|
News:
April 26, 2009
Swine flu and spam
What does the swine flu
have to do with spam?
In the past, during an avian
flu outbreak in Asia, there was a glut of spam advertising antiviral
drugs like Tamiflu. People were afraid there wouldn't be enough
of the drug to go around, so they were hoarding. They couldn't get
a prescription from their doctors for an illness they didn't even
have, so they bought it from spammers.
Of course, there was no
pandemic that time. But don't assume that's because the risk was
exagerated. A virus like the current human/avian/swine flu can still
be as deadly as the one in 1918. Given the way the flu virus mutates,
it's more or less inevitable a pandemic will happen someday, even
if it doesn't this time. And public health officials around the
world are very aware of that, and they have been planning for it
.
When the avian flu began
to infect people in Asia, public health officials around the world
put out warnings to the public, began surveillance for avian flu
virus by collecting viral cultures through a network of "sentinel
physicians," warned physicians who might come in contact with
cases, restricted travel by people who might be infected, and kept
antiviral medication on hand. Those actions may actually have been
what averted disaster at that time.
The same thing is happening
now, and public health agencies are back on alert-- they are trying
to identify cases, so they can treat both the ill person and his/her
contacts.
If you suspect you may have
the flu, contact your doctor or public health department. Public
health departments in the US have plenty of Tamiflu, and they are
keeping track of cases to make sure the virus doesn't become resistant.
They have a system set up to protect you and the people you care
about, so let that system work the way it's supposed to. Don't take
a chance on a generic counterfeit from a spammer pharmacy. There
is a very high chance that the drugs they send have no active ingredient
at all, and if the pills have a dose that is too low, it may actually
help the virus develop immunity. During the time you waste on spamvertised
crap, you could be infecting those you love with a Tamiflu-proof
version of the virus.
April 25, 2009
Puppy adoption scam email
| Hello,
How are you today, My name is Cabana Tammy
I am a consultant gynecologist surgeon and oncologist doctor,
I work for different prominent hospital, me and my husband
are giving out this little puppy for free (Adoption),This
little girl weighs 1.3Lbs at 9 weeks old & should be 3Lbs
when full grown only. She is very friendly with children she
fit in both Palms of your hands. She is AKC/CERF registered
puppy .Adorable and sociable with great Personalities and
very good bloodlines. She is vet-checked, up to date on shots
and deforming, and is health is guaranteed. Recently checked
by a licensed Vet Doctor for heart, knees, skin, correct bite,
and eyes. Bottom and straight sides and tender, she is A.K.C
and CERF registered and shots are given up to date. She will
come along with Travel crate, AKC/CERF Registered Papers,
Toys and Food and Birth Certificate, I resided in the state
with my husband but after my son's death me and my husband
moved to Africa due to our work and we have!
the puppy right here with us. The
For free. You have to promise me that you will take good care
of her as she will be a New family member, please if you are
not going to take good care of the puppy, do not reply but
if you are going to take good care of her kindly reply for
more details about her. I await your urgent Response.
Thanks.
Cabana Tammy
|
If you received one of these,
be assured that several thousand other people did, too. The "free"
puppy will require all types of fees to get it out of the country.
There is no puppy, and they will keep thinking of fees as long as
you keep falling for their lies. Any papers they fax you will be
forgeries.
There are plenty of dogs
available for adoption in the US. Check your local shelters, or
visit Petfinder.com
. If you were hoping to get a highly valuable dog for "free,"
don't let your greed blind you. No matter what the dog costs from
a legitimate breeder, you will end up paying much more being bled
dry with "just one more small fee" for a non-existent
dog with forged papers.
April 9, 2009
Open letter to the new chairman of the US Federal Trade Commission
Members of the
InboxRevenge.com antispam forum have posted an open
letter to the new FTC chairman, Jon Leibowitz. It's about how
the types of cybercrime that constitute a threat to national security
are closely tied to the spam and fraud that shows up in your inbox:
|
We very much support the efforts the FTC
is taking to educate consumers about internet
fraud and identity
theft, and we recommend that everyone view the excellent
materials online at ftc.gov. However, those types of problems
require a level of coordinated effort beyond what any one
individual or business can accomplish. We urge the next head
of the FTC to see the big picture. And one obvious part of
the picture is spam.
Spam is like a flashing light alerting us to far more serious
criminal activity beneath the surface. By minimizing the severity
of spammers' offenses, you lose the ability to expose and
investigate much deeper risks to the US, even impacting on
national security.
Spam -- unsolicited commercial email -- is a nuisance. Because
it is so inexpensive to advertise through email, spam volume
has ballooned to comprise the vast majority of email messages.
And the majority of the spam being mailed advertises products
that are fraudulent or illegal, whose sponsors do not care
about building a positive brand image. Most users have little
idea how much spam would be arriving in their inboxes if their
internet service providers were not using strategies to block
the worst of it.
This is obviously a problem in terms of time/money spent on
spam filtering systems and in deleting spams that pass through
filters. More importantly, the loss of valid emails due to
spam filtering is making some types of email communication
extremely difficult. Legitimate commercial email is lost in
the deluge of spam messages.
But the problem in the inbox pales by comparison to the multiple
layers of illegal activity spammers employ to circumvent users'
attempts to avoid their garbage. Spammers are hijacking the
computers of innocent users to send
their email and host
their web sites. They are using stolen
identities to register their website domain names, and
using stolen credit/debit/PayPal accounts to pay for them.
Their websites flagrantly violate
trademarks, fraudulently
claim approval from agencies like the FDA and Better Business
Bureau, use stock
photos of buildings and people to create imaginary locations
and corporate officers for themselves, display forged
pharmacy licenses, and sell counterfeit copies of drugs
still protected by patents within the US. They abuse voice-over-internet
phone service, using US
local phone numbers to give unwitting consumers the impression
they are located within the US. They transmit protected health
information and credit card numbers via insecure
connections, and use fake
images of SSL icons to deceive consumers about that fact.
They require no prescription for drugs that require one in
the US, often including controlled
narcotics. They ship pills of questionable content into
the US, competing with those produced under FDA oversight,
and they smuggle them through customs via fraudulent declarations.
They use spam emails to lure additional people to websites
where their computers will become infected with malicious
programs like computer viruses and Trojan horses, allowing
the spammers to continue to expand their power to abuse the
internet.
While CAN-SPAM attempted to provide a safe haven for legitimate
emailers, it is totally ignored by the criminal spammers whose
products would still be illegal no matter how "compliant"
their emails might be. Enforcement is hampered because spammers
can maintain anonymity by using other people's hijacked computers,
and because many of the most prolific spammers operate in
countries which tolerate or even condone their activities.
But the situation is not as hopeless as it would appear. Not
all reasonable measures are being taken to control the problem.
Spammers could not continue at this level of activity without
the passive cooperation of legitimate businesses. For instance,
there are multiple systems in existence to identify the hijacked
computers and illegally registered domain names that spammers
rely on to conduct their business. Spam filtering products
rely on them to obtain the necessary information to identify
spam. Yet that information is often ignored by the otherwise
legitimate registrars, hosting companies and telecommunications
services which have the power to do something about it.
Does anyone really believe the spammer smuggling counterfeit
Viagra into the US is sitting at home at the address provided
in the domain registration, waiting for law enforcement to
drop by? Then why is there unwillingness to investigate and
suspend these domains? Do internet service providers think
their customers would rather not know their computers are
controlled by strangers in foreign countries, sending spam
and helping themselves to users' personal information? Then
why are they so unreceptive to reports of hijacked servers
within their own networks? Do banks consider it acceptable
for their clients' credit card numbers to be stolen to register
illegal domains? Then why is there no effort to identify and
close the credit card merchant accounts being used to process
orders at those same sites? And when it would be simple
to block all traffic from rogue countries which allow these
criminals to operate, why are US internet companies so lax
at shutting down bots on their own networks, making it impractical
for American companies to block traffic from the worst spam-spewing
IP address ranges?
The other issue is that these armies of zombie computers,
called "botnets," do more than just send spam or host websites.
They are also used to conduct Distributed Denial of Service
attacks. In such attacks, large numbers of computers access
the resources of an internet target simultaneously, making
it impossible for that web site to continue to operate without
spending large sums of money for mitigation.
We in the antispam community saw an extreme example of such
an attack in 2006 when angry spammers attacked the company
Blue
Security, whose product submitted automated unsubscribe
request for its members. The high volume of that DDoS attack
not only shut down Blue Security, it knocked many other innocent
firms off-line as well. Yet this was apparently dismissed
as a private matter between Blue Security and the spammers,
and there was no notice given of the potential risk to national
security posed by criminals with control of such a powerful
botnet. A year later, a DDoS was used to attack government
agencies in the nation of Estonia.
While our government expressed concern, there was little evidence
of action. Now similar attacks on the nations of Georgia
and Kyrgyzstan
have been in the news, and non-governmental targets continue
to be attacked for the purpose of extortion or harassment.
This is more than merely a commercial or consumer nuisance;
it is a threat to national security.
These botnets are in fact being purchased
and maintained by the spam economy. That's the "military
budget" keeping those "standing armies" available for rental
by any terrorists who might wish to attack the US. There is
serious potential for cyberterrorism to cripple significant
parts of the US government and private sector, and spam is
just one particularly visible part of the problem. The silly
messages and sexually oriented products should not deceive
anyone about the danger. We ask you to work to coordinate
the various companies whose actions and inaction enable spammers
to operate, so that the current state of extreme lawlessness
can be brought under control.
-- from the spam and
internet security investigators
at InboxRevenge.com
|
April 2, 2009
Waledac's "dirty bomb" will make a mess of your computer
The Waledac domain chatloveonline.com is still
alive and well. It's been alive so long it's a bit of a trick to
visit -- Avira's AntiVir recognizes the URL and won't allow you
to open the page. Everyone seems to know it's bad, but no one has
taken it down.
The current Waledac theme is a fake Reuters news
story about a dirty bomb. The page actually analyzes which IP address
you're visiting from, and uses that city's name in the headline:
As is typical, the text is clearly not written
by a native English speaker:
| Powerful explosion burst in Laurel
this morning.
At least 12 people have been killed and more
than 40 wounded in a bomb blast near market in Laurel. Authorities
suggested that explosion was caused by "dirty" bomb.
Police said the bomb was detonated from close by using electric
cables. "It was awful" said the eyewitness about
blast that he heard from his shop. "It made the floor
shake. So many people were running"
Until now there has been no claim of responsibility.
You need the latest Flash player to view
video content. Click here to download.
Related Links:
http://en.wikipedia.org/wiki/Dirty_bomb
http://www.google.com/search?q=Laurel+terror+attack
|
If you don't live in Laurel, substitute New York,
Washington, Los Angeles, Chicago, Houston, Miami, Seattle, Philadelphia,
San Francisco, Dallas, Boston, Cleveland, etc.
Obviously, there is no video, and clicking on
the link that claims to download Flash Player really downloads the
Waledac trojan. It isn't very well detected by antivirus programs,
which isn't surprising -- I grabbed copies from this site twice
today, and virustotal.com
detects the two copies as different trojans. In that brief period,
a new variation was already uploaded:
|
File save.exe received on 04.03.2009 03:19:31
(CET)
Result: 6/39 (15.39%)
Antivirus ----- Version -----
Result
a-squared ----- 4.0.0.101 -----
-
AhnLab-V3 ----- 5.0.0.2 -----
-
AntiVir ----- 7.9.0.129 -----
-
Antiy-AVL ----- 2.0.3.1 -----
-
Authentium ----- 5.1.2.4 -----
-
Avast ----- 4.8.1335.0 -----
-
AVG ----- 8.5.0.285 -----
Win32/Cryptor
BitDefender ----- 7.2 -----
-
CAT-QuickHeal ----- 10 -----
-
ClamAV ----- 0.94.1 -----
-
Comodo ----- 1096 -----
-
eSafe ----- 7.0.17.0 -----
-
eTrust-Vet ----- 31.6.6433 -----
-
F-Prot ----- 4.4.4.56 -----
-
F-Secure ----- 8.0.14470.0 -----
Packed:W32/Waledac.gen!I
Fortinet ----- 3.117.0.0 -----
-
GData ----- 19 -----
-
Ikarus ----- T3.1.1.49.0 -----
-
K7AntiVirus ----- 7.10.690 -----
-
Kaspersky ----- 7.0.0.125 -----
-
McAfee ----- 5572 -----
-
McAfee+Artemis ----- 5572 -----
-
McAfee-GW-Edition ----- 6.7.6
----- Worm.LooksLike.Rbot
Microsoft ----- 1.4502 -----
Trojan:Win32/Waledac.gen!A
NOD32 ----- 3984 -----
a variant of Win32/Kryptik.LP
Norman ----- 6.00.06 -----
-
nProtect ----- 2009.1.8.0 -----
-
Panda ----- 10.0.0.14 -----
Suspicious file
PCTools ----- 4.4.2.0 -----
-
Prevx1 ----- V2 -----
-
Rising ----- 21.23.32.00 -----
-
Sophos ----- 4.40.0 -----
-
Sunbelt ----- 3.2.1858.2 -----
-
Symantec ----- 1.4.4.12 -----
-
TheHacker ----- 6.3.4.0.300 -----
-
TrendMicro ----- 8.700.0.1004
----- -
VBA32 ----- 3.12.10.2 -----
-
ViRobot ----- 2009.4.2.1673 -----
-
VirusBuster ----- 4.6.5.0 -----
-
Additional information
File size: 412672 bytes
MD5...: c81c4d99487ce04bf8c0e697f453c4e0
|
The clueless registrars for this domain are Xiamen
Ename (for chatloveonline.com) and Xin Net (for its nameservers,
extendedman.com)
As usual, it's hosted on a fast-flux botnet with
a zero-second refresh rate. That means that if you just keep checking
continuously, you get new IP's as fast as your computer can do a
nslookup.
This is what you get if you create a Notepad file
called "test.txt" and then fill it with line after line
that just says
|
nslookup chatloveonline.com >> test.out.txt
nslookup chatloveonline.com >> test.out.txt
nslookup chatloveonline.com >> test.out.txt
nslookup chatloveonline.com >> test.out.txt
nslookup chatloveonline.com >> test.out.txt
nslookup chatloveonline.com >> test.out.txt
|
etc., etc. as many times as you want.
Save it, close it, change the name of the saved
file from "test.txt" to "test.cmd", and then
open the "test.cmd" file to start it running. You'll see
a "command" window open and repeatedly do the nslookup.
Within a few seconds you'll get a long list of IP addresses
like this in the "test.out.txt" file it's going to create:
|
Name: chatloveonline.com
Address: 201.246.54.45
Name: chatloveonline.com
Address: 89.37.77.57
Name: chatloveonline.com
Address: 61.120.135.160
Name: chatloveonline.com
Address: 81.57.65.233
Name: chatloveonline.com
Address: 88.199.104.71
Name: chatloveonline.com
Address: 66.178.84.163
Name: chatloveonline.com
Address: 208.98.129.47
Name: chatloveonline.com
Address: 82.246.34.147
Name: chatloveonline.com
Address: 70.44.177.160
Name: chatloveonline.com
Address: 24.158.115.137
Name: chatloveonline.com
Address: 24.3.193.12
Name: chatloveonline.com
Address: 70.44.177.160
Name: chatloveonline.com
Address: 98.212.239.129
Name: chatloveonline.com
Address: 68.204.162.130
Name: chatloveonline.com
Address: 99.49.20.151
Name: chatloveonline.com
Address: 71.62.48.40
Name: chatloveonline.com
Address: 70.44.177.160
Name: chatloveonline.com
Address: 66.69.203.118
Name: chatloveonline.com
Address: 82.181.81.48
Name: chatloveonline.com
Address: 88.183.153.184
Name: chatloveonline.com
Address: 24.158.115.137
Name: chatloveonline.com
Address: 71.149.209.145
Name: chatloveonline.com
Address: 98.24.128.108
Name: chatloveonline.com
Address: 98.200.246.49
Name: chatloveonline.com
Address: 99.49.20.151
Name: chatloveonline.com
Address: 98.24.128.108
Name: chatloveonline.com
Address: 66.153.252.38
Name: chatloveonline.com
Address: 70.44.177.160
Name: chatloveonline.com
Address: 72.138.10.168
Name: chatloveonline.com
Address: 98.212.239.129
Name: chatloveonline.com
Address: 98.24.128.108
Name: chatloveonline.com
Address: 99.49.20.151
Name: chatloveonline.com
Address: 65.50.53.124
Name: chatloveonline.com
Address: 99.49.20.151
Name: chatloveonline.com
Address: 88.199.104.71
Name: chatloveonline.com
Address: 72.138.10.168
Name: chatloveonline.com
Address: 88.199.104.71
Name: chatloveonline.com
Address: 98.24.128.108
Name: chatloveonline.com
Address: 61.120.135.160
Name: chatloveonline.com
Address: 70.44.177.160
Name: chatloveonline.com
Address: 88.199.104.71
Name: chatloveonline.com
Address: 72.138.10.168
Name: chatloveonline.com
Address: 66.153.252.38
Name: chatloveonline.com
Address: 85.66.72.241
Name: chatloveonline.com
Address: 72.138.10.168
Name: chatloveonline.com
Address: 71.196.191.125
Name: chatloveonline.com
Address: 89.134.205.135
Name: chatloveonline.com
Address: 96.48.195.159
Name: chatloveonline.com
Address: 82.131.49.134
Name: chatloveonline.com
Address: 67.172.218.67
Name: chatloveonline.com
Address: 66.69.203.118
Name: chatloveonline.com
Address: 200.115.240.107
Name: chatloveonline.com
Address: 89.134.205.135
Name: chatloveonline.com
Address: 96.48.195.159
Name: chatloveonline.com
Address: 82.33.93.128
Name: chatloveonline.com
Address: 61.120.135.160
Name: chatloveonline.com
Address: 99.49.20.151
Name: chatloveonline.com
Address: 65.50.53.124
Name: chatloveonline.com
Address: 99.49.20.151
Name: chatloveonline.com
Address: 82.181.81.48
Name: chatloveonline.com
Address: 24.158.115.137
Name: chatloveonline.com
Address: 193.26.13.34
Name: chatloveonline.com
Address: 68.204.162.130
Name: chatloveonline.com
Address: 86.7.152.68
Name: chatloveonline.com
Address: 99.49.20.151
Name: chatloveonline.com
Address: 76.84.30.51
Name: chatloveonline.com
Address: 65.50.53.124
Name: chatloveonline.com
Address: 124.84.11.86
Name: chatloveonline.com
Address: 81.84.235.160
Name: chatloveonline.com
Address: 61.206.251.10
Name: chatloveonline.com
Address: 84.73.130.120
Name: chatloveonline.com
Address: 85.66.72.241
Name: chatloveonline.com
Address: 12.237.34.248
Name: chatloveonline.com
Address: 72.189.187.172
Name: chatloveonline.com
Address: 68.144.172.34
Name: chatloveonline.com
Address: 72.189.187.172
Name: chatloveonline.com
Address: 213.63.213.153
Name: chatloveonline.com
Address: 82.77.41.100
Name: chatloveonline.com
Address: 96.48.134.133
Name: chatloveonline.com
Address: 208.127.15.139
Name: chatloveonline.com
Address: 72.189.187.172
Name: chatloveonline.com
Address: 61.206.251.10
Name: chatloveonline.com
Address: 68.144.172.34
|
I'm just guessing that all the people who own
computers at those IP addresses were in a panic about Conficker
worm's April 1 variation. They needed to panic a little sooner when
they downloaded the trojan that handed control of their computers
over to the Waledac authors.
Here are many of the recent live domains. While
many domain names have "news" themes, chatloveonline.com
isn't the only one still surviving since Valentine's day. (These
are dangerous sites: Visit only if you know what you're doing, have
disabled javascripts, have your browser set to open a dialog window
whenever it downloads anything, and are not using Internet Explorer):
adorepoem.com
adoresong.com
antiterroralliance.com
antiterroris.com
antiterrornetwork.com
bayhousehotel.com
bestadore.com
bestbreakingfree.com
bestgoodnews.com
bestjournalguide.com
bestlifeblog.com
bestlovehelp.com
bestusablog.com
blogginhell.com
blogsitedirect.com
bluevalentineonline.com
boarddiary.com
breakinggoodnews.com
breakingkingnews.com
breakingnewsfm.com
breakingnewsltd.com
chatloveonline.com
cherishletter.com
cherishpoems.com
extendedman.com
farboards.com
fearalert.com
funnyvalentinessite.com
gonesite.com
goodnewsdigital.com
goodnewsreview.com
greatcouponclub.com
greatsvalentine.com
greatvalentinepoems.com
linkworldnews.com
longballonline.com
lovecentralonline.com
lovelifeportal.com
mobilephotoblog.com
photoblogsite.com
spacemynews.com
terroralertstatus.com
terrorismfree.com
thevalentinelovers.com
thevalentineparty.com
tntbreakingnews.com
urbanfear.com
whocherish.com
wirelessvalentineday.com
worldlovelife.com
worldnewsdot.com
worldtracknews.com
worshiplove.com
yourbreakingnew.com
yourcountycoupon.com
yourgreatlove.com
yourlength.com
yourlol.com
yourvalentinepoems.com
yourwent.com
April 1, 2009
USAA phish
It's a typical phish. The brand isn't as widely
known as targets like PayPal and Bank of America, so someone who
really deals with this company could be caught off guard. Also,
while the more popular targets pay people to investigate and shut
down phishing sites, a new target may not yet have such an arrangement.
|
To
ensure delivery to your inbox, please add USAA.Web.Services@customermail.usaa.com
to your address book.
Confirmation Form
Online Security Guarantee
Dear USAA Customer,
We would like to inform you that we have released a new version
of USAA Confirmation Form. This form is required to be completed
by all USAA customers. Please use the button below in order
to access the form:
Access USAA Confrmation Form
hank you,
USAA
Please do not reply to this e-mail. To send
a secure message to USAA, please contact us.
Privacy Promise
USAA, 9800 Fredericksburg Road, San Antonio, Texas 78288
USAA means United Services Automobile Association and its
insurance, banking, investment and other companies Banks Member
FDIC. Investments provided by USAA Investment Management Company
and USAA Financial Advisors Inc., both registered broker dealers.
|
And yes, it really did say "hank you."
There wasn't an image of a "T" there or anything.
This one is tricky. In addition to having images
that come from the real USAA site, there are also several links
to the real site. You have to search through to find out which one
is the phish:
|
<a rel=3D"nofollow" target=3D"_blank"
href=3D"https://www.usaa.com/inet/ent_logon/Logon?EID=3D66661-1208_head">
<a rel=3D"nofollow" target=3D"_blank"
href=3D"https://www.usaa.com/inet/ent_utils/McStaticPages?
key=3Dsecurity_guarantee&EID=3D66661-1208_head" style=3D
"color: rgb(182, 182, 182);">
<a href=3D"http://www.usaa.com.h1llf.com/inet/ent_formversionnew/
do_action?id=[code number]" style=3D"font-family:
arial,sans-serif;
font-style: normal; font-variant: normal; font-weight: bold;
font-size:
12px; line-height: normal; font-size-adjust: none; font-stretch:
normal;
-x-system-font: none; color: rgb(255, 255, 255); text-decoration:
none;">
<a rel=3D"nofollow" target=3D"_blank"
href=3D"https://www.usaa.com/inet/ent_references/CpSendUsAMessage
?ContentArea=3Dcp&EID=3D66661-1208_foot" style=3D"color:
rgb(64, 140, 176); text-decoration: none;">
<a rel=3D"nofollow" target=3D"_blank"
href=3D"https://www.usaa.com/inet/ent_utils/McStaticPages?
key=3Dprivacy_promise&EID=3D66661-1208_foot"
style=3D"color: rgb(109, 109, 109);">
<a rel=3D"nofollow" target=3D"_blank"
href=3D"https://www.usaa.com/inet/ent_utils/McStaticPages?
key=3Dabout_usaa_overview&EID=3D66661-1208_foot"
style=3D"color: rgb(64, 140, 176); text-decoration: none;">
|
(The links were live in the original email).
If you look carefully, while most of the links
have "usaa.com" right before the first single "/",
there is one different one:
usaa.com.h1llf.com/
That's the link that showed the phishing site:
There is no reason your bank needs to ask you
for this information, since they are the ones that gave it to you.
And a PIN number is only for in-person transactions. Notice also
that the link began "http://" not "https://".
The last "s" means it's a secure site, so the information
going back and forth is encrypted. No site should ever ask for a
credit card number if it doesn't have a secure server.
This particular phish is hosted on a botnet:
|
; <<>> DiG 9.2.3 <<>>
h1llf.com
;; QUESTION SECTION:
;h1llf.com. IN A
;; ANSWER SECTION:
h1llf.com. 1800 IN A 190.165.27.114
h1llf.com. 1800 IN A 201.215.161.113
h1llf.com. 1800 IN A 201.233.45.234
h1llf.com. 1800 IN A 213.231.106.104
h1llf.com. 1800 IN A 66.138.7.3
h1llf.com. 1800 IN A 70.153.216.198
h1llf.com. 1800 IN A 76.78.215.254
h1llf.com. 1800 IN A 76.205.126.12
h1llf.com. 1800 IN A 80.179.195.144
h1llf.com. 1800 IN A 84.21.24.12
h1llf.com. 1800 IN A 84.125.43.174
h1llf.com. 1800 IN A 84.126.26.207
h1llf.com. 1800 IN A 85.137.234.136
h1llf.com. 1800 IN A 85.181.8.255
h1llf.com. 1800 IN A 190.7.131.253
|
That's 15 "seats," or 15 different computers
hosting this site at one time.
The "1800" number is the "time
to live," or "TTL." When your computer wants to visit
a website, it has to ask where it is, it's IP address. The nameserver
is the official place to ask that information. But rather than having
everyone's computer asking the one that hosts the nameserver
every time someone wants to visit, other computers around
the internet will save the answer as a "cache." They will
then give that information again the next time someone wants to
visit the site, so the query doesn't have to travel so far. They
will continue to give the same answer until the cache expires. The
time to live tells them how long the information should be stored
before checking back with the nameserver to see if anything has
changed.. It's timed in seconds.
The typical TTL is 24 hours. But h1llf.com is
only committing itself to stay at these IP addresses for 1800 seconds,
or half an hour. Then it may have 15 completely different IP addresses.
That's a pretty good indication these are not the IP addresses of
ISP's paid to host this site. These are the computers of innocent
people with malware ("bad software") infections that have
allowed the phishers to gain access to use their computers. And
yes, your little home computer can host a website that everyone
on the internet can come and visit if you download something like
that.
h1llf.com is registered with Interdomain. The
nameservers for h1llf.com are
ns1.americans-tool.com
ns1.bus-on-line.com
Both of those are registered with Gandi. That's
not a bright move if you want your criminal domains to stay alive
long, as Gandi's abuse desk positively enjoys shutting these things
down and cooperating with law enforcement to investigate them.
Searching turns up a number of similar domains
using those nameservers:
i1hh1.com
jil1.com
h1ll1.com
hj1li.com
ji1fj.com
1jl1l.com
jj1fl.com
1hhl.com
ij1il.com
jl1il.com
americans-tool.com
dmoderss.com
imoderss.com
lmoderss.com
f1hj.net
f1hi.biz
Almost all of them are either shut down or have
moved to other nameservers that have been suspended already. So
the registrars involved seem to be jumping all over this one. The
only question is whether USAA has its own investigation team to
try to help the victims.
Castlecops' PIRT team used to do this for all
brands. While they were working, the recommendation was to report
phish to PIRT rather than shut it down yourself. That way they could
investigate and try to find the "drop file," the file
containing all the information that victims had entered into the
form. The victims could then be contacted and their accounts could
be shut down.
There is no way of knowing which phishing targets
handle this takedown for themselves. Some will have a link on their
real websites, so it's a good idea to notify them that way. But
otherwise, it's probably best to just report them via Complainterator
and get them shut down as quickly as possible.
|
Spamtrackers.org
