[nsp-sec] Fast flux or Botnet - Facebook Phish | malware - ns1.castlebin.com | 8.12.160.183 - AS40935 RELYNET - RelyNet Inc

[Jose Nazario]

we think this is the same crew as the guys behind the recent run (and 
there was an earlier run this week) of classmates.com spam, malcode etc.

they also use the same infrastructure as rock but appear to be different 
teams entirely.

-------------------------------------------------------------
jose nazario, ph.d.     	<jose at arbor.net>
manager of security research 	arbor networks
v: (734) 821 1427 	      	http://asert.arbor.net/