Phish Alert
 
 Full Report: /Rock_Phish_phish936810.html
 
 Consumed following related reports:

[936811] http://online3.lloydstsb.co.uk.econfirm.su/customer.ibc/?site=24ewddrcRKDfnhjdruhsylOkhb
[936949] http://www4.associatedbank.com.econfirm.su/web_bank/confirm.asp?refid=3D25rhscfvkprdsDefkayhfcyOrdn
[936950] http://www4.associatedbank.com.econfirm.su/web_bank/confirm.asp?refid=25rhscfvkprdsDefkayhfcyOrdn
Changed status to confirmed phish.IP Converted: 87.100.69.190

dword = 1466189246
hex1 = 0x576445be
hex2 = 0x57.0x64.0x45.0xbe
oct = 0127.0144.0105.0276
View CIDR AS35632 Report: http://www.cidr-report.org/cgi-bin/as-report?as=35632

"35632 | FR | ripencc | 2005-09-20 | IRIS64-AS IRIS64"<br />
Extended information for AS35632:
State/Province:
Country: fr
Responsible Domain: cegetel.fr
Abuse Email: postmaster@cegetel.fr
IP Converted: 121.150.131.120

dword = 2039907192
hex1 = 0x79968378
hex2 = 0x79.0x96.0x83.0x78
oct = 0171.0226.0203.0170
View CIDR AS4766 Report: http://www.cidr-report.org/cgi-bin/as-report?as=4766

"4766 | KR | apnic | 1996-04-22 | KIXS-AS-KR Korea Telecom"<br />
Extended information for AS4766:
State/Province:
Country: kr
Responsible Domain: kornet.net
Abuse Email: abuse@kornet.net
The URL accesses a phishing site with multiple fake banks.
IP addresses 121.150.131.120, 201.19.134.28, 216.153.185.96, 217.132.56.31, 24.122.86.246, 24.158.46.187, 24.178.231.190, 66.57.229.160, 69.138.54.135, 70.216.179.129, 71.104.168.205, 71.197.177.25, 72.188.242.106, 75.104.65.190, 75.146.254.133, 75.65.229.157, 75.74.206.169, 76.250.188.196, 76.73.215.171, 79.146.18.206, 83.87.107.104, 98.213.126.234, 99.165.169.234 were active at Fri, 22 Aug 2008 16:54:36 +0000 (GMT).
Nameservers
NS1.ECONFIRM.SU [69.119.119.178] response 121.150.131.120, 201.19.134.28, 216.153.185.96, 24.122.86.246, 24.158.46.187, 66.57.229.160, 71.104.168.205, 71.197.177.25, 72.188.242.106, 75.104.65.190, 75.146.254.133, 76.250.188.196, 79.146.18.206, 83.87.107.104, 99.165.169.234 in 137 mSec
NS2.ECONFIRM.SU [200.83.189.134] response 121.150.131.120, 217.132.56.31, 24.158.46.187, 24.178.231.190, 66.57.229.160, 69.138.54.135, 70.216.179.129, 71.104.168.205, 72.188.242.106, 75.65.229.157, 75.74.206.169, 76.73.215.171, 83.87.107.104, 98.213.126.234, 99.165.169.234 in 1044 mSec
NS3.ECONFIRM.SU [75.67.216.154] response 121.150.131.120, 217.132.56.31, 24.158.46.187, 24.178.231.190, 66.57.229.160, 69.138.54.135, 70.216.179.129, 71.104.168.205, 72.188.242.106, 75.65.229.157, 75.74.206.169, 76.73.215.171, 83.87.107.104, 98.213.126.234, 99.165.169.234 in 140 mSec
were active at the same time
=================================

REGISTRAR NAUNET-REG-FID:
Domain ECONFIRM.SU has been registered with NAUNET-REG-FID for fraudulent purposes.
It is part of a network of phishing sites with multiple fake banks and it is used for nameservers.
Please suspend this domain immediately to prevent further criminal activity.
Please also check for any domains registered using the same (stolen) identity and credit card details, or the same email address.
=================================
HOST IRIS64:
The machine at IP address
87.100.69.190
is acting as proxy for the real server for these criminal websites. Please shut it down.
PLEASE check the logs for this IP to find the address that it was forwarding
requests to at the time given above , and pass the information to us or to Law Enforcement.
=================================
HOST kornet.net
The machine at IP address
121.150.131.120
is acting as proxy for the real server for these criminal websites. Please shut it down.
PLEASE check the logs for this IP to find the address that it was forwarding
requests to at the time given above , and pass the information to us or to Law Enforcement.
=================================