 nwrickertsand groperPremium,MVM
join:2004-09-04
Geneva, IL
kudos:7
 ·AT&T U-Verse
| reply to nwrickert
Rock phish report Oct 05, 2007The Friday report:
18646 24.224.187.118(10) securelogin-51048669.moneymanagergps.com.fls87.com
18647 24.224.187.118(10) securelogin-05053156.moneymanagergps.com.bkn49.com
18657 200.77.213.15 id-149962.citizensbankmoneymanagergps.com.elrlote.hk
18660 200.77.213.15 id-57546.citizensbankmoneymanagergps.com.gkiier.hk
18661 200.77.213.15 id-89996.citizensbankmoneymanagergps.com.nookrtt.hk
18662 200.77.213.15 id-390091981.citizensbankmoneymanagergps.com.nafert.in
18663 200.77.213.15 hiring-id0646153048.monster.com.jack666.in
18664 200.77.213.15 id-3369041666.citizensbankmoneymanagergps.com.glooe.gx.cn
18665 200.77.213.15 id-190781260.citizensbankmoneymanagergps.com.miloe4r.gz.cn
18666 NXDOMAIN id-5992386005.citizensbankmoneymanagergps.com.neruiw.hn
18667 NXDOMAIN id-6555219.citizensbankmoneymanagergps.com.oio333.yn.cn
18668 200.77.213.15 id-429228838.citizensbankmoneymanagergps.com.letoer.hn
18669 NXDOMAIN id-325307398.citizensbankmoneymanagergps.com.bnjdk2.gz.cn
Domain registration info
Phish domain Registrar
bkn49.com REGISTER.COM 10/02/2007
bnjdk2.gz.cn unknown 10/04/2007? (cancelled?)
elrlote.hk HKDNR 10/05/2007
fls87.com REGISTER.COM 10/02/2007
gkiier.hk HKDNR 10/05/2007
glooe.gx.cn www.cnnic.net.cn 10/02/2007
jack666.in Good Luck Domains 10/04/2007
letoer.hn NamesBeyond 10/05/2007
miloe4r.gz.cn www.cnnic.net.cn 10/03/2007
nafert.in unknown 10/04/2007? (cancelled?)
neruiw.hn NamesBeyond 10/05/2007
nookrtt.hk HKDNR 10/05/2007
oio333.yn.cn unknown 10/04/2007? (cancelled?)
DNS server domain Registrar
bar-bar-com.com BIZCN.COM 9/18/2007 (cancelled)
hardensite.com INFO AVENUE 7/19/2007
lo1-prt.com BIZCN.COM 9/05/2007 (cancelled)
maritanna.com ESTDOMAINS 8/14/2007 (suspended)
--
AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.5 |
|
nwrickertsand groperPremium,MVM
join:2004-09-04
Geneva, IL
kudos:7 Reviews:
·AT&T U-Verse
| Rock phish report Oct 06, 2007The Saturday report:
18685 200.77.213.15 id-976894.citizensbankmoneymanagergps.com.hekirty.net.nz
Domain registration info
Phish domain Registrar
hekirty.net.nz Aust Domains 10/06/2007
DNS server domain Registrar
bar-bar-com.com BIZCN.COM 9/18/2007 (cancelled)
--
AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.5 |
|
nwrickertsand groperPremium,MVM
join:2004-09-04
Geneva, IL
kudos:7 Reviews:
·AT&T U-Verse
1 edit | Rock phish report Oct 07, 2007The report for Sunday:
18713 200.77.213.15 id-3189516343.citizensbankmoneymanagergps.com.gfstepid.ch
18716 200.77.213.15 id-93285976.citizensbankmoneymanagergps.com.oitiert.hk
18717 200.77.213.15 hiring-id142055.monster.com.bk4ft.zj.cn
18718 200.77.213.15 id-964675171.citizensbankmoneymanagergps.com.ddmode.ch
18719 200.77.213.15 id-7754430833.citizensbankmoneymanagergps.com.miloe1r.gz.cn
18720 200.77.213.15 hiring-id409920490.monster.com.bk4ft.zj.cn
18721 200.77.213.15 id-2575465.citizensbankmoneymanagergps.com.nookrtt.hk
18722 200.77.213.15 hiring-id2409542.monster.com.fiueur.hk
18724 200.77.213.15 hiring-id087496.monster.com.miloe5r.gz.cn
18725 200.77.213.15 hiring-id09619399.monster.com.dofoer.hk
18726 200.77.213.15 id-2161655.citizensbankmoneymanagergps.com.fiueur.hk
18727 200.77.213.15 id-3218126126.citizensbankmoneymanagergps.com.elrlote.hk
18728 200.77.213.15 id-7007860427.citizensbankmoneymanagergps.com.kfiiwrf.hk
18729 200.77.213.15 hiring-id2101785.monster.com.lciokei.co.nz
18730 dns_temp_fail hiring-id5055797.monster.com.joiirr.hk
18731 200.77.213.15 hiring-id79469.monster.com.feprre3.hk
18732 200.77.213.15 id-892066240.citizensbankmoneymanagergps.com.hekirty.org.nz
18733 200.77.213.15 id-8096691.citizensbankmoneymanagergps.com.timwer.hk
18734 200.77.213.15 id-6259831935.citizensbankmoneymanagergps.com.miloe3r.gz.cn
18735 200.77.213.15 id-93486117.citizensbankmoneymanagergps.com.looeort.hk
18736 200.77.213.15 id-764639.citizensbankmoneymanagergps.com.kfiiwrf.hk
18737 NXDOMAIN id-395826.citizensbankmoneymanagergps.com.hekirty.net.nz
18738 200.77.213.15 id-222419883.citizensbankmoneymanagergps.com.nookrtt.hk
18739 200.77.213.15 id-300180.citizensbankmoneymanagergps.com.elriite.hk
18747 200.77.213.15 id-11533277.citizensbankmoneymanagergps.com.dottop1.pl
18748 200.77.213.15 id-48157.citizensbankmoneymanagergps.com.danfoe.bz
18749 200.77.213.15 hiring-id51546551.monster.com.lotofid.ch
18750 200.77.213.15 id-560667472.citizensbankmoneymanagergps.com.joiirr.hk
18751 200.77.213.15 id-191887.citizensbankmoneymanagergps.com.dottop1web.pl
18753 200.77.213.15 id-98831334.citizensbankmoneymanagergps.com.miloe5r.gz.cn
Domain registration info
Phish domain Registrar
bk4ft.zj.cn www.cnnic.net.cn 10/02/2007
danfoe.bz NamesBeyond 10/05/2007
ddmode.ch www.switch.ch 10/06/2007?
dofoer.hk HKDNR 10/06/2007
dottop1.pl AZ.pl 10/06/2007
dottop1web.pl AZ.pl 10/06/2007
elriite.hk HKDNR 10/05/2007
elrlote.hk HKDNR 10/05/2007
feprre3.hk HKDNR 10/06/2007
fiueur.hk HKDNR 10/06/2007
gfstepid.ch www.switch.ch 10/06/2007?
hekirty.net.nz Aust Domains 10/06/2007 (suspended?)
hekirty.org.nz Aust Domains 10/06/2007 (suspended?)
joiirr.hk HKDNR 10/06/2007
kfiiwrf.hk HKDNR 10/05/2007
lciokei.co.nz Aust Domains 10/06/2007 (suspended?)
looeort.hk HKDNR 10/05/2007
lotofid.ch www.switch.ch 10/06/2007?
miloe1r.gz.cn www.cnnic.net.cn 10/02/2007
miloe3r.gz.cn www.cnnic.net.cn 10/03/2007
miloe5r.gz.cn www.cnnic.net.cn 10/03/2007
nookrtt.hk HKDNR 10/05/2007
oitiert.hk HKDNR 10/05/2007
timwer.hk HKDNR 10/06/2007
DNS server domain Registrar
bar-bar-com.com BIZCN.COM 9/18/2007 (cancelled)
lo1-prt.com BIZCN.COM 9/05/2007 (cancelled)
maritanna.com ESTDOMAINS 8/14/2007 (suspended)
polo456.com TODAYNIC.COM 9/17/2007
(edit: correct date on subtitle)
--
AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.5 |
|
nwrickertsand groperPremium,MVM
join:2004-09-04
Geneva, IL
kudos:7 Reviews:
·AT&T U-Verse
| Rock phish report Oct 08, 2007The Monday report:
18760 200.77.213.15 hiring-id97122.monster.com.lciokei.co.nz
18771 200.77.213.15 hiring-id86019.monster.com.dottop1web.pl
18772 200.77.213.15 hiring-id6598277.monster.com.gotouin.li
18773 200.77.213.15 id-98586641.citizensbankmoneymanagergps.com.wwwmode.cn
18774 200.77.213.15 id-48647869.citizensbankmoneymanagergps.com.juferw.hk
18775 200.77.213.15 hiring-id16765182.monster.com.kfiiwrf.hk
18776 200.77.213.15 id-362711.citizensbankmoneymanagergps.com.dofoer.hk
18777 200.77.213.15 hiring-id749632463.monster.com.elriite.hk
18778 200.77.213.15 hiring-id731384500.monster.com.dottop1web.pl
18779 200.77.213.15 hiring-id03947779.monster.com.gfstepid.li
18780 200.77.213.15 hiring-id438001715.monster.com.pontnet5.cn
18781 200.77.213.15 hiring-id653966971.monster.com.dofoer.hk
18782 200.77.213.15 hiring-id0860001122.monster.com.lotofid.li
18789 200.77.213.15 hiring-id4058357920.monster.com.jfuuer.hk
18790 200.77.213.15 id-56297648.citizensbankmoneymanagergps.com.roiier.hk
18791 200.77.213.15 id-472844412.citizensbankmoneymanagergps.com.toolnns.cn
18792 200.77.213.15 hiring-id6240540.monster.com.kfiiwrf.hk
18793 200.77.213.15 hiring-id331136.monster.com.soloip3.ch
Domain registration info
Phish domain Registrar
dofoer.hk HKDNR 10/06/2007
dottop1web.pl AZ.pl 10/06/2007
elriite.hk HKDNR 10/05/2007
gfstepid.li www.switch.ch 10/06/2007?
gotouin.li www.switch.ch 10/06/2007?
jfuuer.hk HKDNR 10/08/2007
juferw.hk HKDNR 10/05/2007
kfiiwrf.hk HKDNR 10/05/2007 (suspended)
lciokei.co.nz Aust Domains 10/06/2007 (suspended?)
lotofid.li www.switch.ch 10/06/2007?
pontnet5.cn www.cnnic.net.cn 10/06/2007
roiier.hk HKDNR 10/08/2007
soloip3.ch www.switch.ch 10/06/2007? (cancelled)
toolnns.cn www.cnnic.net.cn 10/06/2007
wwwmode.cn www.cnnic.net.cn 10/06/2007
DNS server domain Registrar
bar-bar-com.com BIZCN.COM 9/18/2007 (cancelled)
dottop1web.pl AZ.pl 10/06/2007
lo1-prt.com BIZCN.COM 9/05/2007 (cancelled)
maritanna.com ESTDOMAINS 8/14/2007 (suspended)
polo456.com TODAYNIC.COM 9/17/2007
--
AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.5 |
|
nwrickertsand groperPremium,MVM
join:2004-09-04
Geneva, IL
kudos:7 Reviews:
·AT&T U-Verse
| Rock phish report Oct 09, 2007The Tuesday report:
18808 200.77.213.15 id-0449314927.citizensbankmoneymanagergps.com.loploper.hk
18809 200.77.213.15 id-98510254.citizensbankmoneymanagergps.com.roiier.hk
18810 200.77.213.15 hiring-id962192.monster.com.kkkmode.cn
18811 200.77.213.15 hiring-id476093.monster.com.kveit4.co.nz
18812 200.77.213.15 hiring-id8458026.monster.com.dottop1.pl
18813 200.77.213.15 hiring-id59018330.monster.com.edottop1.pl
18814 200.77.213.15 id-61045424.citizensbankmoneymanagergps.com.pontnet5.cn
18815 NXDOMAIN hiring-id195935.monster.com.soloip3.ch
18816 200.77.213.15 id-632915.citizensbankmoneymanagergps.com.edottop1.pl
18817 200.77.213.15 hiring-id4436085591.monster.com.jjmode.cn
18818 NXDOMAIN hiring-id61236.monster.com.verpo3.hk
18825 219.253.140.172 id-02047.citizensbankmoneymanagergps.com.edottop1.pl
18826 219.253.140.172 hiring-id21827.monster.com.krii2k.hk
18830 24.7.36.14(10) user09992843.hnbview.huntington.webcm.logon.abs48.com
Domain registration info
Phish domain Registrar
abs48.com REGISTER.COM 10/07/2007
dottop1.pl AZ.pl 10/06/2007
edottop1.pl AZ.pl 10/08/2007
jjmode.cn www.cnnic.net.cn 10/06/2007
kkkmode.cn www.cnnic.net.cn 10/06/2007
krii2k.hk HKDNR 10/08/2007 (suspended)
kveit4.co.nz unknown 10/07/2007? (cancelled?)
loploper.hk HKDNR 10/08/2007
pontnet5.cn www.cnnic.net.cn 10/06/2007
roiier.hk HKDNR 10/08/2007 (suspended)
soloip3.ch www.switch.ch 10/06/2007? (cancelled)
verpo3.hk HKDNR 10/06/2007 (suspended)
DNS server domain Registrar
abc-tgc.com REGISTER.COM 9/11/2007
bar-bar-com.com BIZCN.COM 9/18/2007 (cancelled)
dottop1web.pl AZ.pl 10/06/2007
lo1-prt.com BIZCN.COM 9/05/2007 (cancelled)
polo456.com TODAYNIC.COM 9/17/2007
--
AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.5 |
|
nwrickertsand groperPremium,MVM
join:2004-09-04
Geneva, IL
kudos:7 Reviews:
·AT&T U-Verse
| Rock phish report Oct 10, 2007The Wednesday report:
18835 NXDOMAIN www.citizensbankmoneymanagergps.com.cid88768.oirooe.hk
18853 221.0.188.8 www.citizensbankmoneymanagergps.com.site243644.brrlop15.hk
18856 63.245.155.222(10) user71031373.hnbview.huntington.webcm.logon.svb32.com
18858 63.245.155.222(10) securelogin-62783300.moneymanagergps.com.skr37.com
18865 221.0.188.8 id-704182746.citizensbankmoneymanagergps.com.gocti.hk
Domain registration info
Phish domain Registrar
brrlop15.hk HKDNR 10/10/2007
gocti.hk HKDNR 10/09/2007
oirooe.hk HKDNR 10/08/2007 (suspended)
skr37.com REGISTER.COM 10/02/2007
svb32.com REGISTER.COM 10/02/2007
DNS server domain Registrar
abc-tgc.com REGISTER.COM 9/11/2007
bar-bar-com.com BIZCN.COM 9/18/2007 (cancelled)
realtextonline.com INFO AVENUE 9/12/2007
--
AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.5 |
|
nwrickertsand groperPremium,MVM
join:2004-09-04
Geneva, IL
kudos:7 Reviews:
·AT&T U-Verse
| Rock phish report Oct 11, 2007The report for Thursday:
18883 dns_temp_fail securelogin-16540200.moneymanagergps.com.sim38.com
18885 67.166.213.41(10) securelogin-34215094.moneymanagergps.com.pdv56.com
18900 63.245.155.222(10) securelogin-27270117.moneymanagergps.com.gbw78.com
18901 67.166.213.41(10) securelogin-16595808.moneymanagergps.com.bms43.com
18903 67.166.213.41(10) securelogin-37792731.moneymanagergps.com.bsc98.com
18909 61.223.163.17(10) securelogin-98252807.moneymanagergps.com.bsc98.com
Domain registration info
Phish domain Registrar
bms43.com REGISTER.COM 10/07/2007
bsc98.com REGISTER.COM 10/07/2007
gbw78.com REGISTER.COM 10/07/2007
pdv56.com REGISTER.COM 10/07/2007
sim38.com REGISTER.COM 10/02/2007
DNS server domain Registrar
abc-tgc.com REGISTER.COM 9/11/2007
realtextonline.com INFO AVENUE 9/12/2007
--
AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.5 |
|
nwrickertsand groperPremium,MVM
join:2004-09-04
Geneva, IL
kudos:7 Reviews:
·AT&T U-Verse
| Rock phish report Oct 12, 2007The Friday report:
18914 63.245.155.222(10) securelogin-77367175.moneymanagergps.com.sis32.com
18921 70.234.210.156(10) securelogin-53676253.moneymanagergps.com.ars34.com
18923 24.226.197.117(10) securelogin-81841773.moneymanagergps.com.ars34.com
18924 221.12.43.189 rbsdigital-id003763000.rbs.co.uk.baccet3.hk
18925 209.62.20.175 securelogin-15094602.moneymanagergps.com.amn49.com
18926 dns_temp_fail securelogin-40061945.moneymanagergps.com.rpb58.com
Domain registration info
Phish domain Registrar
amn49.com REGISTER.COM 10/02/2007
ars34.com REGISTER.COM 10/07/2007
baccet3.hk HKDNR 10/11/2007
rpb58.com REGISTER.COM 10/02/2007
sis32.com REGISTER.COM 10/07/2007
DNS server domain Registrar
abc-tgc.com REGISTER.COM 9/11/2007
bar-bar-com.com BIZCN.COM 9/18/2007 (cancelled)
BNMQ.COM RESELLERCLUB 8/03/2004 (in use by rockphish)
realtextonline.com INFO AVENUE 9/12/2007
--
AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.5 |
|
nwrickertsand groperPremium,MVM
join:2004-09-04
Geneva, IL
kudos:7 Reviews:
·AT&T U-Verse
| Rock phish report Oct 15, 2007There are no reports for Saturday or Sunday (Oct 13,14), because there were no rockphish submitted to phishtracker.
I'll also comment on "bar-bar-com.com". That domain was registered by rockphish for DNS use. The domain was suspended on Sept 20 (NS records removed from DNS servers), and cancelled a few days later ("whois" data removed). However, they failed to remove the glue records (the A records for t1.bar-bar-com and t2.bar-bar-com, so the top level domain servers for ".COM" are still giving out IP addresses for those two hostnames. This is allowing rockphish to continue to use those as DNS servers. They have registered domains as recently as Oct 12 that use those two DNS servers.
Here is the Monday report:
18987 219.253.140.172 onlinesession-540651.natwest.com.g4iiirrr.xz.cn
19001 71.192.111.168(10) securelogin-25524476.moneymanagergps.com.mns42.com
19002 NXDOMAIN hiring-id6964486.monster.com.naic3er.xz.cn
19003 NXDOMAIN hiring-id1257307821.monster.com.chival1.xz.cn
19004 NXDOMAIN hiring-id776462695.monster.com.chival4.xz.cn
19005 219.253.140.172 hiring-id69112192.monster.com.go1oliv.xz.cn
19006 219.253.140.172 hiring-id919143352.monster.com.deeper2.gx.cn
19007 68.55.185.103(10) securelogin-51674482.moneymanagergps.com.mns42.com
19015 24.7.36.14(10) securelogin-09841061.moneymanagergps.com.jus83.com
19016 24.7.36.14(10) securelogin-53896845.moneymanagergps.com.fks18.com
19017 219.253.140.172 www.citizensbankmoneymanagergps.com.site327.deeper3.gx.cn
Domain registration info
Phish domain Registrar
chival1.xz.cn unknown 10/14/2007?
chival4.xz.cn unknown 10/14/2007?
deeper2.gx.cn www.cnnic.net.cn 10/12/2007
deeper3.gx.cn www.cnnic.net.cn 10/12/2007
fks18.com REGISTER.COM 10/14/2007
g4iiirrr.xz.cn www.cnnic.net.cn 10/12/2007
go1oliv.xz.cn www.cnnic.net.cn 10/12/2007
jus83.com REGISTER.COM 10/14/2007
mns42.com REGISTER.COM 10/14/2007
naic3er.xz.cn unknown 10/14/2007?
DNS server domain Registrar
abc-tgc.com REGISTER.COM 9/11/2007
bar-bar-com.com BIZCN.COM 9/18/2007 (cancelled)
--
AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.5 |
|
|
|
nwrickertsand groperPremium,MVM
join:2004-09-04
Geneva, IL
kudos:7 Reviews:
·AT&T U-Verse
| Rock phish report Oct 16, 2007The report for Tuesday:
19039 dns_temp_fail securelogin-57033285.moneymanagergps.com.bfg65.com
19040 dns_temp_fail securelogin-60844338.moneymanagergps.com.bib49.com
19041 dns_temp_fail securelogin-65581548.moneymanagergps.com.bib49.com
19043 dns_temp_fail securelogin-14577949.moneymanagergps.com.tkb54.com
19048 dns_temp_fail securelogin-45277814.moneymanagergps.com.bfg65.com
19050 NXDOMAIN hiring-id5678057380.monster.com.tomder2.xz.cn
19051 dns_temp_fail securelogin-06522666.moneymanagergps.com.bib49.com
19052 dns_temp_fail securelogin-03273562.moneymanagergps.com.fks18.com
19060 79.212.197.135(10) e-access65383780.compassbank.com.ibscompass.cmserver.welcome.default.verify.cfm.xtr48.biz
19066 24.147.48.162(10) e-access59346371.compassbank.com.ibscompass.cmserver.welcome.default.verify.cfm.trf54.biz
19067 24.147.48.162(10) e-access07345258.compassbank.com.ibscompass.cmserver.welcome.default.verify.cfm.xtr48.biz
19070 24.147.48.162(10) e-access32667923.compassbank.com.ibscompass.cmserver.welcome.default.verify.cfm.ams76.us
19080 24.7.36.14(10) e-access07448147.compassbank.com.ibscompass.cmserver.welcome.default.verify.cfm.bts48.info
19081 NXDOMAIN hiring-id976865311.monster.com.a382415.xz.cn
19082 211.60.129.140 hiring-id48878524.monster.com.deeper3.gx.cn
Domain registration info
Phish domain Registrar
a382415.xz.cn www.cnnic.net.cn 10/11/2007
ams76.us REGISTER.COM 10/15/2007
bfg65.com REGISTER.COM 10/14/2007
bib49.com REGISTER.COM 10/14/2007
bts48.info REGISTER.COM 10/15/2007
deeper3.gx.cn www.cnnic.net.cn 10/12/2007
fks18.com REGISTER.COM 10/14/2007
tkb54.com REGISTER.COM 10/14/2007
tomder2.xz.cn unknown 10/14/2007? (cancelled?)
trf54.biz REGISTER.COM 10/15/2007
xtr48.biz REGISTER.COM 10/15/2007
DNS server domain Registrar
abc-tgc.com REGISTER.COM 9/11/2007
bar-bar-com.com BIZCN.COM 9/18/2007 (cancelled)
dinovod.com TODAYNIC.COM 10/16/2007
--
AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.5 |
|
nwrickertsand groperPremium,MVM
join:2004-09-04
Geneva, IL
kudos:7 Reviews:
·AT&T U-Verse
| Rock phish report Oct 17, 2007The Merril Lynch phish below each have 3 distinct phish URLs. Hence each is listed 3 times.
Here is the Wednesday report:
19083 24.7.36.14(10) e-access54033417.compassbank.com.ibscompass.cmserver.welcome.default.verify.cfm.rtm64.info
19103 121.247.93.148 e-access49673960.compassbank.com.ibscompass.cmserver.welcome.default.verify.cfm.fgt79.biz
19104 64.131.251.173 e-access04312350.compassbank.com.ibscompass.cmserver.welcome.default.verify.cfm.ams76.us
19105 82.53.90.126 e-access49088767.compassbank.com.ibscompass.cmserver.welcome.default.verify.cfm.uip32.info
19106 64.131.251.173 e-access79477928.compassbank.com.ibscompass.cmserver.welcome.default.verify.cfm.mnr37.us
19110 211.60.129.140 hiring-id7146560180.monster.com.portland5.xz.cn
19116 67.166.209.253(10) wcma.businesscenter.bcprivate.asp68662234.wcmaloginea.aspx.tms72.info
19116 67.166.209.253(10) wcma.businesscenter.bcprivate.asp62124676.wcmaloginea.aspx.ind76.info
19116 58.39.68.70(10) wcma.businesscenter.bcprivate.asp02851988.wcmaloginea.aspx.fds32.net
19117 58.39.68.70(10) wcma.businesscenter.bcprivate.asp50876787.wcmaloginea.aspx.fds32.net
19117 58.39.68.70(10) wcma.businesscenter.bcprivate.asp40859746.wcmaloginea.aspx.knr57.biz
19117 58.39.68.70(10) wcma.businesscenter.bcprivate.asp18561442.wcmaloginea.aspx.mdq28.biz
19144 67.166.209.253(10) wcma.businesscenter.bcprivate.asp30395914.wcmaloginea.aspx.ucx43.us
19144 67.166.209.253(10) wcma.businesscenter.bcprivate.asp17048739.wcmaloginea.aspx.ucx43.us
19144 67.166.209.253(10) wcma.businesscenter.bcprivate.asp15474189.wcmaloginea.aspx.ucx43.us
19145 58.39.68.70(10) wcma.businesscenter.bcprivate.asp53567270.wcmaloginea.aspx.tms72.info
19145 58.39.68.70(10) wcma.businesscenter.bcprivate.asp69683557.wcmaloginea.aspx.ntr55.biz
19145 58.39.68.70(10) wcma.businesscenter.bcprivate.asp32809992.wcmaloginea.aspx.rfc92.info
19146 phish_is_down wcma.businesscenter.bcprivate.asp53811061.wcmaloginea.aspx.rsf39.us
19146 58.39.68.70(10) wcma.businesscenter.bcprivate.asp95258794.wcmaloginea.aspx.gwy87.net
19146 58.39.68.70(10) wcma.businesscenter.bcprivate.asp81865619.wcmaloginea.aspx.knr57.biz
19147 58.39.68.70(10) wcma.businesscenter.bcprivate.asp77923633.wcmaloginea.aspx.ntr55.biz
19147 58.39.68.70(10) wcma.businesscenter.bcprivate.asp40485483.wcmaloginea.aspx.nbt68.us
19147 58.39.68.70(10) wcma.businesscenter.bcprivate.asp08549393.wcmaloginea.aspx.nbt68.us
19148 58.39.68.70(10) wcma.businesscenter.bcprivate.asp65897775.wcmaloginea.aspx.knr57.biz
19148 58.39.68.70(10) wcma.businesscenter.bcprivate.asp59158011.wcmaloginea.aspx.ind76.info
19148 58.39.68.70(10) wcma.businesscenter.bcprivate.asp81110168.wcmaloginea.aspx.tms72.info
19149 85.105.182.6 hiring-id954472813.monster.com.noiptool.cn
19150 85.105.182.6 hiring-id19126492.monster.com.reer34.xz.cn
19151 85.105.182.6 hiring-id50042894.monster.com.girafa.hk
19152 85.105.182.6 hiring-id75393726.monster.com.111shtorm.cn
Domain registration info
Phish domain Registrar
111shtorm.cn www.cnnic.net.cn 10/11/2007
ams76.us REGISTER.COM 10/15/2007
fds32.net REGISTER.COM 10/16/2007 (suspended)
fgt79.biz REGISTER.COM 10/15/2007
girafa.hk HKDNR 10/16/2007
gwy87.net REGISTER.COM 10/16/2007 (suspended)
ind76.info REGISTER.COM 10/16/2007 (suspended)
knr57.biz REGISTER.COM 10/16/2007 (suspended)
mdq28.biz REGISTER.COM 10/16/2007 (suspended)
mnr37.us REGISTER.COM 10/15/2007
nbt68.us REGISTER.COM 10/16/2007 (suspended)
noiptool.cn www.cnnic.net.cn 10/11/2007
ntr55.biz REGISTER.COM 10/16/2007 (suspended)
portland5.xz.cn unknown 10/15/2007? (cancelled)
reer34.xz.cn unknown 10/15/2007? (cancelled)
rfc92.info REGISTER.COM 10/16/2007 (suspended)
rsf39.us REGISTER.COM 10/16/2007 (suspended)
rtm64.info REGISTER.COM 10/15/2007
tms72.info REGISTER.COM 10/16/2007 (suspended)
ucx43.us REGISTER.COM 10/16/2007
uip32.info REGISTER.COM 10/15/2007
DNS server domain Registrar
2ndzero.com INFO AVENUE 10/06/2007
abc-tgc.com REGISTER.COM 9/11/2007
bar-bar-com.com BIZCN.COM 9/18/2007 (cancelled)
bestlightyear.com REGISTER.COM 10/11/2007
dinovod.com TODAYNIC.COM 10/16/2007
polo456.com TODAYNIC.COM 9/17/2007
realtextonline.com INFO AVENUE 9/12/2007
--
AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.5 |
|
nwrickertsand groperPremium,MVM
join:2004-09-04
Geneva, IL
kudos:7 Reviews:
·AT&T U-Verse
| Rock phish report Oct 18, 2007Again, there are 3 lines for each Merrill Lynch phish, due to 3 urls in the phish email. The registrar has suspended or cancelled the domains used for all Merrill Lynch phish.
Here is the report for Thursday:
19156 68.85.133.53(10) wcma.businesscenter.bcprivate.asp40496449.wcmaloginea.aspx.ucx43.us
19156 68.85.133.53(10) wcma.businesscenter.bcprivate.asp90452945.wcmaloginea.aspx.ucx43.us
19156 68.85.133.53(10) wcma.businesscenter.bcprivate.asp90860921.wcmaloginea.aspx.ucx43.us
19160 68.85.133.53(10) wcma.businesscenter.bcprivate.asp19200766.wcmaloginea.aspx.ucx43.us
19160 68.85.133.53(10) wcma.businesscenter.bcprivate.asp02133381.wcmaloginea.aspx.ucx43.us
19160 68.85.133.53(10) wcma.businesscenter.bcprivate.asp86684504.wcmaloginea.aspx.ucx43.us
19164 68.85.133.53(10) wcma.businesscenter.bcprivate.asp90444524.wcmaloginea.aspx.ojs73.com
19164 68.85.133.53(10) wcma.businesscenter.bcprivate.asp71993139.wcmaloginea.aspx.ojs73.com
19164 68.85.133.53(10) wcma.businesscenter.bcprivate.asp95310048.wcmaloginea.aspx.brd58.com
19165 68.85.133.53(10) wcma.businesscenter.bcprivate.asp03417610.wcmaloginea.aspx.gnw49.com
19165 68.85.133.53(10) wcma.businesscenter.bcprivate.asp47352096.wcmaloginea.aspx.dse43.com
19165 68.85.133.53(10) wcma.businesscenter.bcprivate.asp82506613.wcmaloginea.aspx.gnw49.com
19168 24.7.36.14(10) wcma.businesscenter.bcprivate.asp56057309.wcmaloginea.aspx.trc43.net
19168 24.7.36.14(10) wcma.businesscenter.bcprivate.asp60357243.wcmaloginea.aspx.trc43.net
19168 24.7.36.14(10) wcma.businesscenter.bcprivate.asp91918864.wcmaloginea.aspx.lkh21.net
19170 24.7.36.14(10) wcma.businesscenter.bcprivate.asp47646814.wcmaloginea.aspx.dse43.com
19170 24.7.36.14(10) wcma.businesscenter.bcprivate.asp06142062.wcmaloginea.aspx.dse43.com
19170 24.7.36.14(10) wcma.businesscenter.bcprivate.asp25829160.wcmaloginea.aspx.dse43.com
19175 81.181.175.39(10) wcma.businesscenter.bcprivate.asp69447226.wcmaloginea.aspx.gvs86.net
19175 81.181.175.39(10) wcma.businesscenter.bcprivate.asp23998546.wcmaloginea.aspx.qsr93.net
19175 81.181.175.39(10) wcma.businesscenter.bcprivate.asp83028608.wcmaloginea.aspx.gvs86.net
19190 NXDOMAIN wcma.businesscenter.bcprivate.asp97243412.wcmaloginea.aspx.ucx43.us
19190 NXDOMAIN wcma.businesscenter.bcprivate.asp84197879.wcmaloginea.aspx.ucx43.us
19190 NXDOMAIN wcma.businesscenter.bcprivate.asp93590149.wcmaloginea.aspx.ucx43.us
19191 NXDOMAIN wcma.businesscenter.bcprivate.asp56727378.wcmaloginea.aspx.dse43.com
19191 NXDOMAIN wcma.businesscenter.bcprivate.asp50394519.wcmaloginea.aspx.dse43.com
19191 79.112.29.32(10) wcma.businesscenter.bcprivate.asp95499647.wcmaloginea.aspx.gnw49.com
19192 85.105.182.6 hiring-id285268037.monster.com.orocin3.gx.cn
19193 dns_temp_fail wcma.businesscenter.bcprivate.asp82618557.wcmaloginea.aspx.45gsd.com
19193 dns_temp_fail wcma.businesscenter.bcprivate.asp57581352.wcmaloginea.aspx.45gsd.com
19193 dns_temp_fail wcma.businesscenter.bcprivate.asp89601745.wcmaloginea.aspx.try42.com
19196 79.178.21.85(10) wcma.businesscenter.bcprivate.asp83216809.wcmaloginea.aspx.urd68.biz
19196 79.178.21.85(10) wcma.businesscenter.bcprivate.asp71285567.wcmaloginea.aspx.jda53.biz
19196 79.178.21.85(10) wcma.businesscenter.bcprivate.asp15432351.wcmaloginea.aspx.urd68.biz
19198 79.178.21.85(10) wcma.businesscenter.bcprivate.asp81267939.wcmaloginea.aspx.yfw79.biz
19198 79.178.21.85(10) wcma.businesscenter.bcprivate.asp49747275.wcmaloginea.aspx.jvq56.biz
19198 79.178.21.85(10) wcma.businesscenter.bcprivate.asp56242990.wcmaloginea.aspx.yfw79.biz
19199 79.178.21.85(10) wcma.businesscenter.bcprivate.asp02450253.wcmaloginea.aspx.trc43.net
19199 79.178.21.85(10) wcma.businesscenter.bcprivate.asp95897893.wcmaloginea.aspx.trc43.net
19199 79.178.21.85(10) wcma.businesscenter.bcprivate.asp72661895.wcmaloginea.aspx.lkh21.net
19200 79.178.21.85(10) wcma.businesscenter.bcprivate.asp09183779.wcmaloginea.aspx.gnw49.com
19200 79.178.21.85(10) wcma.businesscenter.bcprivate.asp65007058.wcmaloginea.aspx.gnw49.com
19200 79.178.21.85(10) wcma.businesscenter.bcprivate.asp20191240.wcmaloginea.aspx.gnw49.com
19201 dns_temp_fail wcma.businesscenter.bcprivate.asp08479329.wcmaloginea.aspx.ucx43.us
19201 dns_temp_fail wcma.businesscenter.bcprivate.asp58819237.wcmaloginea.aspx.ucx43.us
19201 dns_temp_fail wcma.businesscenter.bcprivate.asp80077091.wcmaloginea.aspx.ucx43.us
Domain registration info
Phish domain Registrar
45gsd.com REGISTER.COM 10/18/2007 (suspended)
brd58.com REGISTER.COM 10/17/2007 (cancelled)
dse43.com REGISTER.COM 10/17/2007 (cancelled)
gnw49.com REGISTER.COM 10/17/2007 (cancelled)
gvs86.net unknown 10/17/2007? (cancelled?)
jda53.biz REGISTER.COM 10/17/2007 (suspended)
jvq56.biz unknown 10/17/2007? (cancelled?)
lkh21.net REGISTER.COM 10/17/2007 (cancelled)
ojs73.com REGISTER.COM 10/17/2007 (cancelled)
orocin3.gx.cn www.cnnic.net.cn 10/17/2007
qsr93.net unknown 10/17/2007? (cancelled?)
trc43.net REGISTER.COM 10/17/2007 (cancelled)
try42.com REGISTER.COM 10/18/2007 (suspended)
ucx43.us REGISTER.COM 10/16/2007 (cancelled)
urd68.biz REGISTER.COM 10/17/2007 (suspended)
yfw79.biz unknown 10/17/2007? (cancelled?)
DNS server domain Registrar
bar-bar-com.com BIZCN.COM 9/18/2007 (cancelled)
bestlightyear.com REGISTER.COM 10/11/2007
ebigstep.com INFO AVENUE 9/27/2007
goldbigstar.com INFO AVENUE 10/06/2007
lo1-prt.com BIZCN.COM 9/05/2007 (cancelled)
mbhold.com REGISTER.COM 10/04/2007 (suspended)
--
AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.5 |
|
MGDPremium,MVM
join:2002-07-31
kudos:9 | Wow !!
They have taken a definite liking to REGISTER.COM as of late.
MGD |
|
nwrickertsand groperPremium,MVM
join:2004-09-04
Geneva, IL
kudos:7 Reviews:
·AT&T U-Verse
| As best I can tell, there have been different teams at work here. I see plenty of evidence that they are part of the same larger group, though I cannot definitively prove that. The team that is interested in ACH access and Merrill Lynch has a preference for REGISTER.COM and Domain Discreet. The team that does the more routine phishes tends to try different registrars until they wear out their welcome. At present the ACH team is the one preparing the phishes, and the other team seems to be taking a break (or plotting something).
I'm guessing that somebody from Merrill Lynch got on the phone to REGISTER.COM. I have never before seen then take down sites this quickly.
--
AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.5 |
|
 UncleScooterBubbles, I like BubblesPremium
join:2002-04-15
Tallahassee, FL | "I'm guessing that somebody from Merrill Lynch got on the phone to REGISTER.COM. I have never before seen then take down sites this quickly."
Now THAT is one conversation I would've loved to listen in on! 
--
I know you think you understand what you thought I said, but what I'm not sure about is that what you heard isn't exactly what I meant. |
|
MGDPremium,MVM
join:2002-07-31
kudos:9 | reply to nwrickert
said by nwrickert:....The team that is interested in ACH access and Merrill Lynch has a preference for REGISTER.COM and Domain Discreet. The team that does the more routine phishes tends to try different registrars until they wear out their welcome. ..... Very interesting, ... plus register could almost write a script to filter out rockphish domains at enrollment time, creatures of habit. I cannot see that a lot of legit domains get registered 3 letter 2 digits or vice versa, a la "lkh21". I did notice that the ach crew are going for volume in an attempt to override the lack of domain stamina.
MGD |
|
nwrickertsand groperPremium,MVM
join:2004-09-04
Geneva, IL
kudos:7 Reviews:
·AT&T U-Verse
| reply to nwrickert
Rock phish report Oct 19, 2007The Friday report:
19214 NXDOMAIN wcma.businesscenter.bcprivate.asp65638272.wcmaloginea.aspx.lkh21.net
19214 NXDOMAIN wcma.businesscenter.bcprivate.asp69771795.wcmaloginea.aspx.lkh21.net
19214 NXDOMAIN wcma.businesscenter.bcprivate.asp88642153.wcmaloginea.aspx.trc43.net
19215 NXDOMAIN wcma.businesscenter.bcprivate.asp74202269.wcmaloginea.aspx.rty73.com
19215 NXDOMAIN wcma.businesscenter.bcprivate.asp93913154.wcmaloginea.aspx.56ub.com
19215 NXDOMAIN wcma.businesscenter.bcprivate.asp38257002.wcmaloginea.aspx.rty73.com
19216 NXDOMAIN wcma.businesscenter.bcprivate.asp35760165.wcmaloginea.aspx.yzc93.com
19216 NXDOMAIN wcma.businesscenter.bcprivate.asp76086634.wcmaloginea.aspx.bsr54.com
19216 NXDOMAIN wcma.businesscenter.bcprivate.asp74877118.wcmaloginea.aspx.yzc93.com
19217 NXDOMAIN wcma.businesscenter.bcprivate.asp56941779.wcmaloginea.aspx.fds32.net
19217 NXDOMAIN wcma.businesscenter.bcprivate.asp49881988.wcmaloginea.aspx.ind76.info
19217 NXDOMAIN wcma.businesscenter.bcprivate.asp45089690.wcmaloginea.aspx.rsf39.us
19218 209.85.51.238 wcma.businesscenter.bcprivate.asp91310461.wcmaloginea.aspx.bnt43.net
19218 NXDOMAIN wcma.businesscenter.bcprivate.asp34449899.wcmaloginea.aspx.gfa53.info
19218 NXDOMAIN wcma.businesscenter.bcprivate.asp56073629.wcmaloginea.aspx.gwy87.net
19219 NXDOMAIN wcma.businesscenter.bcprivate.asp30958731.wcmaloginea.aspx.yfw79.biz
19219 NXDOMAIN wcma.businesscenter.bcprivate.asp33627406.wcmaloginea.aspx.yfw79.biz
19219 NXDOMAIN wcma.businesscenter.bcprivate.asp72602590.wcmaloginea.aspx.yfw79.biz
19220 dns_temp_fail wcma.businesscenter.bcprivate.asp81251426.wcmaloginea.aspx.uj99.com
19220 NXDOMAIN wcma.businesscenter.bcprivate.asp55090847.wcmaloginea.aspx.xsw432.org
19220 dns_temp_fail wcma.businesscenter.bcprivate.asp66706690.wcmaloginea.aspx.bgt55.com
19221 NXDOMAIN wcma.businesscenter.bcprivate.asp74248908.wcmaloginea.aspx.nd7.biz
19221 NXDOMAIN wcma.businesscenter.bcprivate.asp52323022.wcmaloginea.aspx.vbp6.net
19221 NXDOMAIN wcma.businesscenter.bcprivate.asp84823485.wcmaloginea.aspx.nd7.biz
19222 NXDOMAIN securelogin-79397538.moneymanagergps.com.bfg65.com
19223 dns_temp_fail e-access92890160.compassbank.com.ibscompass.cmserver.welcome.default.verify.cfm.dft38.us
19224 NXDOMAIN e-access15471264.compassbank.com.ibscompass.cmserver.welcome.default.verify.cfm.skt32.com
19225 dns_temp_fail e-access25729284.compassbank.com.ibscompass.cmserver.welcome.default.verify.cfm.uip32.info
19226 NXDOMAIN e-access76836132.compassbank.com.ibscompass.cmserver.welcome.default.verify.cfm.fgt79.biz
19227 dns_temp_fail securelogin-04988390.moneymanagergps.com.jus83.com
19228 dns_temp_fail securelogin-33382068.moneymanagergps.com.hds76.com
19230 NXDOMAIN wcma.businesscenter.bcprivate.asp49984519.wcmaloginea.aspx.vfd12.com
19230 dns_temp_fail wcma.businesscenter.bcprivate.asp95331148.wcmaloginea.aspx.7hj5.com
19230 dns_temp_fail wcma.businesscenter.bcprivate.asp13443823.wcmaloginea.aspx.7hj5.com
19231 NXDOMAIN wcma.businesscenter.bcprivate.asp97524783.wcmaloginea.aspx.dvz8.net
19231 NXDOMAIN wcma.businesscenter.bcprivate.asp36835929.wcmaloginea.aspx.hnw21.net
19231 NXDOMAIN wcma.businesscenter.bcprivate.asp42349270.wcmaloginea.aspx.mni43.com
19249 78.96.29.20(10) wcma.businesscenter.bcprivate.asp25082254.wcmaloginea.aspx.ljs83.com
19249 78.96.29.20(10) wcma.businesscenter.bcprivate.asp57895560.wcmaloginea.aspx.fsp68.com
19249 78.96.29.20(10) wcma.businesscenter.bcprivate.asp42611204.wcmaloginea.aspx.fsp68.com
19254 79.178.254.190(10) wcma.businesscenter.bcprivate.asp02776420.wcmaloginea.aspx.ll32.com
19254 NXDOMAIN wcma.businesscenter.bcprivate.asp51259149.wcmaloginea.aspx.ll322.com
19254 NXDOMAIN wcma.businesscenter.bcprivate.asp56203485.wcmaloginea.aspx.ll789.com
19255 NXDOMAIN wcma.businesscenter.bcprivate.asp91721162.wcmaloginea.aspx.lp9.info
19255 NXDOMAIN wcma.businesscenter.bcprivate.asp14416697.wcmaloginea.aspx.ke4.info
19255 NXDOMAIN wcma.businesscenter.bcprivate.asp16068590.wcmaloginea.aspx.ke4.info
19257 NXDOMAIN hiring-id56080375.monster.com.hrenov4.gz.cn
19258 NXDOMAIN wcma.businesscenter.bcprivate.asp57240314.wcmaloginea.aspx.uiuyt6.com
19258 NXDOMAIN wcma.businesscenter.bcprivate.asp05757664.wcmaloginea.aspx.uiuyt6.com
19258 NXDOMAIN wcma.businesscenter.bcprivate.asp02448610.wcmaloginea.aspx.uiuyt6.com
19259 NXDOMAIN hiring-id59592.monster.com.mailop5.xz.cn
19260 NXDOMAIN hiring-id005437368.monster.com.g5oo5liv.xz.cn
19265 dns_temp_fail e-access23459193.compassbank.com.ibscompass.cmserver.welcome.default.verify.cfm.trf54.biz
19266 dns_temp_fail securelogin-57598628.moneymanagergps.com.fks18.com
19268 phish_is_down wcma.businesscenter.bcprivate.asp31142919.wcmaloginea.aspx.dse43.com
19268 phish_is_down wcma.businesscenter.bcprivate.asp70968119.wcmaloginea.aspx.dse43.com
19268 phish_is_down wcma.businesscenter.bcprivate.asp15396532.wcmaloginea.aspx.dse43.com
Domain registration info
Phish domain Registrar
56ub.com REGISTER.COM 10/18/2007 (suspended)
7hj5.com REGISTER.COM 10/18/2007 (suspended)
bfg65.com REGISTER.COM 10/14/2007
bgt55.com REGISTER.COM 10/18/2007 (suspended)
bnt43.net ULTRARPM 10/18/2007
bsr54.com unknown 10/16/2007? (cancelled?)
dft38.us REGISTER.COM 10/15/2007
dse43.com REGISTER.COM 10/17/2007 (cancelled)
dvz8.net unknown 10/18/2007? (cancelled?)
fds32.net REGISTER.COM 10/16/2007 (suspended)
fgt79.biz REGISTER.COM 10/15/2007
fks18.com REGISTER.COM 10/14/2007
fsp68.com REGISTER.COM 10/19/2007
g5oo5liv.xz.cn unknown 10/18/2007? (cancelled?)
gfa53.info unknown 10/16/2007? (cancelled?)
gwy87.net REGISTER.COM 10/16/2007 (suspended)
hds76.com REGISTER.COM 10/14/2007
hnw21.net unknown 10/18/2007? (cancelled?)
hrenov4.gz.cn unknown 10/18/2007? (cancelled?)
ind76.info REGISTER.COM 10/16/2007 (suspended)
jus83.com REGISTER.COM 10/14/2007
ke4.info unknown 10/18/2007? (cancelled?)
ljs83.com REGISTER.COM 10/19/2007
lkh21.net REGISTER.COM 10/17/2007 (cancelled)
ll322.com REGISTER.COM 10/19/2007 (suspended)
ll32.com REGISTER.COM 10/19/2007
ll789.com REGISTER.COM 10/19/2007 (suspended)
lp9.info unknown 10/18/2007? (cancelled?)
mailop5.xz.cn unknown 10/18/2007? (cancelled?)
mni43.com unknown 10/18/2007? (cancelled?)
nd7.biz unknown 10/18/2007? (cancelled?)
rsf39.us REGISTER.COM 10/16/2007 (suspended)
rty73.com REGISTER.COM 10/18/2007 (suspended)
skt32.com REGISTER.COM 10/15/2007 (suspended)
trc43.net REGISTER.COM 10/17/2007 (cancelled)
trf54.biz REGISTER.COM 10/15/2007
uip32.info REGISTER.COM 10/15/2007
uiuyt6.com unknown 10/18/2007? (cancelled?)
uj99.com REGISTER.COM 10/18/2007 (suspended)
vbp6.net unknown 10/18/2007? (cancelled?)
vfd12.com unknown 10/18/2007? (cancelled?)
xsw432.org unknown 10/18/2007? (cancelled?)
yfw79.biz unknown 10/17/2007? (cancelled?)
yzc93.com unknown 10/16/2007? (cancelled?)
DNS server domain Registrar
2ndzero.com INFO AVENUE 10/06/2007
abc-tgc.com REGISTER.COM 9/11/2007 (suspended)
bestlightyear.com REGISTER.COM 10/11/2007 (suspended)
plugininput.com INFO AVENUE 10/02/2007
--
AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.5 |
|
nwrickertsand groperPremium,MVM
join:2004-09-04
Geneva, IL
kudos:7 Reviews:
·AT&T U-Verse
| Rock phish report Oct 20, 2007The Saturday report:
19275 NXDOMAIN wcma.businesscenter.bcprivate.asp63226423.wcmaloginea.aspx.ljs83.com
19275 NXDOMAIN wcma.businesscenter.bcprivate.asp86372720.wcmaloginea.aspx.ll882.com
19275 NXDOMAIN wcma.businesscenter.bcprivate.asp51588672.wcmaloginea.aspx.ll789.com
19276 NXDOMAIN wcma.businesscenter.bcprivate.asp66137406.wcmaloginea.aspx.vnp91.com
19276 NXDOMAIN wcma.businesscenter.bcprivate.asp98332883.wcmaloginea.aspx.skq54.com
19276 NXDOMAIN wcma.businesscenter.bcprivate.asp64174883.wcmaloginea.aspx.hds54.com
19285 221.12.43.189 hiring-id93941382.monster.com.kcfiiwere.es
19286 221.12.43.189 hiring-id3648331442.monster.com.esbeyon1d.gz.cn
19288 221.12.43.189 hiring-id7076176106.monster.com.kiier1.li
19289 221.12.43.189 hiring-id835259115.monster.com.koowershop.at
19290 221.12.43.189 hiring-id621957.monster.com.ko5el6.hk
19291 NXDOMAIN wcma.businesscenter.bcprivate.asp83941908.wcmaloginea.aspx.ll32.com
19291 NXDOMAIN wcma.businesscenter.bcprivate.asp70669026.wcmaloginea.aspx.ll32.com
19291 NXDOMAIN wcma.businesscenter.bcprivate.asp41591555.wcmaloginea.aspx.ll32.com
Domain registration info
Phish domain Registrar
esbeyon1d.gz.cn www.cnnic.net.cn 10/11/2007
hds54.com REGISTER.COM 10/19/2007 (suspended)
kcfiiwere.es www.nic.es 10/19/2007?
kiier1.li www.switch.ch 10/19/2007?
ko5el6.hk HKDNR 10/20/2007
koowershop.at AT-DOM 10/20/2007? (suspended)
ljs83.com REGISTER.COM 10/19/2007 (suspended)
ll32.com REGISTER.COM 10/19/2007 (suspended)
ll789.com REGISTER.COM 10/19/2007 (suspended)
ll882.com REGISTER.COM 10/19/2007 (suspended)
skq54.com REGISTER.COM 10/19/2007 (suspended)
vnp91.com REGISTER.COM 10/19/2007 (suspended)
DNS server domain Registrar
bar-bar-com.com BIZCN.COM 9/18/2007 (cancelled)
vilopr.cn www.cnnic.net.cn 8/16/2007
--
AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.5 |
|
nwrickertsand groperPremium,MVM
join:2004-09-04
Geneva, IL
kudos:7 Reviews:
·AT&T U-Verse
1 edit | Rock phish report Oct 22, 2007There were no rock phish submitted yesterday (Sunday).
Here is the report for Monday:
19319 79.113.80.78(10) wcma.businesscenter.bcprivate.asp96162728.wcmaloginea.aspx.ocs2.com
19319 79.113.80.78(10) wcma.businesscenter.bcprivate.asp92723311.wcmaloginea.aspx.ocs2.com
19319 79.113.80.78(10) wcma.businesscenter.bcprivate.asp67183848.wcmaloginea.aspx.bbsq1.com
19321 79.113.80.78(10) wcma.businesscenter.bcprivate.asp08997928.wcmaloginea.aspx.dvu8.com
19321 79.113.80.78(10) wcma.businesscenter.bcprivate.asp17088423.wcmaloginea.aspx.dvu8.com
19321 79.113.80.78(10) wcma.businesscenter.bcprivate.asp90912488.wcmaloginea.aspx.dvu8.com
19322 NXDOMAIN wcma.businesscenter.bcprivate.asp79436580.wcmaloginea.aspx.c1j1.com
19322 NXDOMAIN wcma.businesscenter.bcprivate.asp36498144.wcmaloginea.aspx.3l24.com
19322 NXDOMAIN wcma.businesscenter.bcprivate.asp85724920.wcmaloginea.aspx.3l24.com
19325 NXDOMAIN wcma.businesscenter.bcprivate.asp01250590.wcmaloginea.aspx.c1j1.com
19325 NXDOMAIN wcma.businesscenter.bcprivate.asp82531809.wcmaloginea.aspx.3l24.com
19325 NXDOMAIN wcma.businesscenter.bcprivate.asp29011317.wcmaloginea.aspx.3l24.com
19331 NXDOMAIN wcma.businesscenter.bcprivate.asp33829591.wcmaloginea.aspx.enn1.com
19331 NXDOMAIN wcma.businesscenter.bcprivate.asp08367569.wcmaloginea.aspx.mol11.com
19331 NXDOMAIN wcma.businesscenter.bcprivate.asp62333855.wcmaloginea.aspx.mol11.com
19332 79.113.46.37(10) wcma.businesscenter.bcprivate.asp44049753.wcmaloginea.aspx.vfr331.com
19332 79.113.46.37(10) wcma.businesscenter.bcprivate.asp35765070.wcmaloginea.aspx.vfr331.com
19332 NXDOMAIN wcma.businesscenter.bcprivate.asp45414394.wcmaloginea.aspx.87ud.com
19334 NXDOMAIN hiring-id191684.monster.com.kiier1.ch
19335 NXDOMAIN wcma.businesscenter.bcprivate.asp05037261.wcmaloginea.aspx.3l24.com
19335 NXDOMAIN wcma.businesscenter.bcprivate.asp81936321.wcmaloginea.aspx.3l24.com
19335 NXDOMAIN wcma.businesscenter.bcprivate.asp65753533.wcmaloginea.aspx.c1j1.com
19336 NXDOMAIN wcma.businesscenter.bcprivate.asp99588860.wcmaloginea.aspx.mol11.com
19336 NXDOMAIN wcma.businesscenter.bcprivate.asp62796565.wcmaloginea.aspx.enn1.com
19336 NXDOMAIN wcma.businesscenter.bcprivate.asp36099670.wcmaloginea.aspx.enn1.com
19337 NXDOMAIN wcma.businesscenter.bcprivate.asp82367874.wcmaloginea.aspx.bbsq1.com
19337 NXDOMAIN wcma.businesscenter.bcprivate.asp29190574.wcmaloginea.aspx.bbsq1.com
19337 NXDOMAIN wcma.businesscenter.bcprivate.asp06915539.wcmaloginea.aspx.bbsq1.com
19338 NXDOMAIN wcma.businesscenter.bcprivate.asp89076344.wcmaloginea.aspx.c1j1.com
19338 NXDOMAIN wcma.businesscenter.bcprivate.asp90843953.wcmaloginea.aspx.3l24.com
19338 NXDOMAIN wcma.businesscenter.bcprivate.asp47397786.wcmaloginea.aspx.3l24.com
19339 NXDOMAIN wcma.businesscenter.bcprivate.asp57726813.wcmaloginea.aspx.dres61.com
19339 NXDOMAIN wcma.businesscenter.bcprivate.asp80727722.wcmaloginea.aspx.ter34.com
19339 NXDOMAIN wcma.businesscenter.bcprivate.asp50066458.wcmaloginea.aspx.ter34.com
19340 NXDOMAIN wcma.businesscenter.bcprivate.asp85756140.wcmaloginea.aspx.dres61.com
19340 NXDOMAIN wcma.businesscenter.bcprivate.asp30281181.wcmaloginea.aspx.dres61.com
19340 NXDOMAIN wcma.businesscenter.bcprivate.asp72539443.wcmaloginea.aspx.dres61.com
19341 NXDOMAIN wcma.businesscenter.bcprivate.asp04179987.wcmaloginea.aspx.vfr331.com
19341 NXDOMAIN wcma.businesscenter.bcprivate.asp00099091.wcmaloginea.aspx.87ud.com
19341 NXDOMAIN wcma.businesscenter.bcprivate.asp42744218.wcmaloginea.aspx.vfr331.com
19342 NXDOMAIN wcma.businesscenter.bcprivate.asp77545532.wcmaloginea.aspx.vfr331.com
19342 NXDOMAIN wcma.businesscenter.bcprivate.asp64323840.wcmaloginea.aspx.vfr331.com
19342 NXDOMAIN wcma.businesscenter.bcprivate.asp79438433.wcmaloginea.aspx.vfr331.com
19343 NXDOMAIN wcma.businesscenter.bcprivate.asp81097926.wcmaloginea.aspx.345tg.com
19343 NXDOMAIN wcma.businesscenter.bcprivate.asp27246303.wcmaloginea.aspx.65rad.com
19343 NXDOMAIN wcma.businesscenter.bcprivate.asp13760220.wcmaloginea.aspx.65rad.com
19349 NXDOMAIN wcma.businesscenter.bcprivate.asp31845140.wcmaloginea.aspx.ter34.com
19349 NXDOMAIN wcma.businesscenter.bcprivate.asp17217252.wcmaloginea.aspx.7iuhf.com
19349 NXDOMAIN wcma.businesscenter.bcprivate.asp05091487.wcmaloginea.aspx.vfr331.com
19352 NXDOMAIN wcma.businesscenter.bcprivate.asp78666988.wcmaloginea.aspx.vfr331.com
19352 NXDOMAIN wcma.businesscenter.bcprivate.asp27331975.wcmaloginea.aspx.vfr331.com
19352 NXDOMAIN wcma.businesscenter.bcprivate.asp21895736.wcmaloginea.aspx.ter34.com
19355 NXDOMAIN wcma.businesscenter.bcprivate.asp80440829.wcmaloginea.aspx.vfr331.com
19355 NXDOMAIN wcma.businesscenter.bcprivate.asp21633410.wcmaloginea.aspx.65rad.com
19355 NXDOMAIN wcma.businesscenter.bcprivate.asp12415378.wcmaloginea.aspx.345tg.com
19356 NXDOMAIN wcma.businesscenter.bcprivate.asp82535190.wcmaloginea.aspx.ter34.com
19356 NXDOMAIN wcma.businesscenter.bcprivate.asp61235476.wcmaloginea.aspx.7iuhf.com
19356 NXDOMAIN wcma.businesscenter.bcprivate.asp28186433.wcmaloginea.aspx.7iuhf.com
19357 NXDOMAIN wcma.businesscenter.bcprivate.asp30988404.wcmaloginea.aspx.ter34.com
19357 NXDOMAIN wcma.businesscenter.bcprivate.asp92769387.wcmaloginea.aspx.dres61.com
19357 NXDOMAIN wcma.businesscenter.bcprivate.asp68011858.wcmaloginea.aspx.ter34.com
Domain registration info
Phish domain Registrar
345tg.com REGISTER.COM 10/21/2007 (suspended)
3l24.com REGISTER.COM 10/21/2007 (suspended)
65rad.com REGISTER.COM 10/21/2007 (suspended)
7iuhf.com REGISTER.COM 10/21/2007 (suspended)
87ud.com REGISTER.COM 10/21/2007? (cancelled?)
bbsq1.com REGISTER.COM 10/21/2007 (suspended)
c1j1.com REGISTER.COM 10/21/2007 (suspended)
dres61.com REGISTER.COM 10/21/2007 (suspended)
dvu8.com REGISTER.COM 10/21/2007 (suspended)
enn1.com REGISTER.COM 10/21/2007 (suspended)
kiier1.ch www.switch.ch 10/19/2007? (suspended)
mol11.com REGISTER.COM 10/21/2007 (suspended)
ocs2.com REGISTER.COM 10/21/2007 (suspended)
ter34.com REGISTER.COM 10/21/2007 (suspended)
vfr331.com REGISTER.COM 10/21/2007 (suspended)
DNS server domain Registrar
ebigstep.com INFO AVENUE 9/27/2007
goldbigstar.com INFO AVENUE 10/06/2007
--
AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.5 |
|
nwrickertsand groperPremium,MVM
join:2004-09-04
Geneva, IL
kudos:7 Reviews:
·AT&T U-Verse
| Rock phish report Oct 23, 2007The Tuesday report:
19370 79.178.50.93(10) www.bxs.inview.session80438.certificate-logon2007.serial16885581-0009.sd323.com
19371 82.78.174.157(10) www.bxs.inview.session62444.certificate-logon2007.serial74577596-0006.ia244.net
19374 79.113.38.145(10) www.bxs.inview.session72983.certificate-logon2007.serial58623957-0001.ia244.net
19375 79.113.38.145(10) www.bxs.inview.session47999.certificate-logon2007.serial13424181-0007.ss69.us
19376 62.231.92.64(10) www.bxs.inview.session73209.certificate-logon2007.serial14680419-0003.sd690.com
19377 62.231.92.64(10) www.bxs.inview.session13536.certificate-logon2007.serial67001884-0004.ll780.com
19383 62.231.92.64(10) www.bxs.inview.session20171.certificate-logon2007.serial08877253-0009.ll3311.com
19388 82.79.220.86(10) www.bxs.inview.session55341.certificate-logon2007.serial44573923-0000.vc232.com
19398 77.81.24.92(10) www.bxs.inview.session70460.certificate-logon2007.serial21494658-0005.ll2213.com
19400 77.81.24.92(10) www.bxs.inview.session51181.certificate-logon2007.serial79733944-0007.fc986.us
Domain registration info
Phish domain Registrar
fc986.us AMERICAN DOMAIN 10/22/2007
ia244.net DOTALLIANCE 10/22/2007
ll2213.com DOTALLIANCE 10/22/2007
ll3311.com DOTALLIANCE 10/22/2007
ll780.com DOTALLIANCE 10/22/2007
sd323.com DOTALLIANCE 10/22/2007
sd690.com DOTALLIANCE 10/22/2007
ss69.us AMERICAN DOMAIN 10/22/2007
vc232.com DOTALLIANCE 10/22/2007
DNS server domain Registrar
ebigstep.com INFO AVENUE 9/27/2007
goldbigstar.com INFO AVENUE 10/06/2007
--
AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.8 |
|
