Onderwerp: phishing sites report - March/2005

Below is a periodic public report from the Malicious Websites and
Phishing research and mitigation mailing list (a sub-group of the drone
armies / botnets research and mitigation mailing list).
For this report it should be noted that we base our analysis on the data
we have accumulated from various sources.

According to our incomplete analysis of information we have thus far, we
now publish the following report.

Notes on the report:
* The report is in descending order.
* In the listing are also included suspected child pornography sites,
however, their numbers are not large enough to effect the statistics.


Number of phishing sites found: 276.


The ISP's that are most often plagued with phishing sites:
----------------------------------------------------------
ASN Responsible Party
14780 INKTOMI-LAWSON - Inktomi Corpo
14779
13768 PEER1 - Peer 1 Network Inc.
21844 THEPLANET-AS - THE PLANET
1668 AOL-ATDN - AOL Transit Data Ne
4134 CHINANET-BACKBONE No.31 Jin-ro
29761 OC3-NETWORKS-AS-NUMBER - OC3 N
27699 TELECOMUNICACOES DE SAO PAULO
15201 Universo Online Ltda.

* We would gladly like to establish a trusted relationship with
these and any organizations to help them in the future (especially the
attacked eCommerce sites and the hosting service providers).

* By previous requests here is an explanation of what "ASN" is, by Joe
St Sauver:
http://darkwing.uoregon.edu/~joe/one-pager-asn.pdf


--
Gadi Evron,
Information Security Manager, Project Tehila -
Israeli Government Internet Security.
Ministry of Finance, Israel.

gadi@tehila.gov.il
gadi@CERT.gov.il
Office: +972-2-5317890
Fax: +972-2-5317801
http://www.tehila.gov.il

The opinions, views, facts or anything else expressed in this email
message are not necessarily those of the Israeli Government.

> Unsure if you have already done so, but you might want to contact
> http://antiphishing.org and http://www.phishreport.net/ with your
> findings.

Yes, there are some very nice and serious people over there.

> As to the ASN, or autonomous system number, here is some more information
> for those willing to dive deeper (the PDF link didn't come up when I tried
> it):

Maybe too many people tried to enter.. try again.


Gadi.

On Mon, 28 Mar 2005, Gadi Evron wrote:

> The ISP's that are most often plagued with phishing sites:
> ----------------------------------------------------------
> ASN Responsible Party
> 14780 INKTOMI-LAWSON - Inktomi Corpo
> 14779
> 13768 PEER1 - Peer 1 Network Inc.
> 21844 THEPLANET-AS - THE PLANET
> 1668 AOL-ATDN - AOL Transit Data Ne
> 4134 CHINANET-BACKBONE No.31 Jin-ro
> 29761 OC3-NETWORKS-AS-NUMBER - OC3 N
> 27699 TELECOMUNICACOES DE SAO PAULO
> 15201 Universo Online Ltda.
>
> * By previous requests here is an explanation of what "ASN" is, by Joe
> St Sauver:
> http://darkwing.uoregon.edu/~joe/one-pager-asn.pdf

Unsure if you have already done so, but you might want to contact
http://antiphishing.org and http://www.phishreport.net/ with your
findings.

As to the ASN, or autonomous system number, here is some more information
for those willing to dive deeper (the PDF link didn't come up when I tried
it):

http://www.iana.org/assignments/as-numbers
(IANA assigns ASNs)

http://en.wikipedia.org/wiki/Autonomous_system_(Internet)


--
Sincerely,

Paul Laudanski .. Computer Cops, LLC.
CastleCops(SM)... http://castlecops.com
CC Blog ......... http://blog.castlecops.com
Staff Blogs ..... http://busterbunny.castlecops.com
Our Vision ...... http://castlecops.com/postt63382.html

http://cuddlesnkisses.com http://justalittlepoke.com http://zhen-xjell.com