On 02/13/2011, I found several domains used for Facebook phishing, registered the same day:
- securedirectsite.com
- directsecuresite.com
- securedsitedirect.com
- highsecuritydirect.com
- securedsitedirect.com
- officialsecuredsite.com
These domains contain the same page: a simple form to enter a Facebook login and password.
![]() |
Facebook Phishing page |
After entering the credentials, users are redirected to
http://www.facebook.com/pages/Image-hosting-service/106354426063487#!/album.php?profile=1&id=208421665712, which lands the user at their
Profile Pictures page. If the user was not yet logged into Facebook, he must login "again". The phishing page does not post the credentials to Facebook on the user's behalf.
Fast-flux DNS
All of the domains were registered by the same individual in China.
![]() |
WHOIS information for highsecuritydirect.com |
|
The domains are bound to multiple IP addresses that change rapidly (aka fast-flux DNS):
![]() |
DNS information for highsecuritydirect.com |
They all use the DNS server
fbnameserver.com, which has been used for other Facebook phishing sites in the past.
Random redirections
On 02/14/2011, these 6 domains where redirecting users to
http://www.google.com/ in the morning. In the afternoon, they redirected users to
http://www.facebook.com/. On 02/16/2011, they seem to display the phishing pages all the time. I'm not sure why these redirections were set up earlier.
These domains are not yet blocked by Google Safe Browsing.
-- Julien