(The quickest way to register)

Forum

Dear visitor! The webpage is only available in English. We're sorry for the inconvenience.
  1. User picture
    • MysteryFCM on Thu 23 Jul 2009
    • 02:00:21 PM UTC

    Is your computer part of the Alliance and Leicester phishing botnet?

    Is your computer part of the Alliance and Leicester phishing botnet?

    "I've been seeing these for several days now, and they seem to have a new one every day or two. Thus far, I've seen 9 different domains, all pointing to Alliance & Leicester phishing scam pages - but here's the kicker - they're ALL hosted on DRONE COMPUTERS! (otherwise known as, they've all been compromised and are now part of a botnet).

    http://hosts-file.net/misc/hpObserver_-_Alliance_a...

    Incidentally, there only seems to be a handful of IP's involved at present, which makes it a rather small and amateurish botnet:"

    http://hphosts.blogspot.com/2009/07/is-your-comput...

    Regards Steven Burn I.T. Mate / hpHosts it-mate.co.uk / hosts-file.net

Comments:

  2. User picture
    • cconniejean on Thu 23 Jul 2009
    • 02:56:24 PM UTC

    Checked mine, I'm clean :O).

    Checked mine, I'm clean :O). Never realized before how important it was to keep a eye on my ip address.
  3. User picture
    • g7w on Fri 24 Jul 2009
    • 02:51:19 AM UTC

    domains and IP's

    Here's a list of domains and IP's many are Reported as attack sites.

    Rate RED; these have been verified as currently active

    Malicious content
    Alliance and Leicester phishing botnet
    re: http://hphosts.blogspot.com/2009/07/is-your-computer-part-of-alliance-and.html

    219.83.125.242
    2nd6xui4f.com
    68.112.21.204
    68.54.210.173
    69.250.79.6
    74.210.187.149
    75.199.109.38
    76.115.11.52
    79.78.196.168
    88.185.146.240
    97.90.152.194
    alliance-leicester084.com
    alliance-leicester184.com
    alliance-leicester314.com
    alliance-leicester406.com
    alliance-leicester450.com
    alliance-leicester950.com
    finalhookspot.com
    justhookupnow.com
    my-secret-pics.com
    mybank.alliance-leicester084.com
    mybank.alliance-leicester184.com
    mybank.alliance-leicester314.com
    ns1.besthingdomainname.com
    ns2.besthingdomainname.com
    ns3.besthingdomainname.com
    ns4.besthingdomainname.com
    ns5.besthingdomainname.com
    ns6.besthingdomainname.com
    pictures-plug.com
    pictures-switch.com
    pictures-utube.com
    secret-digital-pictures.com
    stolen-pictures.com
    stolen-shots.com

    I previously rated this back in May 2009 from this DNS-BH blog post

    my-cheerful-dns.com
    ns1.my-cheerful-dns.com
    ns2.my-cheerful-dns.com
    ns3.my-cheerful-dns.com
    ns4.my-cheerful-dns.com

    currently parked, but IMO it's best to catch it before it's a problem

    citiaccountservices.com

    Here's a "kicker"
    This domain's DNS does not resolve, though it previously listed name servers do.
    whois
    Created: 2009-06-05
    Expires: 2010-06-05
    Updated: 2009-07-03
    Registrant:
    Organization : cheng wu
    Name yang jing zhong
    Address wuhan
    City wuhanshi
    Province/State : hubeisheng
    Country china
    Postal Code 430000
    Domain Status:On-hold (generic)

    besthingdomainname.com

    {EDIT}
    removed duplicate list entries; apologies
  4. User picture
    • Xp54321 on Fri 24 Jul 2009
    • 12:09:51 AM UTC

    Done

    Rated and commented.

    Thanks.

    :-)
  5. User picture
    • shazza on Fri 24 Jul 2009
    • 02:04:07 AM UTC

    Rated / Commented

    Thanks g7w!
  6. User picture
    • g7w on Fri 24 Jul 2009
    • 03:11:25 AM UTC

    more::Alliance and Leicester domains

    Again, referencing MysteryFCM's blog a reply was made giving reference to yet more domains.
    WOT rates without the www. prefix, but the www. is required to visit "live" in a browser, without it, DNS does not resolve.

    alliance-leicester005.com
    alliance-leicester023.com
    alliance-leicester100.com
    alliance-leicester109.com
    alliance-leicester14.com
    alliance-leicester145.com
    alliance-leicester180.com
    alliance-leicester24.com
    alliance-leicester276.com
    alliance-leicester28.com
    alliance-leicester29.com
    alliance-leicester329.com
    alliance-leicester340.com
    alliance-leicester363.com
    alliance-leicester364.com
    alliance-leicester38.com
    alliance-leicester396.com
    alliance-leicester406.com
    alliance-leicester41.com
    alliance-leicester453.com
    alliance-leicester50.com
    alliance-leicester524.com
    alliance-leicester527.com
    alliance-leicester543.com
    alliance-leicester55.com
    alliance-leicester571.com
    alliance-leicester59.com
    alliance-leicester609.com
    alliance-leicester65.com
    alliance-leicester684.com
    alliance-leicester71.com
    alliance-leicester72.com
    alliance-leicester73.com
    alliance-leicester774.com
    alliance-leicester78.com
    alliance-leicester79.com
    alliance-leicester86.com
    alliance-leicester93.com
    alliance-leicester934.com
    alliance-leicester96.com
    mybank.alliance-leicester005.com
    mybank.alliance-leicester023.com
    mybank.alliance-leicester100.com
    mybank.alliance-leicester109.com
    mybank.alliance-leicester14.com
    mybank.alliance-leicester145.com
    mybank.alliance-leicester180.com
    mybank.alliance-leicester24.com
    mybank.alliance-leicester276.com
    mybank.alliance-leicester28.com
    mybank.alliance-leicester29.com
    mybank.alliance-leicester329.com
    mybank.alliance-leicester340.com
    mybank.alliance-leicester363.com
    mybank.alliance-leicester364.com
    mybank.alliance-leicester38.com
    mybank.alliance-leicester396.com
    mybank.alliance-leicester406.com
    mybank.alliance-leicester41.com
    mybank.alliance-leicester453.com
    mybank.alliance-leicester50.com
    mybank.alliance-leicester524.com
    mybank.alliance-leicester527.com
    mybank.alliance-leicester543.com
    mybank.alliance-leicester55.com
    mybank.alliance-leicester571.com
    mybank.alliance-leicester59.com
    mybank.alliance-leicester609.com
    mybank.alliance-leicester65.com
    mybank.alliance-leicester684.com
    mybank.alliance-leicester71.com
    mybank.alliance-leicester72.com
    mybank.alliance-leicester73.com
    mybank.alliance-leicester774.com
    mybank.alliance-leicester78.com
    mybank.alliance-leicester79.com
    mybank.alliance-leicester86.com
    mybank.alliance-leicester93.com
    mybank.alliance-leicester934.com
    mybank.alliance-leicester96.com
    • User picture
      • MysteryFCM on Fri 24 Jul 2009
      • 06:03:27 PM UTC

      Just an FYI .....

      ... the reply to the blog post was made by my friend Gerhard from Clean-MX.de :o)

      Regards
      Steven Burn
      Ur I.T. Mate Group / hpHosts
      it-mate.co.uk / hosts-file.net
      • User picture
        • g7w on Fri 24 Jul 2009
        • 07:26:26 PM UTC

        Clean-MX.de

        German site (too lazy at the moment to use Google Translator)
        Not rated!

        If I see a MysteryFCM good site rating, I'll have no problem following up with some Green and an Agree. :-)

        -------
        Against Intuition - gives us safety through Web of Trust.
        WOT Community - gives us security through unity.
        Thank you all
        G7W
        • User picture
          • MysteryFCM on Fri 24 Jul 2009
          • 07:47:55 PM UTC

          .....

          hehe I use Avant Browser 99% of the time, which MyWot won't allow me to do ratings in, which is why I rarely do them (can't post from Avant in the scorecard comments either)

          Waiting for Anderson (Avants developer) and the MyWot team to get full support added for it ;o)

          /edit

          Just loaded IE specially to add a rating and comment ;o)

          http://www.mywot.com/en/scorecard/clean-mx.de

          Mass greens all round folks!

          Regards
          Steven Burn
          Ur I.T. Mate Group / hpHosts
          it-mate.co.uk / hosts-file.net
          • User picture
            • Tonor on Sat 25 Jul 2009
            • 03:52:42 PM UTC

            Rated

            Given this site a 'very good' (bright green) rating. :)
  7. User picture
    • cconniejean on Fri 24 Jul 2009
    • 04:18:00 AM UTC

    Rated and commented

    Rated and commented
  8. User picture
    • Tonor on Fri 24 Jul 2009
    • 02:54:11 PM UTC

    Rated

    All rated red.
  9. User picture
    • phantazm on Fri 24 Jul 2009
    • 04:43:06 PM UTC

    Done too

    Rated and commented...

    Thanks for locating these phishes...

    PS: I also happened to notice this new mass rating possibility:
    "Delete all my comments and ratings on these domains".
    Nice addition, quite practical. Thanks WOT..!
  10. User picture
    • Nexuse on Fri 24 Jul 2009
    • 09:32:41 PM UTC

    Im Safe

    Im safe, checked my IP Address on the list, rated the websites RED
  11. User picture
    • MysteryFCM on Sat 25 Jul 2009
    • 03:49:37 PM UTC

    ...

    Upto date list (if you come across any not in the list, please let me know)

    http://hosts-file.net/pest.asp?show=alliance-leice...

    **********************************************************
    alliance-leicester005.com
    alliance-leicester012.com
    alliance-leicester023.com
    alliance-leicester052.com
    alliance-leicester084.com
    alliance-leicester100.com
    alliance-leicester145.com
    alliance-leicester180.com
    alliance-leicester184.com
    alliance-leicester214.com
    alliance-leicester220.com
    alliance-leicester250.com
    alliance-leicester267.com
    alliance-leicester276.com
    alliance-leicester314.com
    alliance-leicester329.com
    alliance-leicester340.com
    alliance-leicester363.com
    alliance-leicester364.com
    alliance-leicester396.com
    alliance-leicester406.com
    alliance-leicester407.com
    alliance-leicester411.com
    alliance-leicester450.com
    alliance-leicester453.com
    alliance-leicester467.com
    alliance-leicester524.com
    alliance-leicester525.com
    alliance-leicester527.com
    alliance-leicester543.com
    alliance-leicester557.com
    alliance-leicester571.com
    alliance-leicester709.com
    alliance-leicester754.com
    alliance-leicester774.com
    alliance-leicester780.com
    alliance-leicester821.com
    alliance-leicester934.com
    alliance-leicester950.com
    alliance-leicester979.com
    alliance-leicester981.com
    alliance-leicester-co-uk.info
    mybank.alliance-leicester005.com
    mybank.alliance-leicester012.com
    mybank.alliance-leicester023.com
    mybank.alliance-leicester052.com
    mybank.alliance-leicester084.com
    mybank.alliance-leicester100.com
    mybank.alliance-leicester145.com
    mybank.alliance-leicester180.com
    mybank.alliance-leicester184.com
    mybank.alliance-leicester214.com
    mybank.alliance-leicester220.com
    mybank.alliance-leicester250.com
    mybank.alliance-leicester267.com
    mybank.alliance-leicester276.com
    mybank.alliance-leicester314.com
    mybank.alliance-leicester329.com
    mybank.alliance-leicester340.com
    mybank.alliance-leicester363.com
    mybank.alliance-leicester364.com
    mybank.alliance-leicester396.com
    mybank.alliance-leicester406.com
    mybank.alliance-leicester407.com
    mybank.alliance-leicester411.com
    mybank.alliance-leicester450.com
    mybank.alliance-leicester453.com
    mybank.alliance-leicester467.com
    mybank.alliance-leicester524.com
    mybank.alliance-leicester525.com
    mybank.alliance-leicester527.com
    mybank.alliance-leicester543.com
    mybank.alliance-leicester557.com
    mybank.alliance-leicester571.com
    mybank.alliance-leicester709.com
    mybank.alliance-leicester754.com
    mybank.alliance-leicester774.com
    mybank.alliance-leicester780.com
    mybank.alliance-leicester821.com
    mybank.alliance-leicester934.com
    mybank.alliance-leicester950.com
    mybank.alliance-leicester979.com
    mybank.alliance-leicester981.com
    http://www.alliance-leicester005.com
    http://www.alliance-leicester012.com
    http://www.alliance-leicester023.com
    http://www.alliance-leicester052.com
    http://www.alliance-leicester084.com
    http://www.alliance-leicester100.com
    http://www.alliance-leicester145.com
    http://www.alliance-leicester180.com
    http://www.alliance-leicester184.com
    http://www.alliance-leicester214.com
    http://www.alliance-leicester220.com
    http://www.alliance-leicester250.com
    http://www.alliance-leicester267.com
    http://www.alliance-leicester276.com
    http://www.alliance-leicester314.com
    http://www.alliance-leicester329.com
    http://www.alliance-leicester340.com
    http://www.alliance-leicester363.com
    http://www.alliance-leicester364.com
    http://www.alliance-leicester396.com
    http://www.alliance-leicester406.com
    http://www.alliance-leicester407.com
    http://www.alliance-leicester411.com
    http://www.alliance-leicester450.com
    http://www.alliance-leicester453.com
    http://www.alliance-leicester467.com
    http://www.alliance-leicester524.com
    http://www.alliance-leicester525.com
    http://www.alliance-leicester527.com
    http://www.alliance-leicester543.com
    http://www.alliance-leicester557.com
    http://www.alliance-leicester571.com
    http://www.alliance-leicester709.com
    http://www.alliance-leicester754.com
    http://www.alliance-leicester774.com
    http://www.alliance-leicester780.com
    http://www.alliance-leicester821.com
    http://www.alliance-leicester934.com
    http://www.alliance-leicester950.com
    http://www.alliance-leicester979.com
    http://www.alliance-leicester981.com
    http://www.alliance-leicester-co-uk.info
    http://www.mybank.alliance-leicester005.com
    http://www.mybank.alliance-leicester012.com
    http://www.mybank.alliance-leicester023.com
    http://www.mybank.alliance-leicester052.com
    http://www.mybank.alliance-leicester084.com
    http://www.mybank.alliance-leicester100.com
    http://www.mybank.alliance-leicester145.com
    http://www.mybank.alliance-leicester180.com
    http://www.mybank.alliance-leicester184.com
    http://www.mybank.alliance-leicester214.com
    http://www.mybank.alliance-leicester220.com
    http://www.mybank.alliance-leicester250.com
    http://www.mybank.alliance-leicester267.com
    http://www.mybank.alliance-leicester276.com
    http://www.mybank.alliance-leicester314.com
    http://www.mybank.alliance-leicester329.com
    http://www.mybank.alliance-leicester340.com
    http://www.mybank.alliance-leicester363.com
    http://www.mybank.alliance-leicester364.com
    http://www.mybank.alliance-leicester396.com
    http://www.mybank.alliance-leicester406.com
    http://www.mybank.alliance-leicester407.com
    http://www.mybank.alliance-leicester411.com
    http://www.mybank.alliance-leicester450.com
    http://www.mybank.alliance-leicester453.com
    http://www.mybank.alliance-leicester467.com
    http://www.mybank.alliance-leicester524.com
    http://www.mybank.alliance-leicester525.com
    http://www.mybank.alliance-leicester527.com
    http://www.mybank.alliance-leicester543.com
    http://www.mybank.alliance-leicester557.com
    http://www.mybank.alliance-leicester571.com
    http://www.mybank.alliance-leicester709.com
    http://www.mybank.alliance-leicester754.com
    http://www.mybank.alliance-leicester774.com
    http://www.mybank.alliance-leicester780.com
    http://www.mybank.alliance-leicester821.com
    http://www.mybank.alliance-leicester934.com
    http://www.mybank.alliance-leicester950.com
    http://www.mybank.alliance-leicester979.com
    http://www.mybank.alliance-leicester981.com
    **********************************************************

    Regards
    Steven Burn
    Ur I.T. Mate Group / hpHosts
    it-mate.co.uk / hosts-file.net
    • User picture
      • g7w on Sat 25 Jul 2009
      • 06:45:48 PM UTC

      FYI

      please remove the "http:// www." entries, they are redundant in WOT.
      The scorecard for example.com and www.example.com are the same. This is why we generally try to use non live URLs and reference domains simply as example.com or subdomain.example.com
      ;-)

      {EDIT}
      I've went through the new list and compared to what's already been rated, here are "new" domains:

      alliance-leicester-co-uk.info

      Alliance-leicester11.com
      Alliance-leicester407.com
      Alliance-leicester525.com
      Alliance-leicester557.com
      Alliance-leicester67.com
      Alliance-leicester709.com
      Alliance-leicester754.com
      Alliance-leicester780.com
      Alliance-leicester821.com
      Alliance-leicester979.com
      Alliance-leicester981.com

      mybank.alliance-leicester012.com
      mybank.alliance-leicester052.com
      mybank.alliance-leicester214.com
      mybank.alliance-leicester220.com
      mybank.alliance-leicester250.com
      mybank.alliance-leicester267.com
      mybank.alliance-leicester407.com
      mybank.alliance-leicester411.com
      mybank.alliance-leicester450.com
      mybank.alliance-leicester467.com
      mybank.alliance-leicester525.com
      mybank.alliance-leicester557.com
      mybank.alliance-leicester709.com
      mybank.alliance-leicester754.com
      mybank.alliance-leicester780.com
      mybank.alliance-leicester821.com
      mybank.alliance-leicester950.com
      mybank.alliance-leicester979.com
      mybank.alliance-leicester981.com
      -------
      Against Intuition - gives us safety through Web of Trust.
      WOT Community - gives us security through unity.
      Thank you all
      - G7W
  12. User picture
    • shazza on Sat 25 Jul 2009
    • 07:23:40 PM UTC

    Thanks,

    All lists above rated / commented
  13. User picture
    • phantazm on Sat 25 Jul 2009
    • 05:26:31 PM UTC

    Done again

    Rated, commented...

    Btw, thanks for catching all these phishes..!
  14. User picture
    • g7w on Sat 25 Jul 2009
    • 07:12:49 PM UTC

    found more IP's and PTR's

    Rate RED
    Malicious content
    Alliance and Leicester phishing botnet
    re: http://hphosts.blogspot.com/2009/07/is-your-computer-part-of-alliance-and.html

    138.210.154.36
    202.77.97.227
    202.77.97.227
    206.220.192.198
    208.107.67.19
    24.164.131.147
    24.164.131.147
    24.60.216.62
    65.202.231.12
    68.47.206.15
    69.250.79.6
    70.132.4.132
    71.71.241.121
    74.75.104.93
    75.222.33.15
    75.38.72.217
    79.0.136.5
    81.172.25.108
    89.156.170.229
    91.67.60.103
    91.67.60.103
    99.38.13.15
    c-24-60-216-62.hsd1.ma.comcast.net
    c-69-250-79-6.hsd1.md.comcast.net
    c-76-115-11-52.hsd1.or.comcast.net
    c-76-115-11-52.hsd1.wa.comcast.net
    host-19-67-107-208.midco.net
    mail.ykkbi.or.id
    nv-138-210-154-36.sta.embarqnow.net
    -------
    Against Intuition - gives us safety through Web of Trust.
    WOT Community - gives us security through unity.
    Thank you all
    - G7W
  15. User picture
    • g7w on Sun 26 Jul 2009
    • 04:36:45 PM UTC

    new: alliance-leicester325.com

    New IP's and domains

    Rate RED
    Malicious content
    Alliance and Leicester phishing botnet
    re: http://hphosts.blogspot.com/2009/07/is-your-computer-part-of-alliance-and.html

    67.77.32.172
    68.69.94.207
    70.231.249.215
    84.228.22.24
    88.173.181.235
    alliance-leicester325.com
    mybank.alliance-leicester325.com

    -------
    Against Intuition - gives us safety through Web of Trust.
    WOT Community - gives us security through unity.
    Thank you all
    - G7W
  16. User picture
    • cconniejean on Sun 26 Jul 2009
    • 11:17:01 PM UTC

    Rated and commented.

    Rated and commented.