Hi,
Some recent data, attack on "Associated Bank" and "Bank of America"
(Fast-Flux):
Associated Bank:
hxxp://*.bikoem.com/confirm.asp
hxxp://*.bnyril.com/confirm.asp
hxxp://*.caloshe.com/confirm.asp
hxxp://*.dnreru.com/confirm.asp
hxxp://*.eirinf.com/confirm.asp
hxxp://*.gamanzi.com/confirm.asp
hxxp://*.jerriin.com/confirm.asp
hxxp://*.jiolof.com/confirm.asp
hxxp://*.kelrfo.com/confirm.asp
hxxp://*.knezzei.com/confirm.asp
hxxp://*.ksdeaaz.com/confirm.asp
hxxp://*.lavvis.com/confirm.asp
hxxp://*.miefjko.com/confirm.asp
hxxp://*.miogef.com/confirm.asp
hxxp://*.nefgie.com/confirm.asp
hxxp://*.qioche.com/confirm.asp
hxxp://*.sefiddo.com/confirm.asp
Bank of America - Pushing Trojans:
hxxp://*.bikoem.com/verify.htm
hxxp://*.bnyril.com/verify.htm
hxxp://*.caloshe.com/verify.htm
hxxp://*.dnreru.com/verify.htm
hxxp://*.eirinf.com/verify.htm
hxxp://*.gamanzi.com/verify.htm
hxxp://*.jerriin.com/verify.htm
hxxp://*.jiolof.com/verify.htm
hxxp://*.kelrfo.com/verify.htm
hxxp://*.kelrfo.com',/verify.htm
hxxp://*.knezzei.com/verify.htm
hxxp://*.ksdeaaz.com/verify.htm
hxxp://*.lavvis.com/verify.htm
hxxp://*.miefjko.com/verify.htm
hxxp://*.miogef.com/verify.htm
hxxp://*.nefgie.com/verify.htm
hxxp://*.qioche.com/verify.htm
hxxp://*.sefiddo.com/verify.htm
-- Michael
P.S. I am not (yet) subscribed to phishing@, please kindly contact directly
if there should be any concerns
_______________________________________________
botnets@, the public's dumping ground for maliciousness
All list and server information are public and available to law enforcement
upon request.
http://www.whitestar.linuxbox.org/mailman/listinfo/botnets
