Chinese Phishing Sites: Stocks and Government Lottery

December 15, 2010 - 2 Min. de leitura

Conteúdo

Article
Mais blogs

I find Chinese phishing sites particularly interesting. For starters, they don't seem to attract too many security researchers. I have found that very few Chinese sites are blocked by Phishtank or Google Safe Browsing. Additionally, the type of phishing is very different from what we see in the US or other western countries. While sites related to banking (PayPal, Bank of America, JPMorgan, etc.) are the primary targets of phishers overall, Chinese phishing sites are mainly focused on QQ (instant messaging, online games, etc.) or Yahoo! Auctions.

Recently, I found two Chinese phishing/scam sites: a site about stocks from Shanghai Huaer Securities and a site for a government lottery. These two types of sites use a large number of pages with an iframe displaying the main site, and both follow a similar layout. The domain names are registered to different people, so the phishers may not be affiliated.

Shanghai Huaer Securities

This site claims to be a stock trading company for the Shanghai Securities market.

Shanghai Securities trading site

The main sites is hosted on huaerzq.com. The "Add to Favorite" links do not use the same domain. Rather, they leverage short links (http://www.goo.gl/YebPW) which redirect to huaer88997766.now.to, which is simply an iframe to huaerzq.com.

There are many now.to sub-domains which display this website:

soso112233.now.to
huaer88997766.now.to
hua123567000.now.to
hua88899900.now.to
gugu99889988.now.to
gugu001122.now.to
lang123123.now.to
gugu6677.now.to
168.hua8899.now.to
soso9988.now.to
gugu8899.now.to
33223388.now.to

Government Lottery

The second type of site claims to be a government lottery. Proceeds are purported to help the kids you see on the right side. I found two slightly different versions of this site.

Fake government lottery

This site is hosted on these domains:

www.330069.com
55882.co.cc
55571.co.cc

And the following domains contain an iframe to one of the sites above:

797.feels3.de 
90.ezpagez.com
www.66797.co.cc

These sites are not blocked by any popular phishing denylist that I am aware of and will therefore likely stay up for some time.

-- Julien

Obrigado por ler

Esta postagem foi útil?？

Sim, muito útil!

Na verdade, não

Aviso legal: este post no blog foi criado pela Zscaler apenas para fins informativos e é fornecido "no estado em que se encontra", sem quaisquer garantias de exatidão, integridade ou confiabilidade. A Zscaler não se responsabiliza por quaisquer erros, omissões ou por quaisquer ações tomadas com base nas informações fornecidas. Quaisquer sites ou recursos de terceiros vinculados neste post são fornecidos apenas para sua conveniência, e a Zscaler não se responsabiliza por seu conteúdo ou práticas. Todo o conteúdo está sujeito a alterações sem aviso prévio. Ao acessar este blog, você concorda com estes termos e reconhece que é de sua exclusiva responsabilidade verificar e utilizar as informações conforme apropriado para suas necessidades.