24.122.237.105(10) securelogin-35157879.citizensbank.com.nst32.com 17904 24.122.237.105(10) securelogin-85809293.citizensbank.com.fij62.com 17905 219.253.140.172 moneymanagergps-id7987511.citizensbank.com.tron4off1.hi.cn 17906 219.253.140.172 moneymanagergps-id295244941.citizensbank.com.vari1an.xz.cn 17907 219.253.140.172 moneymanagergps-id8489145.citizensbank.com.kiirog.cn 17908 219.253.140.172 moneymanagergps-id7323288.citizensbank.com.ckiirgf.cn 17909 219.253.140.172 moneymanagergps-id4563599827.citizensbank.com.tron3off1.hi.cn Domain registration info Phish domain Registrar ckiirgf.cn www.cnnic.net.cn 9/21/2007 fij62.com REGISTER.COM 9/19/2007 jovago31.xz.cn www.cnnic.net.cn 9/21/2007 kiirog.cn www.cnnic.net.cn 9/21/2007 kkdio3.gx.cn www.cnnic.net.cn 9/21/2007 kroitkg.cn www.cnnic.net.cn 9/21/2007 lo2prt.hi.cn www.cnnic.net.cn 9/06/2007 nst32.com REGISTER.COM 9/19/2007 tron3off1.hi.cn www.cnnic.net.cn 9/14/2007 tron4off1.hi.cn www.cnnic.net.cn 9/14/2007 vari1an.xz.cn www.cnnic.net.cn 9/21/2007 varian2.xz.cn www.cnnic.net.cn 9/21/2007 xiloex.cn www.cnnic.net.cn 9/21/2007 DNS server domain Registrar bar-bar-com.com BIZCN.COM 9/18/2007 (suspended) themailworld.com INFO AVENUE 8/24/2007 vilopr.cn www.cnnic.net.cn 8/16/2007 vot-tov.net BIZCN.COM 9/21/2007 -- AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.5
	to forum · permalink · 2007-09-22 23:56:05 ·
nwrickert sand groper Premium,MVM join:2004-09-04 Geneva, IL kudos:7 Reviews: ·AT&T U-Verse	Rock phish report Sep 23, 2007 The Sunday report: 17930 219.253.140.172 moneymanagergps-id42994.citizensbank.com.jov7ago1.cn 17931 219.253.140.172 moneymanagergps-id53297.citizensbank.com.donfort.cn 17932 219.253.140.172 moneymanagergps-id70497.citizensbank.com.varia4n.xz.cn 17933 219.253.140.172 moneymanagergps-id669890642.citizensbank.com.lopfroriif.cn 17934 219.253.140.172 moneymanagergps-id3507358.citizensbank.com.irutujg.cn 17937 200.77.213.15 moneymanagergps-id34644.citizensbank.com.virad1.cn 17939 200.77.213.15 moneymanagergps-id44132.citizensbank.com.donfrod.cn 17943 209.62.20.175 moneymanagergps-id38666400.citizensbank.com.token9.com 17945 209.62.20.175 moneymanagergps-id74993884.citizensbank.com.lops19.com 17949 209.62.20.175 moneymanagergps-id57072693.citizensbank.com.grin65.com 17952 209.62.20.175 moneymanagergps-id40818374.citizensbank.com.fids98.com 17954 NXDOMAIN bancorpsouthonline.inview.93492135-login.corporate.challenge691.com 17956 NXDOMAIN bancorpsouthonline.inview.37786896-login.corporate.passmark589.com 17961 200.77.213.15 moneymanagergps-id1312731.citizensbank.com.nig4yr.cn 17962 200.77.213.15 moneymanagergps-id0852979.citizensbank.com.kkriirm.cn 17963 200.77.213.15 moneymanagergps-id25286167.citizensbank.com.ntigyr.cn 17964 200.77.213.15 moneymanagergps-id1108152.citizensbank.com.member47.cn Domain registration info Phish domain Registrar challenge691.com unknown 9/11/2007? (cancelled?) donfort.cn www.cnnic.net.cn 9/21/2007 donfrod.cn www.cnnic.net.cn 9/21/2007 fids98.com REGISTER.COM 9/12/2007 grin65.com REGISTER.COM 9/12/2007 irutujg.cn www.cnnic.net.cn 9/21/2007 jov7ago1.cn www.cnnic.net.cn 9/21/2007 kkriirm.cn www.cnnic.net.cn 9/21/2007 lopfroriif.cn www.cnnic.net.cn 9/21/2007 lops19.com REGISTER.COM 9/16/2007 member47.cn www.cnnic.net.cn 9/05/2007 nig4yr.cn www.cnnic.net.cn 9/22/2007 ntigyr.cn www.cnnic.net.cn 9/22/2007 passmark589.com unknown 9/10/2007? (cancelled?) token9.com REGISTER.COM 9/16/2007 varia4n.xz.cn www.cnnic.net.cn 9/21/2007 virad1.cn www.cnnic.net.cn 9/19/2007 DNS server domain Registrar bar-bar-com.com BIZCN.COM 9/18/2007 (suspended) BNMQ.COM RESELLERCLUB 8/03/2004 (in use by rockphish) nt-wuser.com INFO AVENUE 5/30/2007 (suspended) polo456.com TODAYNIC.COM 9/17/2007 vot-tov.net BIZCN.COM 9/21/2007 -- AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.5
	to forum · permalink · 2007-09-23 23:47:53 ·

nwrickert sand groper Premium,MVM join:2004-09-04 Geneva, IL kudos:7 Reviews: ·AT&T U-Verse	Rock phish report Sep 24, 2007 The Monday report: 17976 200.77.213.15 moneymanagergps-id5468150.citizensbank.com.nnigyr.cn 17978 200.77.213.15 moneymanagergps-id8694173.citizensbank.com.nig63yr.cn 17990 200.77.213.15 moneymanagergps-id2192489093.citizensbank.com.member47.cn 17997 24.122.237.105(10) securelogin-89048398.citizensbank.com.gl24.org 17998 200.77.213.15 moneymanagergps-id961527.citizensbank.com.danc2rk1.gz.cn 18025 200.77.213.15 moneymanagergps-id88505225.citizensbank.com.lglleirt.gx.cn 18031 200.77.213.15 moneymanagergps-id40379328.citizensbank.com.donfrod.cn 18032 200.77.213.15 moneymanagergps-id270794.citizensbank.com.kolpor.cn 18033 24.226.197.117(10) securelogin-92199895.citizensbank.com.fg09.org 18034 200.77.213.15 moneymanagergps-id9340187.citizensbank.com.member46.cn 18035 200.77.213.15 moneymanagergps-id6073810615.citizensbank.com.member49.cn 18036 200.77.213.15 moneymanagergps-id321349096.citizensbank.com.ne3r3j.cn 18037 200.77.213.15 moneymanagergps-id4132712870.citizensbank.com.xilod3.cn 18038 200.77.213.15 moneymanagergps-id8357845.citizensbank.com.varia4n.xz.cn 18039 200.77.213.15 moneymanagergps-id6117036284.citizensbank.com.lo4poreiif.cn 18040 24.226.197.117(10) securelogin-19276363.citizensbank.com.mb43.org Domain registration info Phish domain Registrar danc2rk1.gz.cn www.cnnic.net.cn 9/18/2007 donfrod.cn www.cnnic.net.cn 9/21/2007 fg09.org REGISTER.COM 9/24/2007 gl24.org REGISTER.COM 9/24/2007 kolpor.cn www.cnnic.net.cn 9/21/2007 lglleirt.gx.cn www.cnnic.net.cn 9/22/2007 lo4poreiif.cn www.cnnic.net.cn 9/21/2007 mb43.org REGISTER.COM 9/24/2007 member46.cn www.cnnic.net.cn 9/05/2007 member47.cn www.cnnic.net.cn 9/05/2007 member49.cn www.cnnic.net.cn 9/05/2007 ne3r3j.cn www.cnnic.net.cn 9/20/2007 nig63yr.cn www.cnnic.net.cn 9/22/2007 nnigyr.cn www.cnnic.net.cn 9/22/2007 varia4n.xz.cn www.cnnic.net.cn 9/21/2007 xilod3.cn www.cnnic.net.cn 9/21/2007 DNS server domain Registrar bar-bar-com.com BIZCN.COM 9/18/2007 (suspended) lo1-prt.com BIZCN.COM 9/05/2007 (suspended) polo456.com TODAYNIC.COM 9/17/2007 realtextonline.com INFO AVENUE 9/12/2007 vilopr.cn www.cnnic.net.cn 8/16/2007 vot-tov.net BIZCN.COM 9/21/2007 -- AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.5
	to forum · permalink · 2007-09-24 23:54:06 ·
nwrickert sand groper Premium,MVM join:2004-09-04 Geneva, IL kudos:7 Reviews: ·AT&T U-Verse	Rock phish report Sep 25, 2007 The report for Tuesday: 18047 24.226.197.117(10) securelogin-52713950.citizensbank.com.mb43.org 18052 dns_temp_fail securelogin-48292657.citizensbank.com.eec22.org 18054 NXDOMAIN moneymanagergps-id296078935.citizensbank.com.voma2d.cn 18055 211.60.129.140 moneymanagergps-id3179627.citizensbank.com.dkjdu.gz.cn 18056 NXDOMAIN moneymanagergps-id022053.citizensbank.com.vnigyr.cn 18057 211.60.129.140 moneymanagergps-id62866354.citizensbank.com.gleli4.gz.cn 18058 dns_temp_fail securelogin-26759775.citizensbank.com.ejd2.info 18061 61.81.129.16(10) bancorpsouthonline.inview.35340279.corporate.lopy9.org 18062 61.81.129.16(10) bancorpsouthonline.inview.22536277.corporate.fvws11.org 18065 67.166.218.106(10) bancorpsouthonline.inview.67264759.corporate.lopy9.org 18066 67.166.218.106(10) bancorpsouthonline.inview.64283600.corporate.vdv01.com 18067 74.13.153.20(10) bancorpsouthonline.inview.23482305.corporate.y54eg.org 18068 74.13.153.20(10) bancorpsouthonline.inview.32415485.corporate.vdv01.com 18069 dns_temp_fail securelogin-22529844.citizensbank.com.ghts87.org 18071 dns_temp_fail securelogin-54367519.citizensbank.com.ecc88.org 18077 NXDOMAIN bancorpsouthonline.inview.11988655.corporate.bxx11.com 18079 12.206.125.174(10) bancorpsouthonline.inview.21470519.corporate.bxs09.com 18080 12.206.125.174(10) bancorpsouthonline.inview.55596356.corporate.y54eg.org 18084 211.60.129.140 www.rbsdigital.com.ref55661.m1or1109.zj.cn 18091 24.122.237.105(10) bancorpsouthonline.inview.19732590.corporate.asd3q2.org 18092 24.122.237.105(10) bancorpsouthonline.inview.94836650.corporate.fvws11.org 18098 211.60.129.140 moneymanagergps-id6497703421.citizensbank.com.dfkgkb3.xz.cn 18099 NXDOMAIN moneymanagergps-id927458906.citizensbank.com.fkiirtg.cn 18101 211.60.129.140 moneymanagergps-id6377435414.citizensbank.com.varia4n.xz.cn 18102 24.226.197.117(10) bancorpsouthonline.inview.87185398.corporate.gre40.org 18103 24.226.197.117(10) bancorpsouthonline.inview.29683546.corporate.lve11.com 18109 211.60.129.140 moneymanagergps-id61699345.citizensbank.com.gkkkiee.gx.cn Domain registration info Phish domain Registrar asd3q2.org REGISTER.COM 9/24/2007 bxs09.com REGISTER.COM 9/24/2007 bxx11.com unknown 9/24/2007? (cancelled?) dfkgkb3.xz.cn www.cnnic.net.cn 9/21/2007 dkjdu.gz.cn www.cnnic.net.cn 9/22/2007 ecc88.org REGISTER.COM 9/24/2007 eec22.org REGISTER.COM 9/24/2007 ejd2.info REGISTER.COM 9/24/2007 fkiirtg.cn unknown 9/24/2007? (cancelled?) fvws11.org REGISTER.COM 9/24/2007 ghts87.org REGISTER.COM 9/24/2007 gkkkiee.gx.cn www.cnnic.net.cn 9/22/2007 gleli4.gz.cn www.cnnic.net.cn 9/21/2007 gre40.org REGISTER.COM 9/24/2007 lopy9.org REGISTER.COM 9/24/2007 lve11.com REGISTER.COM 9/24/2007 m1or1109.zj.cn www.cnnic.net.cn 9/11/2007 mb43.org REGISTER.COM 9/24/2007 varia4n.xz.cn www.cnnic.net.cn 9/21/2007 vdv01.com REGISTER.COM 9/24/2007 vnigyr.cn unknown 9/24/2007? (cancelled?) voma2d.cn unknown 9/18/2007? (cancelled?) y54eg.org REGISTER.COM 9/24/2007 DNS server domain Registrar abc-tgc.com REGISTER.COM 9/11/2007 bar-bar-com.com BIZCN.COM 9/18/2007 (suspended) realtextonline.com INFO AVENUE 9/12/2007 vot-tov.net BIZCN.COM 9/21/2007 (suspended) -- AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.5
	to forum · permalink · 2007-09-26 00:27:45 ·
nwrickert sand groper Premium,MVM join:2004-09-04 Geneva, IL kudos:7 Reviews: ·AT&T U-Verse 1 edit	Rock phish report Sep 26, 2007 The Wednesday report: 18120 74.13.153.20(10) securelogin-99443479.moneymanagergps.com.ghm553.com 18121 74.13.153.20(10) securelogin-49016183.moneymanagergps.com.ghm553.com 18122 74.13.153.20(10) securelogin-38483084.moneymanagergps.com.gfc11.com 18124 24.226.197.117(10) securelogin-13244822.moneymanagergps.com.ghm553.com 18125 24.226.197.117(10) securelogin-93489129.moneymanagergps.com.gps181.com 18126 NXDOMAIN moneymanagergps-id742524426.citizensbank.com.ntigyr.cn 18127 200.77.213.15 moneymanagergps-id02599961.citizensbank.com.vari1an.xz.cn 18128 NXDOMAIN moneymanagergps-id80125865.citizensbank.com.lorporiif.cn 18129 NXDOMAIN moneymanagergps-id93865.citizensbank.com.oiroot.cn 18130 200.77.213.15 moneymanagergps-id6921391.citizensbank.com.dkjdu.gx.cn 18131 200.72.139.67 www.citibank.co.uk.session47697.mybe2er1.gx.cn 18134 200.72.139.67 www.citibank.co.uk.taskid285.carlat2.zj.cn 18137 NXDOMAIN moneymanagergps-id614557.citizensbank.com.voma1d.cn 18144 NXDOMAIN bancorpsouthonline.inview.27185445.corporate.y54eg.org 18145 79.66.89.106(10) securelogin-50852902.moneymanagergps.com.gfc11.com 18146 NXDOMAIN bancorpsouthonline.inview.99049422.corporate.fds43.org 18149 18.62.30.195(10) securelogin-37838375.moneymanagergps.com.gps181.com 18161 NXDOMAIN moneymanagergps-id369907.citizensbank.com.mita2c.cn 18165 211.60.129.140 moneymanagergps-id03807844.citizensbank.com.varia4n.xz.cn 18166 211.60.129.140 moneymanagergps-id9413051869.citizensbank.com.lglleirt.gx.cn 18167 68.55.15.65(10) securelogin-57678646.moneymanagergps.com.gps181.com Domain registration info Phish domain Registrar carlat2.zj.cn www.cnnic.net.cn 9/13/2007 dkjdu.gx.cn www.cnnic.net.cn 9/22/2007 fds43.org REGISTER.COM 9/26/2007 (cancelled) gfc11.com REGISTER.COM 9/26/2007 ghm553.com REGISTER.COM 9/26/2007 gps181.com REGISTER.COM 9/26/2007 lglleirt.gx.cn www.cnnic.net.cn 9/22/2007 lorporiif.cn www.cnnic.net.cn 9/23/2007 (cancelled) mita2c.cn www.cnnic.net.cn 9/18/2007 (cancelled) mybe2er1.gx.cn www.cnnic.net.cn 9/18/2007 ntigyr.cn www.cnnic.net.cn 9/22/2007 oiroot.cn www.cnnic.net.cn 9/22/2007 (cancelled) vari1an.xz.cn www.cnnic.net.cn 9/21/2007 varia4n.xz.cn www.cnnic.net.cn 9/21/2007 voma1d.cn www.cnnic.net.cn 9/18/2007 y54eg.org REGISTER.COM 9/24/2007 DNS server domain Registrar abc-tgc.com REGISTER.COM 9/11/2007 bar-bar-com.com BIZCN.COM 9/18/2007 (suspended) carapicho.net BIZCN.COM 9/12/2007 (suspended) maritanna.com ESTDOMAINS 8/14/2007 (suspended) realtextonline.com INFO AVENUE 9/12/2007 vilopr.cn www.cnnic.net.cn 8/16/2007 vot-tov.net BIZCN.COM 9/21/2007 (suspended) (edit to fix date on subtitle) -- AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.5
	to forum · permalink · 2007-09-26 23:55:03 ·
nwrickert sand groper Premium,MVM join:2004-09-04 Geneva, IL kudos:7 Reviews: ·AT&T U-Verse	Rock phish report Sep 27, 2007 The rockphish group seems to be exploring for new targets. Today there is a NatWest (#18226) and a Bank of America (#18250). They screwed up the Bank of America, using a wrong subject line. Yesterday they tried CitiBank (#18131 and #18134). The previous day (Tuesday) they tried Royal Bank of Scotland (#18084). The report for Thursday: 18176 dns_temp_fail securelogin-45815113.moneymanagergps.com.nty90.com 18184 NXDOMAIN moneymanagergps-id211428562.citizensbank.com.gleli4.gz.cn 18185 dns_temp_fail securelogin-66183765.moneymanagergps.com.ssd12.com 18187 dns_temp_fail securelogin-45492118.moneymanagergps.com.ssd12.com 18189 211.60.129.140 moneymanagergps-id3400118.citizensbank.com.va2rian.gx.cn 18190 211.60.129.140 moneymanagergps-id02597512.citizensbank.com.member46.cn 18191 24.90.125.171(10) securelogin-00178065.moneymanagergps.com.jbl93.com 18192 24.90.125.171(10) securelogin-82747770.moneymanagergps.com.wsb34.com 18193 18.62.31.57(10) securelogin-66399291.moneymanagergps.com.jbl93.com 18194 18.62.31.57(10) securelogin-30087204.moneymanagergps.com.sks47.com 18199 18.62.31.57(10) securelogin-50616171.moneymanagergps.com.tnt67.com 18200 18.62.31.57(10) securelogin-95201136.moneymanagergps.com.htn39.com 18201 18.62.31.57(10) securelogin-62342935.moneymanagergps.com.htn39.com 18226 NXDOMAIN onlinesession-7121794900.natwest.com.member48.cn 18227 66.30.113.109(10) securelogin-66957377.moneymanagergps.com.skm64.com 18231 24.199.79.21(10) securelogin-24515210.moneymanagergps.com.sks47.com 18232 24.199.79.21(10) securelogin-15587859.moneymanagergps.com.prs86.com 18233 24.199.79.21(10) securelogin-19498525.moneymanagergps.com.gts72.com 18234 159.226.7.162 moneymanagergps-id3141162287.citizensbank.com.advanced4.cn 18235 NXDOMAIN moneymanagergps-id4209732.citizensbank.com.beloe.xz.cn 18250 211.60.129.140 service.bankofamerica.com.token2026.hahwkd.gs.cn Domain registration info Phish domain Registrar advanced4.cn unknown 9/26/2007? (cancelled) beloe.xz.cn www.cnnic.net.cn 9/21/2007 gleli4.gz.cn www.cnnic.net.cn 9/21/2007 (suspended) gts72.com REGISTER.COM 9/26/2007 hahwkd.gs.cn www.cnnic.net.cn 9/27/2007 htn39.com REGISTER.COM 9/26/2007 jbl93.com REGISTER.COM 9/26/2007 member46.cn www.cnnic.net.cn 9/05/2007 member48.cn www.cnnic.net.cn 9/05/2007 nty90.com REGISTER.COM 9/26/2007 prs86.com REGISTER.COM 9/26/2007 skm64.com REGISTER.COM 9/26/2007 sks47.com REGISTER.COM 9/26/2007 ssd12.com REGISTER.COM 9/26/2007 tnt67.com REGISTER.COM 9/26/2007 va2rian.gx.cn www.cnnic.net.cn 9/21/2007 wsb34.com REGISTER.COM 9/26/2007 DNS server domain Registrar abc-tgc.com REGISTER.COM 9/11/2007 bar-bar-com.com BIZCN.COM 9/18/2007 (suspended) polo456.com TODAYNIC.COM 9/17/2007 realtextonline.com INFO AVENUE 9/12/2007 -- AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.5
	to forum · permalink · 2007-09-27 23:55:49 ·
nwrickert sand groper Premium,MVM join:2004-09-04 Geneva, IL kudos:7 Reviews: ·AT&T U-Verse	Rock phish report Sep 28, 2007 The Friday report: 18267 200.77.213.15 moneymanagergps-id9973651507.citizensbank.com.kidfgk.gz.cn 18268 62.87.167.73(10) securelogin-24911269.moneymanagergps.com.meg48.com 18270 62.87.167.73(10) securelogin-76353314.moneymanagergps.com.gms96.com 18275 74.69.237.72(10) securelogin-61541844.moneymanagergps.com.kms59.com 18276 200.77.213.15 moneymanagergps-id942504656.citizensbank.com.xlopoe5.cn 18277 200.77.213.15 moneymanagergps-id22102339.citizensbank.com.fkkiwe.xz.cn 18278 74.69.237.72(10) securelogin-23784056.moneymanagergps.com.sks47.com 18279 74.69.237.72(10) securelogin-37333832.moneymanagergps.com.sks47.com 18280 74.69.237.72(10) securelogin-22494928.moneymanagergps.com.skm64.com 18281 74.69.237.72(10) securelogin-92187665.moneymanagergps.com.dmk49.com 18282 200.77.213.15 service.bankofamerica.com.unitid99672038.poernu3.hi.cn 18295 200.77.213.15 www.rbsdigital.com.cid1808346.porenu3.hi.cn 18299 200.77.213.15 moneymanagergps-id94358536.citizensbank.com.ognigor1.cn 18300 12.201.89.143(10) securelogin-92285959.moneymanagergps.com.fag54.com Domain registration info Phish domain Registrar dmk49.com REGISTER.COM 9/26/2007 fag54.com REGISTER.COM 9/26/2007 fkkiwe.xz.cn www.cnnic.net.cn 9/25/2007 gms96.com REGISTER.COM 9/26/2007 kidfgk.gz.cn www.cnnic.net.cn 9/27/2007 kms59.com REGISTER.COM 9/26/2007 meg48.com REGISTER.COM 9/26/2007 ognigor1.cn www.cnnic.net.cn 9/27/2007 poernu3.hi.cn www.cnnic.net.cn 9/05/2007 porenu3.hi.cn www.cnnic.net.cn 9/05/2007 skm64.com REGISTER.COM 9/26/2007 sks47.com REGISTER.COM 9/26/2007 xlopoe5.cn www.cnnic.net.cn 9/27/2007 DNS server domain Registrar abc-tgc.com REGISTER.COM 9/11/2007 lo1-prt.com BIZCN.COM 9/05/2007 (suspended) realtextonline.com INFO AVENUE 9/12/2007 vilopr.cn www.cnnic.net.cn 8/16/2007 -- AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.5
	to forum · permalink · 2007-09-28 23:51:18 ·
nwrickert sand groper Premium,MVM join:2004-09-04 Geneva, IL kudos:7 Reviews: ·AT&T U-Verse	Rock phish report Sep 29, 2007 The Saturday report: 18314 62.141.76.247(10) securelogin-28882163.moneymanagergps.com.fag54.com 18316 219.253.140.172 moneymanagergps-id17261436.citizensbank.com.cykiony.yn.cn 18317 62.141.76.247(10) securelogin-13240548.moneymanagergps.com.prs86.com 18327 219.253.140.172 moneymanagergps-id7334720249.citizensbank.com.gkkkd.gs.cn 18337 12.215.205.230(10) securelogin-47162069.moneymanagergps.com.glw93.com 18338 219.253.140.172 moneymanagergps-id315411.citizensbank.com.fkkiwe.gz.cn 18339 219.253.140.172 moneymanagergps-id277540973.citizensbank.com.fg45ll3.gz.cn 18344 24.199.79.21(10) securelogin-88228842.moneymanagergps.com.tnt67.com 18345 24.199.79.21(10) securelogin-24234738.moneymanagergps.com.gts72.com 18346 24.199.79.21(10) securelogin-77570268.moneymanagergps.com.skm64.com Domain registration info Phish domain Registrar cykiony.yn.cn www.cnnic.net.cn 9/28/2007 fag54.com REGISTER.COM 9/26/2007 fg45ll3.gz.cn www.cnnic.net.cn 9/25/2007 fkkiwe.gz.cn www.cnnic.net.cn 9/25/2007 gkkkd.gs.cn www.cnnic.net.cn 9/27/2007 glw93.com REGISTER.COM 9/26/2007 gts72.com REGISTER.COM 9/26/2007 prs86.com REGISTER.COM 9/26/2007 skm64.com REGISTER.COM 9/26/2007 tnt67.com REGISTER.COM 9/26/2007 DNS server domain Registrar abc-tgc.com REGISTER.COM 9/11/2007 bar-bar-com.com BIZCN.COM 9/18/2007 (suspended) lo1-prt.com BIZCN.COM 9/05/2007 (suspended) realtextonline.com INFO AVENUE 9/12/2007 vilopr.cn www.cnnic.net.cn 8/16/2007 -- AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.5
	to forum · permalink · 2007-09-29 23:51:34 ·
nwrickert sand groper Premium,MVM join:2004-09-04 Geneva, IL kudos:7 Reviews: ·AT&T U-Verse	Rock phish report Sep 30, 2007 The Sunday report: 18362 219.253.140.172 moneymanagergps-id1962368525.citizensbank.com.dfklkkd.gz.cn 18364 219.253.140.172 moneymanagergps-id1770040259.citizensbank.com.dfklkkd.gz.cn 18365 219.253.140.172 moneymanagergps-id539428.citizensbank.com.kidfgk.gz.cn 18366 219.253.140.172 moneymanagergps-id273247250.citizensbank.com.etkkdr.zj.cn 18369 219.253.140.172 moneymanagergps-id63921.citizensbank.com.dfgkke.gs.cn 18383 219.253.140.172 moneymanagergps-id1076920.citizensbank.com.glooer4.gz.cn 18384 219.253.140.172 moneymanagergps-id0216402349.citizensbank.com.glooer4.gz.cn 18385 219.253.140.172 moneymanagergps-id9388169782.citizensbank.com.ajjfhef.yn.cn 18386 219.253.140.172 moneymanagergps-id48164689.citizensbank.com.ajjfhef.yn.cn 18387 219.253.140.172 moneymanagergps-id67977470.citizensbank.com.cykiony.yn.cn 18388 219.253.140.172 moneymanagergps-id4624262.citizensbank.com.ajjfhef.yn.cn 18391 219.253.140.172 moneymanagergps-id0064212.citizensbank.com.cykiony.yn.cn 18392 219.253.140.172 moneymanagergps-id627766986.citizensbank.com.ajjfhef.yn.cn 18393 219.253.140.172 moneymanagergps-id6815992.citizensbank.com.cykiony.yn.cn 18394 219.253.140.172 moneymanagergps-id44923.citizensbank.com.ajjfhef.yn.cn 18395 219.253.140.172 moneymanagergps-id647311.citizensbank.com.ajjfhef.yn.cn 18399 219.253.140.172 moneymanagergps-id70417.citizensbank.com.glooer4.gz.cn Domain registration info Phish domain Registrar ajjfhef.yn.cn www.cnnic.net.cn 9/28/2007 cykiony.yn.cn www.cnnic.net.cn 9/28/2007 dfgkke.gs.cn www.cnnic.net.cn 9/27/2007 dfklkkd.gz.cn www.cnnic.net.cn 9/27/2007 (suspended) etkkdr.zj.cn www.cnnic.net.cn 9/27/2007 glooer4.gz.cn www.cnnic.net.cn 9/25/2007 kidfgk.gz.cn www.cnnic.net.cn 9/27/2007 DNS server domain Registrar bar-bar-com.com BIZCN.COM 9/18/2007 (suspended) lo1-prt.com BIZCN.COM 9/05/2007 (suspended) vilopr.cn www.cnnic.net.cn 8/16/2007 -- AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.5
	to forum · permalink · 2007-09-30 23:54:49 ·
nwrickert sand groper Premium,MVM join:2004-09-04 Geneva, IL kudos:7 Reviews: ·AT&T U-Verse	Rock phish report Oct 01, 2007 The Monday report: 18402 58.251.87.236(10) securelogin-38988320.moneymanagergps.com.skm64.com 18418 219.253.140.172 moneymanagergps-id72348.citizensbank.com.mostreal23.cn 18419 62.141.76.247(10) securelogin-62184394.moneymanagergps.com.baz74.com 18420 219.253.140.172 moneymanagergps-id6219024024.citizensbank.com.ajjfhef.yn.cn 18421 62.141.76.247(10) securelogin-11601605.moneymanagergps.com.btm32.com 18424 62.101.170.125(10) securelogin-17525227.moneymanagergps.com.kpp18.com 18425 62.101.170.125(10) securelogin-37997282.moneymanagergps.com.klm46.com 18435 80.133.238.126(10) securelogin-51763809.moneymanagergps.com.jps81.com 18436 dns_temp_fail securelogin-50192216.moneymanagergps.com.mpr75.com 18440 76.204.245.211(10) securelogin-32419768.moneymanagergps.com.nil46.com 18442 dns_temp_fail securelogin-91667224.moneymanagergps.com.gip73.com 18443 67.166.213.41(10) securelogin-68511216.moneymanagergps.com.nil46.com 18444 67.166.213.41(10) securelogin-75342894.moneymanagergps.com.klm46.com 18445 67.166.213.41(10) securelogin-31625887.moneymanagergps.com.fij59.com 18447 219.253.140.172 moneymanagergps-id344002424.citizensbank.com.gkkj45.xz.cn 18448 67.166.213.41(10) securelogin-59135935.moneymanagergps.com.bds39.com 18449 219.253.140.172 moneymanagergps-id05603895.citizensbank.com.mmbmb.zj.cn 18450 219.253.140.172 moneymanagergps-id67008.citizensbank.com.pipec0.yn.cn 18452 67.166.213.41(10) securelogin-09100930.moneymanagergps.com.kpp18.com Domain registration info Phish domain Registrar ajjfhef.yn.cn www.cnnic.net.cn 9/28/2007 baz74.com REGISTER.COM 9/30/2007 bds39.com REGISTER.COM 9/30/2007 btm32.com REGISTER.COM 9/30/2007 fij59.com REGISTER.COM 9/30/2007 gip73.com REGISTER.COM 9/30/2007 gkkj45.xz.cn www.cnnic.net.cn 10/01/2007 jps81.com REGISTER.COM 9/30/2007 klm46.com REGISTER.COM 9/30/2007 kpp18.com REGISTER.COM 9/30/2007 mmbmb.zj.cn www.cnnic.net.cn 10/02/2007 mostreal23.cn www.cnnic.net.cn 10/01/2007 mpr75.com REGISTER.COM 9/30/2007 nil46.com REGISTER.COM 9/30/2007 pipec0.yn.cn www.cnnic.net.cn 10/01/2007 skm64.com REGISTER.COM 9/26/2007 DNS server domain Registrar bar-bar-com.com BIZCN.COM 9/18/2007 (suspended) dsluptimes.com INFO AVENUE 8/30/2007 hardensite.com INFO AVENUE 7/19/2007 polo456.com TODAYNIC.COM 9/17/2007 realtextonline.com INFO AVENUE 9/12/2007 -- AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.5
	to forum · permalink · 2007-10-01 23:49:15 ·
nwrickert sand groper Premium,MVM join:2004-09-04 Geneva, IL kudos:7 Reviews: ·AT&T U-Verse	Rock phish report Oct 02, 2007 The Tuesday report: 18461 219.253.140.172 cman_id-69739257.bbt.com.jguuer.yn.cn 18463 219.253.140.172 moneymanagergps-id654573.citizensbank.com.mmbmb.zj.cn 18464 78.51.66.25(10) securelogin-68732121.moneymanagergps.com.vsa78.com 18470 78.51.66.25(10) securelogin-99708833.moneymanagergps.com.bnt73.com 18471 78.51.66.25(10) securelogin-55057559.moneymanagergps.com.knui1.com 18472 219.253.140.172 id-216568.citizensbankmoneymanagergps.com.metroid5.cn 18473 62.101.170.125(10) securelogin-30589421.moneymanagergps.com.btm32.com 18474 219.253.140.172 moneymanagergps-id7855243768.citizensbank.com.pip3ec.yn.cn 18477 62.101.170.125(10) securelogin-31071867.moneymanagergps.com.cmt38.com 18479 74.13.153.20(10) securelogin-94191439.moneymanagergps.com.bnt73.com 18480 74.13.153.20(10) securelogin-48506969.moneymanagergps.com.lsv13.com 18483 219.253.140.172 moneymanagergps-id9918637379.citizensbank.com.dlliptool.cn 18484 219.253.140.172 cman_id-33742.bbt.com.dkkwje3.hn 18485 24.57.85.74(10) securelogin-98950041.moneymanagergps.com.dls84.com 18486 219.253.140.172 id-8686628.citizensbankmoneymanagergps.com.vnjjfrt.in 18487 219.253.140.172 cman_id-00725.bbt.com.opkrie.in 18488 219.253.140.172 cman_id-74883.bbt.com.miloe1r.gz.cn 18489 219.253.140.172 id-88102507.citizensbankmoneymanagergps.com.affer66.in 18490 219.253.140.172 cman_id-6053175.bbt.com.otyee.in 18491 219.253.140.172 id-078602284.citizensbankmoneymanagergps.com.otyee.in 18492 219.253.140.172 id-06978820.citizensbankmoneymanagergps.com.bk4ft.zj.cn 18493 219.253.140.172 id-9855881831.citizensbankmoneymanagergps.com.glooe.gx.cn 18514 58.140.87.64(10) securelogin-95932870.moneymanagergps.com.int29.com 18516 58.140.87.64(10) securelogin-40771980.moneymanagergps.com.vsa78.com 18526 58.141.31.27(10) securelogin-16560433.moneymanagergps.com.pmt38.com 18528 58.141.31.27(10) securelogin-83252810.moneymanagergps.com.tns76.com 18529 219.253.140.172 id-90421.citizensbankmoneymanagergps.com.kdiie.mn 18530 219.253.140.172 id-43142.citizensbankmoneymanagergps.com.uw11we.in Domain registration info Phish domain Registrar affer66.in Good Luck Domains 10/02/2007 bk4ft.zj.cn www.cnnic.net.cn 10/02/2007 bnt73.com REGISTER.COM 10/01/2007 (cancelled) btm32.com REGISTER.COM 9/30/2007 cmt38.com REGISTER.COM 10/01/2007 dkkwje3.hn NamesBeyond 10/01/2007 dlliptool.cn unknown 10/01/2007? (cancelled) dls84.com REGISTER.COM 10/01/2007 glooe.gx.cn www.cnnic.net.cn 10/02/2007 int29.com REGISTER.COM 10/01/2007 jguuer.yn.cn unknown 9/30/2007? (cancelled) kdiie.mn unknown 10/01/2007? knui1.com REGISTER.COM 10/01/2007 lsv13.com REGISTER.COM 10/01/2007 metroid5.cn unknown 10/01/2007? (cancelled?) miloe1r.gz.cn www.cnnic.net.cn 10/02/2007 mmbmb.zj.cn www.cnnic.net.cn 10/02/2007 (cancelled) opkrie.in Good Luck Domains 10/01/2007 otyee.in Good Luck Domains 10/01/2007 pip3ec.yn.cn unknown 10/01/2007? (cancelled?) pmt38.com REGISTER.COM 10/01/2007 tns76.com REGISTER.COM 10/01/2007 uw11we.in Good Luck Domains 10/01/2007 vnjjfrt.in Good Luck Domains 10/02/2007 vsa78.com REGISTER.COM 9/30/2007 DNS server domain Registrar abc-tgc.com REGISTER.COM 9/11/2007 bar-bar-com.com BIZCN.COM 9/18/2007 (cancelled) dsluptimes.com INFO AVENUE 8/30/2007 realtextonline.com INFO AVENUE 9/12/2007 -- AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.5
	to forum · permalink · 2007-10-03 00:15:54 ·

Broadband Tech > Security > Scam and Phishbusters > Rock phish information - continued

Rock phish report Sep 14, 2007

Rock phish report Sep 15, 2007

Rock phish report Sep 16, 2007

Rock phish report Sep 17, 2007

Rock phish report Sep 18, 2007

Rock phish report Sep 19, 2007

Rock phish report Sep 20, 2007

Rock phish report Sep 21, 2007

Rock phish report Sep 22, 2007

Rock phish report Sep 23, 2007

Rock phish report Sep 24, 2007

Rock phish report Sep 25, 2007

Rock phish report Sep 26, 2007

Rock phish report Sep 27, 2007

Rock phish report Sep 28, 2007

Rock phish report Sep 29, 2007

Rock phish report Sep 30, 2007

Rock phish report Oct 01, 2007

Rock phish report Oct 02, 2007