Phish Alert
 
 Full Report: /Abbey_Bank_Rock_Phish_phish984533.html
 
 Consumed following related reports:

[984534] http://www9.abbey.com.4stream.tw/CentralLogonWeb/Confirm?config=25kcnkwcyyD
[987538] http://ww9.nwolb.com.cmdid046730.4stream.tw/details/confirmpage.aspx?srv=26edyhzedLafDlczytbczyOkhOvp
Changed status to confirmed phish.The URL accesses a phishing site hosted on a bot net.
IP addresses 118.91.53.128, 189.32.51.125, 200.109.132.40, 213.134.38.73, 24.14.134.142, 24.15.33.3, 24.216.177.93, 65.25.97.106, 66.140.72.234, 67.174.94.127, 67.209.72.220, 68.62.230.232, 68.80.246.19, 71.84.127.132, 76.11.220.229, 76.27.213.215, 76.87.141.146, 79.181.196.5, 82.42.189.145, 85.59.51.79, 86.131.240.7, 91.117.246.87, 97.87.136.93, 98.14.118.181, 98.25.5.221, 99.171.162.183, 99.227.250.122 were active at Wed, 08 Oct 2008 17:49:48 +0000 (GMT).
Nameservers
NS1.4STREAM.TW [62.219.252.109] response 200.109.132.40, 24.14.134.142, 24.216.177.93, 65.25.97.106, 66.140.72.234, 67.174.94.127, 68.62.230.232, 76.11.220.229, 76.87.141.146, 79.181.196.5, 82.42.189.145, 86.131.240.7, 91.117.246.87, 97.87.136.93, 99.227.250.122 in 230 mSec
NS2.4STREAM.TW [68.197.137.239] response 118.91.53.128, 189.32.51.125, 213.134.38.73, 24.15.33.3, 67.174.94.127, 67.209.72.220, 68.62.230.232, 68.80.246.19, 71.84.127.132, 76.27.213.215, 85.59.51.79, 86.131.240.7, 98.14.118.181, 98.25.5.221, 99.171.162.183 in 95 mSec
NS3.4STREAM.TW [69.119.119.178] response 118.91.53.128, 189.32.51.125, 213.134.38.73, 24.15.33.3, 67.174.94.127, 67.209.72.220, 68.62.230.232, 68.80.246.19, 71.84.127.132, 76.27.213.215, 85.59.51.79, 86.131.240.7, 98.14.118.181, 98.25.5.221, 99.171.162.183 in 74 mSec
were active at the same time
=================================
REGISTRAR Twnic.net]:
Domain 4STREAM.TW has been registered with for fraudulent purposes.
It is part of a network of phishing sites hosted on a bot net.
Please suspend this domain immediately to prevent further criminal activity.
Please also check for any domains registered using the same (stolen) identity and credit card details, or the same email address.
=================================
NAMESERVER HOST BEZEQINT.NET:
Nameserver
NS1.4STREAM.TW [62.219.252.109] - response 230 mSec
has been set up on your network to serve addresses for this phishing domain and others.
No legitimate domains use this nameserver.
Please shut it down urgently.
Please close the customer's account.
If possible please also be alert for anyone setting up other nameservers on your network for this domain.
=================================