Anatomy of a Rock	Posted by Mikko @ 10:47 GMT

Let's have a closer look at a typical rock phish.

Here's the mail, sent yesterday:



The link points to paypal-user-confirm.com/acc/login.php. The domain was registered a week ago with bogus whois data and (we guess) a stolen credit card.



Here's what the site looks like:



Let's see where this is hosted.



This IP address is physically in Israel. Let's see what the front page looks like.



Ah. "209.1 Host Locked".

This. is. Rock. phish.

While we wait for the abuse messages to go through, lets have a quick look at what kind of host names in addition to paypal-user-confirm.com have been pointing to this same IP address.

Turns out that's quite a list, here's a sampling:

paypal-secure-login.com
citibank.com.defelopour1.es
citibank.com.defelopour3.es
citibank.com.defelopour4.es
citibank.com.defelopour61.es
citibank.com.fgh45.hk
citibank.com.fgh67.hk
citibank.com.had.st
citibank.com.host56.hk
citibank.com.losao0.es
citibank.com.losao1.es
citibank.com.losao2.es
citibank.com.platoniv5.es
citibank.com.platoniv7.es
citibank.com.platoniv8.es
citibank.com.radio78.net
citibank.com.raduo4.es
citibank.com.readyonline.es
citibank.com.torbirt1.es
citibank.com.torbirt4.es
citibank.com.torbirt7.es
citibank.com.trek.st
bibform.hsbc.com.defelopour1.es
bibform.hsbc.com.defelopour3.es
bibform.hsbc.com.defelopour4.es
bibform.hsbc.com.fgh67.hk
bibform.hsbc.com.had.st
bibform.hsbc.com.host56.hk
bibform.hsbc.com.losao.hk
bibform.hsbc.com.losao0.es
bibform.hsbc.com.losao1.es
bibform.hsbc.com.losao3.es
bibform.hsbc.com.platoniv7.es
bibform.hsbc.com.platoniv9.es
bibform.hsbc.com.readyonline.es
bibform.hsbc.com.torbirt1.es
bibform.hsbc.com.torbirt4.es
bibform.hsbc.com.torbirt9.es
bibform.hsbc.com.trek.st
bibform.hsbc.com.xn--hjk78-qo7mo3n.hk
citibusiness.citibank.com.dastin1.es
citibusiness.citibank.com.dastin1.nom.es
citibusiness.citibank.com.dastin1.org.es
citibusiness.citibank.com.defelopour1.es
citibusiness.citibank.com.defelopour2.es
citibusiness.citibank.com.fast5.net.in
citibusiness.citibank.com.fast5.org.cn
citibusiness.citibank.com.fast5.org.in
citibusiness.citibank.com.fgh45.hk
citibusiness.citibank.com.host56.hk
citibusiness.citibank.com.losao.hk
citibusiness.citibank.com.losao0.es
citibusiness.citibank.com.losao1.es
citibusiness.citibank.com.losao2.es
citibusiness.citibank.com.platoniv7.es
citibusiness.citibank.com.platoniv8.es
citibusiness.citibank.com.platoniv9.es
citibusiness.citibank.com.readyonline.es
citibusiness.citibank.com.realo7.firm.in
citibusiness.citibank.com.torbirt1.es
citibusiness.citibank.com.torbirt4.es
citibusiness.citibank.com.torbirt9.es
citibusiness.citibank.com.trek.st
citibusinessonline.citibank.com.defelopour2.es
citibusinessonline.citibank.com.defelopour5.es
citibusinessonline.citibank.com.defelopour61.es
citibusinessonline.citibank.com.fgh45.hk
citibusinessonline.citibank.com.fgh67.hk
citibusinessonline.citibank.com.had.st
citibusinessonline.citibank.com.host56.hk
citibusinessonline.citibank.com.losao.hk
citibusinessonline.citibank.com.losao2.es
citibusinessonline.citibank.com.losao5.es
citibusinessonline.citibank.com.platoniv1.es
citibusinessonline.citibank.com.platoniv3.es
citibusinessonline.citibank.com.platoniv4.es
citibusinessonline.citibank.com.platoniv6.es
citibusinessonline.citibank.com.platoniv7.es
citibusinessonline.citibank.com.radio78.net
citibusinessonline.citibank.com.raduo4.es
citibusinessonline.citibank.com.torbirt1.es
citibusinessonline.citibank.com.torbirt4.es
citibusinessonline.citibank.com.torbirt7.es
citibusinessonline.citibank.com.torbirt8.es
citibusinessonline.citibank.com.trek.st
citibusinessonline.citibank.com.xn--hjk78-qo7mo3n.hk
citibusinessonline.citibank.com.xn--ursa12-110l.hk
citibusinessonline.da-us.citi.com.defelopour1.es
citibusinessonline.da-us.citi.com.defelopour2.es
citibusinessonline.da-us.citi.com.defelopour5.es
citibusinessonline.da-us.citi.com.fgh45.hk
citibusinessonline.da-us.citi.com.fgh67.hk
citibusinessonline.da-us.citi.com.had.st
citibusinessonline.da-us.citi.com.losao1.es
citibusinessonline.da-us.citi.com.losao3.es
citibusinessonline.da-us.citi.com.platoniv8.es
citibusinessonline.da-us.citi.com.platoniv9.es
citibusinessonline.da-us.citi.com.radio5.es
citibusinessonline.da-us.citi.com.radio78.net
citibusinessonline.da-us.citi.com.raduo4.es
citibusinessonline.da-us.citi.com.readyonline.es
citibusinessonline.da-us.citi.com.torbirt1.es
citibusinessonline.da-us.citi.com.torbirt4.es
citibusinessonline.da-us.citi.com.trek.st
citibusinessonline.da-us.citi.com.xn--ursa12-110l.hk
citibusinessonline.da-us.citibank.com.defelopour2.es
citibusinessonline.da-us.citibank.com.defelopour61.es
citibusinessonline.da-us.citibank.com.had.st
citibusinessonline.da-us.citibank.com.host56.hk
citibusinessonline.da-us.citibank.com.losao1.es
citibusinessonline.da-us.citibank.com.losao2.es
citibusinessonline.da-us.citibank.com.platoniv9.es
citibusinessonline.da-us.citibank.com.radio5.es
citibusinessonline.da-us.citibank.com.raduo4.es
citibusinessonline.da-us.citibank.com.readyonline.es
citibusinessonline.da-us.citibank.com.torbirt1.es
citibusinessonline.da-us.citibank.com.torbirt4.es
citibusinessonline.da-us.citibank.com.torbirt9.es
citibusinessonline.da-us.citibank.com.xn--ursa12-110l.hk
direct-certs.bankofamerica.com.losao8.es
direct-certs.bankofamerica.com.platoniv9.es
natwest.co.uk.dastin1.es
natwest.co.uk.dastin1.nom.es
natwest.co.uk.dastin1.org.es
natwest.co.uk.defelopour1.es
natwest.co.uk.defelopour2.es
natwest.co.uk.defelopour3.es
natwest.co.uk.defelopour4.es
natwest.co.uk.defelopour5.es
natwest.co.uk.defelopour61.es
natwest.co.uk.fast5.co.in
natwest.co.uk.fast5.firm.in
natwest.co.uk.fast5.gen.in
natwest.co.uk.fast5.ind.in
natwest.co.uk.fast5.net.in
natwest.co.uk.fast5.org.cn
natwest.co.uk.fast5.org.in
natwest.co.uk.fgh45.hk
natwest.co.uk.fgh67.hk
natwest.co.uk.host56.hk
natwest.co.uk.losao.hk
natwest.co.uk.losao1.es
natwest.co.uk.losao2.es
natwest.co.uk.losao3.es
natwest.co.uk.platoniv8.es
natwest.co.uk.platoniv9.es
natwest.co.uk.radio78.net
natwest.co.uk.readyonline.es
natwest.co.uk.realo7.firm.in
natwest.co.uk.torbirt1.es
natwest.co.uk.torbirt4.es
natwest.co.uk.trek.st
natwest.co.uk.xn--ursa12-110l.hk
natwest.com.dastin1.es
natwest.com.dastin1.nom.es
natwest.com.dastin1.org.es
natwest.com.defelopour1.es
natwest.com.defelopour2.es
natwest.com.defelopour3.es
natwest.com.defelopour4.es
natwest.com.defelopour5.es
natwest.com.defelopour61.es
natwest.com.fast5.co.in
natwest.com.fast5.firm.in
natwest.com.fast5.gen.in
natwest.com.fast5.net.in
natwest.com.fast5.org.cn
natwest.com.fast5.org.in
natwest.com.fgh45.hk
natwest.com.had.st
natwest.com.host56.hk
natwest.com.losao.hk
natwest.com.losao0.es
natwest.com.losao1.es
natwest.com.losao2.es
natwest.com.platoniv7.es
natwest.com.platoniv8.es
natwest.com.raduo4.es
natwest.com.readyonline.es
natwest.com.torbirt1.es
natwest.com.torbirt4.es
natwest.com.xn--hjk78-qo7mo3n.hk
natwest.com.xn--ursa12-110l.hk
online.natwest.co.uk.dastin1.es
online.natwest.co.uk.dastin1.nom.es
online.natwest.co.uk.dastin1.org.es
online.natwest.co.uk.fast5.net.in
online.natwest.co.uk.fast5.org.cn
online.natwest.co.uk.fast5.org.in
online.natwest.co.uk.fgh45.hk
online.natwest.co.uk.had.st
online.natwest.co.uk.host56.hk
online.natwest.co.uk.losao.hk
online.natwest.co.uk.losao2.es
online.natwest.co.uk.losao3.es
online.natwest.co.uk.losao5.es
online.natwest.co.uk.platoniv8.es
online.natwest.co.uk.platoniv9.es
online.natwest.co.uk.radio78.net
online.natwest.co.uk.readyonline.es
online.natwest.co.uk.realo7.firm.in
online.natwest.co.uk.torbirt5.es
online.natwest.co.uk.torbirt6.es
online.natwest.co.uk.torbirt7.es
online.natwest.co.uk.torbirt8.es
online.natwest.co.uk.torbirt9.es
online.natwest.co.uk.xn--hjk78-qo7mo3n.hk
online.natwest.co.uk.xn--ursa12-110l.hk
online.natwest.com.dastin1.org.es
online.natwest.com.defelopour1.es
online.natwest.com.defelopour5.es
online.natwest.com.defelopour61.es
online.natwest.com.fast5.co.in
online.natwest.com.fast5.firm.in
online.natwest.com.fast5.gen.in
online.natwest.com.fast5.ind.in
online.natwest.com.fast5.net.in
online.natwest.com.fast5.org.cn
online.natwest.com.fast5.org.in
online.natwest.com.fgh45.hk
online.natwest.com.host56.hk
online.natwest.com.losao.hk
online.natwest.com.losao0.es
online.natwest.com.losao1.es
online.natwest.com.losao2.es
online.natwest.com.platoniv8.es
online.natwest.com.platoniv9.es
online.natwest.com.radio5.es
online.natwest.com.radio78.net
online.natwest.com.readyonline.es
online.natwest.com.realo7.firm.in
online.natwest.com.torbirt1.es
online.natwest.com.torbirt4.es
online.natwest.com.trek.st
online.natwest.com.xn--ursa12-110l.hk
uk.natwest.com.dastin1.nom.es
uk.natwest.com.dastin1.org.es
uk.natwest.com.defelopour1.es
uk.natwest.com.defelopour2.es
uk.natwest.com.fast5.co.in
uk.natwest.com.fast5.firm.in
uk.natwest.com.fast5.org.cn
uk.natwest.com.fgh45.hk
uk.natwest.com.had.st
uk.natwest.com.host56.hk
uk.natwest.com.losao.hk
uk.natwest.com.losao0.es
uk.natwest.com.losao1.es
uk.natwest.com.platoniv9.es
uk.natwest.com.radio78.net
uk.natwest.com.realo7.firm.in
uk.natwest.com.torbirt1.es
uk.natwest.com.torbirt4.es
uk.natwest.com.torbirt9.es
uk.natwest.com.trek.st
uk.natwest.com.xn--hjk78-qo7mo3n.hk
uk.natwest.com.xn--ursa12-110l.hk
www.53.com.dastin1.es
www.53.com.dastin1.nom.es
www.53.com.dastin1.org.es
www.53.com.defelopour1.es
www.53.com.defelopour2.es
www.53.com.fast5.co.in
www.53.com.fast5.firm.in
www.53.com.fast5.gen.in
www.53.com.fast5.ind.in
www.53.com.fast5.net.in
www.53.com.losao8.es
www.53.com.losao9.es
www.53.com.platoniv1.es
www.53.com.platoniv2.es
www.53.com.platoniv3.es
www.53.com.readyonline.es
www.53.com.realo7.firm.in
www.53.com.torbirt4.es
www.53.com.xn--ursa12-110l.hk
...

Yes, it goes on. Oh well.