Late Notes

I did not note a few weeks ago they seemed to be buying and using .eu domains like crazy. They have since just stopped. Dead cold. At very least, a dry tickle.

The latest phishbait includes msvideoc.exe

Before that they seemed to be dumping IP numbers. After that they went to zero on that scheme. That said, they have started dumping again.

Currently, they are dumping .cn (china) domains like crazy. Perhaps, china is cracking down on them.

TC

Increase in hijacked sites.

There has been a large increase in hijacked websites, especially those that have the video.exe and video1.exe. The same goes for redirected websites and hijacked php websites.

Old, but a goodie.

The tatics are now down to the oldies, goodies

1) send us your name
2) send us your password

Increase in IPs

Recently, there has been an increase of raw IPs given. I'm not entirely sure of what to make of it. It is significant somehow. I have a few ideas. More on this later.

Example of hijacked machine.

No firewall? No clue?

Here is a URL address of a machine that was hijacked and they are using an alternate port (84) to phish for ebay names and passwords. At first I did not recognize it, but 3 or 4 seconds later it dawned upon me what was going on.

http://207-172-200-73.c3-0.upd-ubr13.trpr-upd.pa.cable.rcn.com:84/www.ebay.com-signin-ebay.com.html

No Sacred Ground

Today a new domain caught my eye. I though, perhaps, that it was a hijacked domain, but not. It advertises "the latest update in ED treatment", with it being a "Limited time offer". (ED, of course, being Erectial Dysfunction.)

Anyhow, the domain is healthykidsinc.com
I guess it relates.

Ramping up.

Volume of spam over the last few days has ramped up. In addition, it looks like the captcha at geocites.com has completed failed. They have become blatant to the point of being obvious. As and example, they have completely given up on using "real sounding" domain names.

Here are a couple names as an examples.

kdoitueuryfgvavec.com

www.geocities.com/barbaraafkdxdy