On 02/13/2011, I found several domains used for Facebook phishing, registered the same day:
These domains contain the same page: a simple form to enter a Facebook login and password.
|Facebook Phishing page
After entering the credentials, users are redirected to http://www.facebook.com/pages/Image-hosting-service/106354426063487#!/album.php?profile=1&id=208421665712
, which lands the user at their Profile Pictures
page. If the user was not yet logged into Facebook, he must login "again". The phishing page does not post the credentials to Facebook on the user's behalf.
All of the domains were registered by the same individual in China.
|WHOIS information for highsecuritydirect.com
The domains are bound to multiple IP addresses that change rapidly (aka fast-flux DNS):
|DNS information for highsecuritydirect.com
They all use the DNS server fbnameserver.com
, which has been used for other Facebook phishing sites in the past.
On 02/14/2011, these 6 domains where redirecting users to http://www.google.com/
in the morning. In the afternoon, they redirected users to http://www.facebook.com/
. On 02/16/2011, they seem to display the phishing pages all the time. I'm not sure why these redirections were set up earlier.
These domains are not yet blocked by Google Safe Browsing.