On 02/13/2011, I found several domains used for Facebook phishing, registered the same day:

• securedirectsite.com
• directsecuresite.com
• securedsitedirect.com
• highsecuritydirect.com
• securedsitedirect.com
• officialsecuredsite.com

These domains contain the same page: a simple form to enter a Facebook login and password.

 

Facebook Phishing page

After entering the credentials, users are redirected to http://www.facebook.com/pages/Image-hosting-service/106354426063487#!/album.php?profile=1&id=208421665712, which lands the user at their Profile Pictures page. If the user was not yet logged into Facebook, he must login "again". The phishing page does not post the credentials to Facebook on the user's behalf.

Fast-flux DNS

All of the domains were registered by the same individual in China. 

WHOIS information for highsecuritydirect.com

The domains are bound to multiple IP addresses that change rapidly (aka fast-flux DNS):

DNS information for highsecuritydirect.com

They all use the DNS server fbnameserver.com, which has been used for other Facebook phishing sites in the past.

Random redirections

On 02/14/2011, these 6 domains where redirecting users to http://www.google.com/ in the morning. In the afternoon, they redirected users to http://www.facebook.com/. On 02/16/2011, they seem to display the phishing pages all the time. I'm not sure why these redirections were set up earlier.

These domains are not yet blocked by Google Safe Browsing.

-- Julien