[nsp-sec] Phishing site at AS44706 (NDNET.CH)

[Peter Haag]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



On 3/23/10 19:39, Carles Fragoso wrote:
> ----------- nsp-security Confidential --------
> 
> Hi!
> 
> Could someone drop this phishing website?
> 
>    AS      | IP               | AS Name
>    44706   | 91.199.218.222   | NDNET-AS Network Design GmbH
> 
>    hxxp://web001.zrh01.ndnet.ch/webmail/htaccess/httpwww2.segundamano.esstorelogin0ca=0_s/

Seems to be already down. Feel free to send .ch/.li related issues also to cert at switch.ch
We take care about these.

	- Peter
> 
> The customer has already notified it to PhishTank:
> 
>    http://www.phishtank.com/phish_detail.php?phish_id=949772
> 
> Legitimate website is located at:
> 
>    http://www.segundamano.es/
> 
> Thanks,
> 
> -- Carlos
> 
> 
> _______________________________________________
> nsp-security mailing list
> nsp-security at puck.nether.net
> https://puck.nether.net/mailman/listinfo/nsp-security
> 
> Please do not Forward, CC, or BCC this E-mail outside of the nsp-security
> community. Confidentiality is essential for effective Internet security counter-measures.
> _______________________________________________

- -- 
_______ SWITCH - The Swiss Education and Research Network ______
Peter Haag,  Security Engineer,  Member of SWITCH CERT
PGP fingerprint: D9 31 D5 83 03 95 68 BA  FB 84 CA 94 AB FC 5D D7
SWITCH, Werdstrasse 2, P.O. Box,  CH-8021   Zurich, Switzerland
E-mail: peter.haag at switch.ch Web: http://www.switch.ch/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (Darwin)

iQCVAwUBS6mzOv5AbZRALNr/AQKO7wP8CKE97tgs96P6KEYwminlP+sHyxNGeUhR
cQujs5K7FkR7/oDyGe3tbK/EX22+nmWPxcYtsRu0pGAkywtB0V/1nJ+TpQ4BVLLD
0rf/ChOOYJGN03AfKWzRbdL/L7p//KjGG6a2QhFu9UXExvnOpMm7L0RzpvyfY5Ay
ugyjxwKB4dk=
=ee1m
-----END PGP SIGNATURE-----