Comments

Paypal Phishing attempts via uvmtv.net and sell-mp3.ru and from coin-money.ru – x-files2.ru — 2 Comments

  1. they are changing the final destination url several times a day: When I posted this comment the destination was “sell-mp3.ru/work/login_run.htm” Not the different folder that holds the phish. previously it was ” /upg/ ”

    this is being done to try to stop Microsoft, Mozilla & Google chrome blocking the phishing site. These browsers and the underlying technology will only block the full URL not the base domain. This is because often the sites or the servers hosting the sites have been hacked or compromised

  2. This has been updated yet again to use coin-money.ru as the eventual landing site and the link in the email will be to x-files2.ru/img/.news/ ( the img folder changes frequently to another folder name)

Leave a Reply

Your email address will not be published. Required fields are marked *