Insights and Research
Facebook Phishing Pages
On 02/13/2011, I found several domains used for Facebook phishing, registered the same day:
After entering the credentials, users are redirected to http://www.facebook.com/pages/Image-hosting-service/106354426063487#!/album.php?profile=1&id=208421665712, which lands the user at their Profile Pictures page. If the user was not yet logged into Facebook, he must login "again". The phishing page does not post the credentials to Facebook on the user's behalf.
Fast-flux DNS
All of the domains were registered by the same individual in China.
The domains are bound to multiple IP addresses that change rapidly (aka fast-flux DNS):
They all use the DNS server fbnameserver.com, which has been used for other Facebook phishing sites in the past.
Random redirections
On 02/14/2011, these 6 domains where redirecting users to http://www.google.com/ in the morning. In the afternoon, they redirected users to http://www.facebook.com/. On 02/16/2011, they seem to display the phishing pages all the time. I'm not sure why these redirections were set up earlier.
These domains are not yet blocked by Google Safe Browsing.
-- Julien
- securedirectsite.com
- directsecuresite.com
- securedsitedirect.com
- highsecuritydirect.com
- securedsitedirect.com
- officialsecuredsite.com
 |
| Facebook Phishing page |
After entering the credentials, users are redirected to http://www.facebook.com/pages/Image-hosting-service/106354426063487#!/album.php?profile=1&id=208421665712, which lands the user at their Profile Pictures page. If the user was not yet logged into Facebook, he must login "again". The phishing page does not post the credentials to Facebook on the user's behalf.
Fast-flux DNS
All of the domains were registered by the same individual in China.
 | |
| WHOIS information for highsecuritydirect.com |
The domains are bound to multiple IP addresses that change rapidly (aka fast-flux DNS):
 |
| DNS information for highsecuritydirect.com |
Random redirections
On 02/14/2011, these 6 domains where redirecting users to http://www.google.com/ in the morning. In the afternoon, they redirected users to http://www.facebook.com/. On 02/16/2011, they seem to display the phishing pages all the time. I'm not sure why these redirections were set up earlier.
These domains are not yet blocked by Google Safe Browsing.
-- Julien