Web Hosting Talk : Web Hosting Main Forums : Hosting Security and Technology : New CPanel Phishing E-Mail

[Ryan G - Limestone]

I read this article today and was curious if anyone was affected or knew about it.

Webmasters from at least 90 online hosting providers are specifically targeted in the newest round of Avalanche phish.

Subject lines use the name of the targeted hosting company in the email subject, such as:

(targeted hosting company) webhosting update
(targeted hosting company) web hosting update
(targeted hosting company) webhosting user
(targeted hosting company) web hosting update
for (targeted hosting company) webhosting user
for (targeted hosting company) web hosting user


where (targeted hosting company) can be:
locaweb.com.br
now.cn
4shared.com
50webs.com
bluehost.com
earthlink.com
github.com
godaddy.com
homestead.com
hostalia.com
hostgator.com
hostmonster.com
ixwebhosting.com
jeeran.com
lunarpages.com
mediafire.com
mozy.com
namecheap.com
netfirms.com
networksolutions.com
pair.com
powweb.com
qwest.com
register.com
resellerclub.com
siteground.com
sitesell.com
softlayer.com
squarespace.com
startlogic.com
t35.com
theplanet.com
ucoz.com
vendio.com
volusion.com
web.com
************.com
webhostingpad.com
west263.com
x10hosting.com
yahoo.com
35.com
bravehost.com
dreamhost.com
enom.com
fatcow.com
krypt.com
midphase.com
one.com
xlhost.com
**********.com
all-inkl.com
angelfire.com
bravenet.com
freeservers.com
freewebs.com
ipower.com
justhost.com
leaseweb.com
pingdom.com
rackspace.com
zerolag.com
arabstart.com
awardspace.com
fortunecity.com
freehostia.com
dynadot.com
pueblo.cz
arcor.de
funpic.de
hosteurope.de
ohost.de
1und1.de
server4you.de
strato.de
usenext.de
aruba.it
isimtescil.net
masterweb.net
ovh.net
speakeasy.net
aplus.net
mediatemple.net
home.pl
nazwa.pl
masterhost.ru
123-reg.co.uk
1and1.co.uk
oneandone.co.uk
fasthosts.co.uk
netbenefit.co.uk
website.ws

http://garwarner.blogspot.com/2009/1...nel-phish.html

[njoker555]

That's just terrible.

First I'm hearing of it, haven't been affected either.

[phauk]

ooo, thanks very much for posting that nice to know!

[Bihira]

Wow; thank you for posting this info here.

[WireNine]

All customers from those companies were the victim of phishing e-mails? Or was this just randomly sent out to a mailing list of users?

[vivithemage]

Thanks for the heads up..what a pain though. Hopefully they can find the mail server and shut it off.

[UH-Bobby]

Thanks for the heads up on this. I'll be passing it along.

[VIPoint]

Thanks for the post..

[Ryan G - Limestone]

Originally Posted by WN-Ali

All customers from those companies were the victim of phishing e-mails? Or was this just randomly sent out to a mailing list of users?

All those domains are used randomly in the subject titles and bodies of the e-mails. Are they able to specifically target the users of those companies? The article does not say. I hope they don't have a special list of e-mails per company but it probably wouldn't be hard especially for those who sell domains. You can get a good idea from looking at the WHOIS.