[nsp-sec] active bank phishing sites (theplanet/AS21844 + others)

[Nick Hilliard]

There's an active AIB phishing site on:

http://danmorris-djm.co.uk/up/up.htm

It currently redirects to:

> http://thaipanga.net/plugins/htmlpurifier/standalone/HTMLPurifier/DefinitionCache/Serializer/inet/roi/login.htm

Details:

> % whois -h v4.whois.cymru.com " -v 74.53.26.163"
> AS      | IP               | BGP Prefix          | CC | Registry | Allocated  | AS Name
> 21844   | 74.53.26.163     | 74.52.0.0/14        | US | arin     | 2006-02-17 | THEPLANET-AS - ThePlanet.com Internet Services, Inc.
> % whois -h v4.whois.cymru.com " -v 206.196.98.52"
> AS      | IP               | BGP Prefix          | CC | Registry | Allocated  | AS Name
> 6428    | 206.196.98.52    | 206.196.96.0/19     | US | arin     | 1995-07-19 | CDM - CDM
> 54052   | 206.196.98.52    | 206.196.96.0/19     | US | arin     | 1995-07-19 | FRACRACKAS - Frac Rack LLC

Nick