CastleCops, Internet Crime Fighters
Need help? Click here to register for free! Absolutely zero advertisements on this site!

Donation/Premium
spacer
block bottom
Security Central
spacer
· Home
· PIRT/Fried Phish
· MIRT
· SIRT
· Deutsch
· Wiki
· Newsletter
· O16/ActiveX
· CLSID List
· Contest2007
· Downloads
· Feedback (send)
· Forums
· HijackThis
· Hijacktrend
· LSPs
· My Downloads
· O18
· O20
· O21
· O22
· O23
· O9
· Premium
· Private Messages
· Proxomitron
· Reviews
· Search
· StartupList
· Stories Archive
· Submit News
· WsIRT
· Your Account
· Acceptable Use Policy
block bottom
spacer spacer

educational parked domain page

 
Post new topic   Reply to topic       All -> FavForums -> Phishing, Fraud and Dastardly Deeds [del.icio.us!] [digg it!] [reddit!]
View previous topic :: View next topic  
Author Message
AlphaCentauri

SIRT Handler
Premium Member

Joined: Nov 20, 2003
Posts: 2886

Premium

PostPosted: Tue Apr 29, 2008 8:36 pm    Post subject: educational parked domain page
Reply with quote

Maybe some of you have seen this, but it's the first I've seen. The domain has been suspended. If you check under the plain domain name you get a typical parked page advertising the registrar. But if you are following the phishing link, you get a specific warning:
http://commercial.wachovia.com.field66.tk/Online/Financial/Business/Service/

I'm not sure what the "domains on last five vists" means, unless it has been recording my IP address (it's still there when I use another browser, so it isn't a cookie). I was running IDSpam to find the active phish to report, so I visited an assortment of dead phish links on .tk domains within a short period.

I wish Blogspot would do something similar.

Back to top
View users profile Send private message
s0tet

PIRT Handler


Joined: May 21, 2005
Posts: 2965

Phishing Squad

PostPosted: Sat May 10, 2008 2:31 am    Post subject:
Reply with quote

The link above now points back to the registrar for the .tk domain.

Latey, I have been seeing these parked pages on more than 1 host lately for suspended fraudulent phishing domains

They look like this:

online.etrade.com.nichola2008.com.es

This website was seized and shutdown for spam and other abuses.

Domains on last five visits:
6733 : http://online.etrade.com.ichola2008.es +
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8. x


If you are here you need email protection or education.

1. You should not get any spam so replace or upgrade your email protection if you do.

2. You should know not to click on strange emails and carefully examine links. consumer advice from antiphishing.org

=======================

The final link points to:

http://www.antiphishing.org/consumer_recs.html

Back to top
View users profile Send private message Send email
AlphaCentauri

SIRT Handler
Premium Member

Joined: Nov 20, 2003
Posts: 2886

Premium

PostPosted: Sat May 10, 2008 5:02 am    Post subject:
Reply with quote

Yes, that's the same one I saw. It didn't remain up long, but I suppose it didn't need to.

Back to top
View users profile Send private message
Display posts from previous:   
Post new topic   Reply to topic       All -> FavForums -> Phishing, Fraud and Dastardly Deeds All times are GMT
Page 1 of 1

 
Quick Reply:
Username: 

Quote the last message
Attach signature (signatures can be changed in profile)
 
You can post new topics in this forum
You can reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum


Powered by phpBB © 2001 phpBB Group
spacer spacer