Monday, May 4, 2009

ICQ Phishing - You Type, They Sell

My friend ax1les has a 5 digit ICQ number and he always gets wiered messages that turn out to be phishing or links to trojans. A few days ago, he got this message:



He thought it would be a good idea that we'll take a look at that website together, and we did :)



In the last decade russians really mad fun of the world using the Internet.
The website http://icq-confirm.info/ is a phishing website that "confirms" your ICQ account credentials are still valid (yeah right). The amazing thing is he didn't even bother changing the title from the former text "icq.com" :)

But of course his business is really successful as he is also the owner of the mega-icq-shop, he is trying to hide so much that he event left it in the domain's whois details......

Domain ID:D28335226-LRMS
Domain Name:ICQ-CONFIRM.INFO
Created On:20-Apr-2009 07:27:17 UTC
Last Updated On:29-Apr-2009 15:01:04 UTC
Expiration Date:20-Apr-2010 07:27:17 UTC
Sponsoring Registrar:Directi Internet Solutions Pvt. Ltd. d/b/a PublicDomainRegistry.com (R159-LRMS)
Status:CLIENT TRANSFER PROHIBITED
Status:TRANSFER PROHIBITED
Registrant ID:DI_9732581
Registrant Name:Andrey Petrovich
Registrant Organization:Private person
Registrant Street1:Krasnoarmeyskaya 18 dom 4 kv 32
Registrant Street2:
Registrant Street3:
Registrant City:Moskva
Registrant State/Province:Moskva
Registrant Postal Code:132132
Registrant Country:RU
Registrant Phone:+7.4951783223
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:mega-icq-shop@mail.ru
Admin ID:DI_9732581
Admin Name:Andrey Petrovich
Admin Organization:Private person
Admin Street1:Krasnoarmeyskaya 18 dom 4 kv 32
Admin Street2:
Admin Street3:
Admin City:Moskva
Admin State/Province:Moskva
Admin Postal Code:132132
Admin Country:RU
Admin Phone:+7.4951783223
Admin Phone Ext.:
Admin FAX:
Admin FAX Ext.:
Admin Email:mega-icq-shop@mail.ru
Billing ID:DI_9732581
Billing Name:Andrey Petrovich
Billing Organization:Private person
Billing Street1:Krasnoarmeyskaya 18 dom 4 kv 32
Billing Street2:
Billing Street3:
Billing City:Moskva
Billing State/Province:Moskva
Billing Postal Code:132132
Billing Country:RU
Billing Phone:+7.4951783223
Billing Phone Ext.:
Billing FAX:
Billing FAX Ext.:
Billing Email:mega-icq-shop@mail.ru
Tech ID:DI_9732581
Tech Name:Andrey Petrovich
Tech Organization:Private person
Tech Street1:Krasnoarmeyskaya 18 dom 4 kv 32
Tech Street2:
Tech Street3:
Tech City:Moskva
Tech State/Province:Moskva
Tech Postal Code:132132
Tech Country:RU
Tech Phone:+7.4951783223
Tech Phone Ext.:
Tech FAX:
Tech FAX Ext.:
Tech Email:mega-icq-shop@mail.ru
Name Server:NS1.AGHOST.RU
Name Server:NS2.AGHOST.RU

Anyway, the really wiered thing about this case is that while i am writing this post this website is not loading anymore...the DNS no longer resolves to any IP and their former IP 95.211.7.5 reponse with "Apache is working properley" when requesting the Host "icq-confirm.info".
May be I scared them away with a few little DNS requests or the cops just randomly knocked on their door :)