CastleCops, Internet Crime Fighters
Need help? Click here to register for free! Absolutely zero advertisements on this site!

Donation/Premium
spacer
block bottom
Security Central
spacer
· Home
· PIRT/Fried Phish
· MIRT
· SIRT
· Deutsch
· Wiki
· Newsletter
· O16/ActiveX
· CLSID List
· Contest2007
· Downloads
· Feedback (send)
· Forums
· HijackThis
· Hijacktrend
· LSPs
· My Downloads
· O18
· O20
· O21
· O22
· O23
· O9
· Premium
· Private Messages
· Proxomitron
· Reviews
· Search
· StartupList
· Stories Archive
· Submit News
· WsIRT
· Your Account
· Acceptable Use Policy
block bottom
spacer spacer

[PIRT#987359] Botnet Phish on HIT12.TV

 
Post new topic   Reply to topic       All -> FavForums -> PIRT Fried Phish Reports [del.icio.us!] [digg it!] [reddit!]
View previous topic :: View next topic  
Author Message
s0tet

PIRT Handler


Joined: May 21, 2005
Posts: 2976

Phishing Squad

PostPosted: Wed Oct 08, 2008 5:43 pm    Post subject: [PIRT#987359] Botnet Phish on HIT12.TV
Reply with quote

Phish Alert
 
 Full Report: CastleCops Link/Abbey_Bank_Rock_Phish_phish987359.html
 
 Changed status to confirmed phish.IP Converted: 189.18.27.188

dword = 3172080572
hex1 = 0xbd121bbc
hex2 = 0xbd.0x12.0x1b.0xbc
oct = 0275.022.033.0274
View CIDR AS27699 Report: http://www.cidr-report.org/cgi-bin/as-report?as=27699

"27699 | BR | lacnic | 2003-06-24 | TELECOMUNICACOES DE SAO PAULO S/A - TELESP"<br />
Extended information for AS27699:
State/Province:
Country: br
Responsible Domain: telesp.com.br
Abuse Email: abuse@telesp.net.br
The URL accesses a phishing site hosted on a bot net.
IP addresses 189.18.27.188, 190.189.224.188, 201.254.40.13, 212.97.174.149, 213.60.16.70, 41.251.54.175, 60.244.1.19, 61.229.188.153, 65.66.216.52, 69.1.18.70, 72.28.229.72, 75.3.117.23, 76.67.114.104, 81.225.250.57, 82.101.159.231, 83.168.122.11, 83.173.186.120, 85.87.4.220, 87.116.180.136, 92.237.33.17, 93.173.92.92, 98.235.59.239, 99.144.82.183 were active at Wed, 08 Oct 2008 15:17:05 +0000 (GMT).
Nameservers
NS1.HIT12.TV [69.119.119.178] response 189.18.27.188, 190.189.224.188, 201.254.40.13, 212.97.174.149, 60.244.1.19, 61.229.188.153, 65.66.216.52, 69.1.18.70, 72.28.229.72, 75.3.117.23, 76.67.114.104, 81.225.250.57, 82.101.159.231, 83.173.186.120, 98.235.59.239 in 82 mSec
NS3.HIT12.TV [76.182.187.206] response 190.189.224.188, 201.254.40.13, 212.97.174.149, 213.60.16.70, 41.251.54.175, 65.66.216.52, 82.101.159.231, 83.168.122.11, 83.173.186.120, 85.87.4.220, 87.116.180.136, 92.237.33.17, 93.173.92.92, 98.235.59.239, 99.144.82.183 in 78 mSec
were active at the same time
=================================
REGISTRAR -----REGISTRAR_HERE----:
Domain HIT12.TV has been registered with stargateinc.comfor fraudulent purposes.
It is part of a network of phishing sites hosted on a bot net.
Please suspend this domain immediately to prevent further criminal activity.
Please also check for any domains registerIP Converted: 212.97.174.149

dword = 3563171477
hex1 = 0xd461ae95
hex2 = 0xd4.0x61.0xae.0x95
oct = 0324.0141.0256.0225
View CIDR AS13143 Report: http://www.cidr-report.org/cgi-bin/as-report?as=13143

"13143 | ES | ripencc | 2000-06-30 | ARAGON DE CABLE"<br />
Extended information for AS13143:
State/Province:
Country: es
Responsible Domain: auna.es
Abuse Email: abuse@auna.es
IP Converted: 69.1.18.70

dword = 1157698118
hex1 = 0x45011246
hex2 = 0x45.0x1.0x12.0x46
oct = 0105.01.022.0106
View CIDR AS12083 Report: http://www.cidr-report.org/cgi-bin/as-report?as=12083

"12083 | US | arin | 1999-03-19 | KNOLOGY-NET - Knology Holdings"<br />
Extended information for AS12083:
State/Province: ga
Country: us
Responsible Domain: knology.net
Abuse Email: abuse@knology.net
IP Converted: 98.235.59.239

dword = 1659583471
hex1 = 0x62eb3bef
hex2 = 0x62.0xeb.0x3b.0xef
oct = 0142.0353.073.0357
View CIDR AS33287 Report: http://www.cidr-report.org/cgi-bin/as-report?as=33287

"33287 | US | arin | 2004-11-16 | DNEO-OSP4 - Comcast Cable Communications, Inc."<br />
Extended information for AS33287:
State/Province: nj
Country: us
Responsible Domain: comcast.net
Abuse Email: abuse@comcast.net

Quote:
http://ww0.abbey-business.hit12.tv/CentralLogonWeb/Confirm

Back to top
View users profile Send private message Send email
Display posts from previous:   
Post new topic   Reply to topic       All -> FavForums -> PIRT Fried Phish Reports All times are GMT
Page 1 of 1

 
Quick Reply:
Username: 

Quote the last message
Attach signature (signatures can be changed in profile)
 
You can post new topics in this forum
You can reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum


Powered by phpBB © 2001 phpBB Group
spacer spacer