[nsp-sec] ACK 174 RE: Phishing site at AS24611 (DCLUXNET)

[Shelton, Steve]

Hello,

I'll see if I can help with this one.  The site is currently pulling
content from 212.247.61.24.

</head>
<frameset rows="*,1" frameborder="NO" border="0" framespacing="0">
  <frame src="http://212.247.61.24:1280/visa/index.html"
name="EuroDNSmainFrame"

URL: http://212.247.61.24:1280/visa/index.html

1257    | 212.247.61.24    | TELE2

Steve Shelton
Network Security Engineer
Cogent Communications



-----Original Message-----
From: nsp-security-bounces at puck.nether.net
[mailto:nsp-security-bounces at puck.nether.net] On Behalf Of Veronika
Berglund
Sent: Wednesday, May 28, 2008 7:25 AM
To: nsp-security at puck.nether.net
Subject: [nsp-sec] Phishing site at AS24611 (DCLUXNET)

----------- nsp-security Confidential --------

Is someone around that could help getting this site taken down,
http://www.visaverified-se.cn:80/

AS	| IP		| AS Name
24611	| 80.92.66.14	| DCLUX-AS Datacenter Luxembourg S.A.

We've gotten a large amount of phishing e-mails regarding this site this

morning.

Thanks!
Veronika
--
Veronika Berglund
SUNet CERT
<veronika.berglund at cert.sunet.se>



_______________________________________________
nsp-security mailing list
nsp-security at puck.nether.net
https://puck.nether.net/mailman/listinfo/nsp-security

Please do not Forward, CC, or BCC this E-mail outside of the
nsp-security
community. Confidentiality is essential for effective Internet security
counter-measures.
_______________________________________________