Gustav FraudWatch\Fake Domains

Look in this specific forum for newly found security threats which may not yet be covered by your usual security software

Moderators: Admin Team, Moderators

User avatar
TeMerc
Site Admin
Site Admin
Posts: 15995
Joined: Fri Jan 28, 2005 5:16 pm
Area Of Expertise: Security
experience: I know the functions, OS settings, registry tweaks and more
PC time: What else is there in life?
Location: PHX, AZ
Contact:

Gustav FraudWatch\Fake Domains

Postby TeMerc » Sat Aug 30, 2008 9:51 am

Remember three years ago when hurricanes Katrina and Rita hit the US Gulf coast? On the day Katrina hit New Orleans hundreds of donation sites appeared online, many if not most were scam sites. Well this time around it looks like the people who like to register domain names in anticipation of a storm's arrival have already started registering them for Gustav and Hanna. I'm not suggeting that they are up to no good, but simply pointing out that the rush has started and we need to make sure our users are aware of the potential for scam sites appearing online in the next few days.

For example, these domains were registered in the past 24 hours according to Domain Tools:
    aidforgustav.com
    gustav-recovery.com
    gustav08.com
    gustavcharities.org
    gustavcharity.org
    gustavcontractor.com
    gustavdonation.org
    gustavdonations.com
    gustavdonations.org
    gustavfund.org
    gustavjamaica.com
    gustavsecurity.com
    gustavsupport.com
    gustavupdates.com
    gustavvictims.com
    gustavvolunteers.com
    hurricanegustavrecovery.com
    hurricanegustavresponse.com
    isurvivedgustav.com
    killergustav.com
    officialhurricanegustav2008.com
    reliefforgustav.com
    trackgustav.com
    trackgustav.net
    victimsofgustav.com

I checked several of them and the sites i viewed are just parked with a "for sale" sign on them. Nothing wrong with that, but it's only a matter of time before the "donate here" buttons start showing up.

Marcus H. Sachs
Director, SANS Internet Storm Center
0-= SANS
Image

User avatar
TeMerc
Site Admin
Site Admin
Posts: 15995
Joined: Fri Jan 28, 2005 5:16 pm
Area Of Expertise: Security
experience: I know the functions, OS settings, registry tweaks and more
PC time: What else is there in life?
Location: PHX, AZ
Contact:

Re: Gustav Inspires Scammers w\Fake Domains

Postby TeMerc » Sun Aug 31, 2008 9:31 am

Sunday, August 31, 2008
Hurricane Gustav: Fraud Watch

For several years I've worked as an "industry partner" sharing information with the coolest Law Enforcement / Industry / Academia partnership on the planet - the National Cyber Forensics Training Alliance. One of the very first things we did together was compiling potential fraud domains for Hurricane Katrina.

Since that time, anytime we've seen a natural disaster, we've been on the lookup for domains which might be abused for fraud. It was only natural then that I retuned my settings at DomainTools yesterday to alert on Gustav domains.

Parked Domains

parked at GoDaddy
    contributegustav.org
    contributiongustav.org
    donategustav.org
    donationgustav.org
    gustav-relief.org
    gustavassistance.org
    gustavattorney.com
    gustavclaims.net
    gustavcontribution.org
    gustavhelpers.org
    gustavlawsuit.com
    gustavlawyer.com
    gustavlouisiana.org
    gustavneworleans.org
    gustavotimponi.com
    gustavrecovery.org
    hurricanegustavrepair.com
    hurricanegustavvictims.info
    hurricanegustavvictims.org
    hurricanegustav08.com
Parked at IPTV Domains:
    gustavcharities.com
    gustavcharity.com
    gustavdonation.com
    gustavrelieffund.com
Parked at Mad Dog Domains & Cattle Company:
    hurricanegustavresponse.info
    officialhurricanegustav2008.info
Parked at Network Solutions:
    gustavresponse.com
Parked on a Sedo search click ads site:
    gustavhurricanerelief.com
    gustavhurricanerelief.info
    gustavhurricanerelief.net
    gustavhurricanerelief.org
    gustavlegalrelief.com
    gustavlegalrelief.info
Parked at Sedoparking.com:
    gustav-hurricane.info
    gustav-hurricane.net
    gustav-hurricane.org
    gustav-hurricane.us
Points to a Sedo IP, but no content there:
    hurricanegustavrelief.info
    hurricanegustavrelief.net
    hurricanegustavrelief.org
Parked at WebSites2You:
    gustavfound.com
    gustavmissing.com
    survivedgustav.com
    survivedgustav.net
For sale by auction on ebay and sedo by "harfordadvantage.com":
    helpgustavvictims.com
    helpgustavvictims.net
    helpgustavvictims.org
0-= More @ CyberCrime & DoingTime
Image

User avatar
TeMerc
Site Admin
Site Admin
Posts: 15995
Joined: Fri Jan 28, 2005 5:16 pm
Area Of Expertise: Security
experience: I know the functions, OS settings, registry tweaks and more
PC time: What else is there in life?
Location: PHX, AZ
Contact:

Re: Gustav Inspires Scammers w\Fake Domains

Postby TeMerc » Mon Sep 01, 2008 10:01 am

Hurricane Gustav: Fraud Watch
Monday, September 01, 2008

Yesterday evening, we rechecked the domains from the morning report, and found that several had been "picked up" by legitimate charities in two groups:

(1) ContributeGustav.org now forwards to:
http://www.braf.org/site/c.jfISK0OxFkG/b.4453149/
(Baton Rouge Area Foundation)

Which has a "Click Here to Donate to the Hurricane Gustav Relief and
Recovery Fund" button, which takes you to:
https://www.kintera.org/site/c.jfISK0Ox ... dIKIWPJKuF

(Kintera is a known fund-raising site)

    (2) contributiongustav.org (Same as (1))
    (3) donategustav.org (Same as (1))
    (4) donationgustav.org (same as (1))
    (6) gustavassistance.org (same as (1))
    (9) gustavcontribution.org (same as (1))
    (13) gustavlouisiana.org (same as (1))
    (14) gustavneworleans.org (same as (1))
    (16) gustavrecovery.org (same as (1))
(20) gustavcharities.com = Samaritan's Purse Give Links go to
"giving.samaritanspurse.org", a known charity.
    (21) gustavcharity.com (same as (20))
    (22) gustavdonation.com (Same as (20))
    (23) gustavrelieffund.com (same as (20))
More domains
More than 140 more new Gustav domains have been added since yesterday, with more than 200 total Gustav domains to be watching. The new group is listed here (we'll sort and update content soon, watch for an update):
    aid4gustav.com
    cleanupgustav.com
    cleanupgustav.info
    cleanupgustav.net
    cleanupgustav.org
    contributegustav.com
    contributiongustav.com
    donate2gustav.org
    donationgustav.com
    givetogustav.com
    givetogustav.org
    gustav-relief.com
    gustav08.info
    gustavadjuster.com
    gustavadvocacy.com
    gustavadvocacy.net
    gustavadvocacy.org
    gustavaftermath.com
    gustavaftermath.info
    gustavaftermath.net
    gustavaftermath.org
    gustavaid.us
    gustavaidnow.org
    gustavalert.com
    gustavangels.org
    gustavassistance.com
    gustavcare.com
    gustavcare.org
    gustavcleanup.com
    gustavconstruction.com
    gustavcontractors.com
    gustavcontractorsstore.com
    gustavcontribution.com
    gustavcuba.com
    gustavdestruction.com
    gustavdisaster.com
    gustavdisasterfund.org
    gustaverelief.com
    gustavevacuation.com
    gustavevacuation.info
    gustavevacuation.net
    gustavevacuation.org
    gustavevacuations.com
    gustavfund.net
    gustavgear.com
    gustavgetaway.com
    gustavgive.com
    gustavgive.org
    gustavhelp.info
    gustavhelpers.com
    gustavhelpers.info
    gustavhelpers.net
    gustavhelpfund.com
    gustavhelpfund.org
    gustavhelpinfo.com
    gustavhelpinfo.org
    gustavhouston.com
    gustavimages.com
    gustavinfo.org
    gustavla.com
    gustavlive.com
    gustavlouisiana.com
    gustavmississippi.com
    gustavmodels.com
    gustavnow.com
    gustavpeoplesearch.com
    gustavpeoplesearch.net
    gustavpets.com
    gustavphotos.com
    gustavpics.com
    gustavpublicadjuster.com
    gustavreferrals.com
    gustavreferrals.info
    gustavreferrals.net
    gustavreferrals.org
    gustavrefugees.com
    gustavrefugees.net
    gustavrefugees.org
    gustavrelief.net
    gustavrelief.us
    gustavreliefhelp.us
    gustavreport.com
    gustavsolidarity.org
    gustavstorm.biz
    gustavstorm.us
    gustavsucks.com
    gustavsurvivor.org
    gustavsurvivors.com
    gustavupdate.com
    gustavvictims.info
    gustavvictims.org
    gustavvictims.us
    gustavvideo.com
    gustavwiki.com
    help4gustav.com
    help4gustav.org
    helpgustav.com
    helphurriancegustav.org
    helphurricanegustavvictims.com
    huracangustav.net
    huracangustav.org
    huricane-gustav.com
    hurricane-gustav-recovery.com
    hurricane-gustav.info
    hurricanegustav2008.net
    hurricanegustav2008.org
    hurricanegustavaftermath.com
    hurricanegustavaid.org
    hurricanegustavblog.com
    hurricanegustavcare.com
    hurricanegustavcontractor.com
    hurricanegustavdisaster.com
    hurricanegustavfacts.com
    hurricanegustavforum.com
    hurricanegustavfund.com
    hurricanegustavhelp.com
    hurricanegustavhelp.org
    hurricanegustavinfo.com
    hurricanegustavinfo.org
    hurricanegustavinformation.com
    hurricanegustavrelieffund.com
    hurricanegustavstories.com
    hurricanegustavstory.com
    hurricanegustavvictims.com
    hurricanegustavvictims.net
    hurricanegustavvideo.com
    hurricanegustavvideos.com
    hurricanevictimsgustav.com
    hurricangustav08.com
    leadershipaugustavolunteers.com
    neworleansgustav.com
    rebuildinggustav.com
    rncgustavfund.com
    rncgustavrelief.com
    rncgustavrelief.net
    rncgustavrelief.org
    spelmanoperationgustav.com
    supportgustavvictims.org
    survivedgustav.org
    thegustavblog.com
    waitingforgustav.com
    women-childrens-gustav.com
    womens-childrens-gustav.com
    wwwgustav.com
    gustavtrack.com
    tsgustav.com
0-= CyberCrime & Doing Time
Image

User avatar
TeMerc
Site Admin
Site Admin
Posts: 15995
Joined: Fri Jan 28, 2005 5:16 pm
Area Of Expertise: Security
experience: I know the functions, OS settings, registry tweaks and more
PC time: What else is there in life?
Location: PHX, AZ
Contact:

Re: Gustav FraudWatch\Fake Domains

Postby TeMerc » Tue Sep 02, 2008 7:33 am

Tuesday, September 02, 2008

This is our third day of listing the newly registered domains for Hurricane Gustav. On August 31st there were Fifty-four new Gustav domains, and yesterday there were an additional One hundred forty-six new Gustav domains. Today we add One hundred seventy-five more Gustav domains. As with previous disasters, the vast majority of these domains have been purchased by two categories of domain speculators and will never be used in a meaningful way. Some are people who purchased the domains to be sold to legitimate organizations.

For instance:
Now displaying "Samaritan's Purse" charity pages, but not registered by Samaritan's Purse. No reason to suspect foul play, but Dan Brown's email address makes them "interesting".
    gustavcharities.com
    gustavcharity.com
    gustavdonation.com
    gustavrelieffund.com
Each says it is owned by "Dan Brown" with the email address, companyone@cash-evolutions.com. Dan owns more than 2,000 domain names. The real Samaritan's Purse website is registered to Jeff Chandler, jchandler@samaritan.org. It certainly appaers that Dan has made exact duplicates of the Samaritan's Purse website on these websites in order to help people find these worthy charities. This may be his own act of charity, and if so, that's great. He has made no edits to the content, he is simply loading the real charity site inside a frame. Clicking the "GIVE" button, really does give money to Samaritan's Purse. But each of these new charity domains has to checked out to be sure.

The first type of Speculator is someone who buys a domain to sell to someone. The second type of Speculator is someone who buys the domain and then sells advertising on it. The latter seems to be one of the most popular ways to make money on your domain. For instance:

gustavhurricaneblog.com is owned by Ryan Blankenship of Bakersfield, California. Were you in the Hurricane, Ryan? Then why do you need a website about it? The page is currently covered with advertising, so if you need a "Gustav Hurricane Lawyer", and you click on BloomLegal.com, presumably Mr. Blankenship gets paid. Need Wind Storm Insurance in Texas? Click txwindstorminsurance.com, and Mr. Blankenship gets paid again. (Ryan also owns: gustavstorm.info, gustavhurricanesite.com, hurricanegustaveinfo.com, hurricanegustaveinfosite.com)

Some of the new domains are real sites that anyone interested in or experiencing Gustav might want to build or participate in.

Photosites:
    gustavimages.com
    gustavphotos.com
    gustavpictures.com
    gustavrelief.net
Other types of real sites:
    gustavneworleans.com
    gustavpeoplesearch.com
    gustavpeoplesearch.net
But there are plenty of sites with a Donate Button that are not so easy to figure out . . .

gustavpets.com is building a Twitter network for people who are helping find lost pets after Gustav. They suggest we donate to a charity that has brought 3,000 pet carriers to the area to help gather strays. Real? We need to find out.

gustavsolidarity.org has information on many local charities who may be deserving of your help.

donate2gustav.org does the same, with more well-known charities.

gustavnow.com says its going to list local charities soon . . .

Some we don't understand yet, for instance, Bob Dunlap, long-time owner of "beui.com", which has always just been a family photos website for his New Orleans family (example), but now owns the domains:
    Aid4gustav.com
    Gustavaid.us
    Gustavrelief.us
    Gustavvictims.us
    Help4gustav.com
    Help4gustav.org
    Helpgustav.com
Domain speculator? Charity benefactor? We don't know.

Some of the most popular domain owners from last night's run include:
Anito Caro of Toledo, Ohio, who owns:
    gustavrecovery.info
    hurricanegustav2008.info
    hurricanegustavrecovery.org
    gustavimpact.info
    hurricanegustavhelp.info
    hurricanegustavla.info
    hurricanegustavrecovery.info
    hurricanegustavrecovery.net

Greg Greene of Mishawaka, Indiana, who owns:
    helpwithgustav.org
    gustavrescue.org
    gustavvictimassistance.org
    gustavvictimhelp.org
    gustavfoundpets.org
    gustavsangels.org
    gustavvictimcare.org
    gustavfoundpets.com
    gustavsangels.com
    gustavvictimhelp.com
    gustavvictimassistance.com
    gustavvictimcare.com
    helpwithgustav.com

Of course the "Privacy" sites, which hide WHOIS information so that people have no opportunity to use it to figure out if the domain is legitimate or not, have scored quite a bit of traffic.

GoDaddy's "Registration Privacy" service, "Domains by Proxy", lists:
    gustav08.org
    gustav-ala.info
    gustav-ala.org
    gustav-alabama.info
    gustav-alabama.org
    gustavclaims.info
    gustavclaims.org
    gustavclaims-ala.org
    gustavclaims-alabama.org
    gustavclaims-houma.org
    gustavclaims-la.org
    gustavclaims-lafayette.org
    gustavclaims-louisiana.org
    gustavclaims-mississippi.org
    gustavclaims-ms.org
    gustavclaims-nola.org
    gustavclaims-texas.org
    gustavclaims-tx.org
    gustav-la.info
    gustav-la.org
    gustav-louisiana.info
    gustav-louisiana.org
    gustav-mississippi.info
    gustav-mississippi.org
    gustav-ms.info
    gustav-ms.org
    gustavreliefnow.info
    gustavrelief-now.info
    gustavreliefnow.org
    gustavrelief-now.org
    gustavsite.info
    gustavsite.org
    gustav-texas.info
    gustav-texas.org
    gustav-tx.info
    gustav-tx.org
    gustav-ala.com
    gustav-alabama.com
    gustavclaims-houma.com
    gustavclaims-lafayette.com
    gustavclaims-ms.com
    gustavclaims-nola.com
    gustavclaimsnow.com
    gustavclaimsonline.com
    gustavclaimssite.com
    gustavclaims-tx.com
    gustav-la.com
    gustav-louisiana.com
    gustav-mississippi.com
    gustav-ms.com
    gustavreliefnow.com
    gustavrelief-now.com
    gustavshop.com
    gustavsite.com
    gustavsite.net
    gustav-texas.com
    gustav-tx.com
    newgustavclaims.com
    gustavclaims-ala.com
    gustavclaims-alabama.com
    gustavclaims-la.com
    gustavclaims-louisiana.com
    gustavclaims-mississippi.com
    gustavclaims-texas.com
Here are the new domains that need to be checked out today:
    assistgustav.com
    assistgustav.org
    donate2gustav.com
    evacuate-hurricane-gustav.info
    fuckgustav.com
    giantgustav.com
    gustav-2008.com
    gustav-ala.com
    gustav-ala.info
    gustav-ala.org
    gustav-alabama.com
    gustav-alabama.info
    gustav-alabama.org
    gustav-help.com
    gustav-images.com
    gustav-la.com
    gustav-la.info
    gustav-la.org
    gustav-louisiana.com
    gustav-louisiana.info
    gustav-louisiana.org
    gustav-mississippi.com
    gustav-mississippi.info
    gustav-mississippi.org
    gustav-ms.com
    gustav-ms.info
    gustav-ms.org
    gustav-pictures.com
    gustav-texas.com
    gustav-texas.info
    gustav-texas.org
    gustav-tx.com
    gustav-tx.info
    gustav-tx.org
    gustav08.org
    gustavaidnow.com
    gustavangels.com
    gustavassist.com
    gustavclaims-ala.com
    gustavclaims-ala.org
    gustavclaims-alabama.com
    gustavclaims-alabama.org
    gustavclaims-houma.com
    gustavclaims-houma.org
    gustavclaims-la.com
    gustavclaims-la.org
    gustavclaims-lafayette.com
    gustavclaims-lafayette.org
    gustavclaims-louisiana.com
    gustavclaims-louisiana.org
    gustavclaims-mississippi.com
    gustavclaims-mississippi.org
    gustavclaims-ms.com
    gustavclaims-ms.org
    gustavclaims-nola.com
    gustavclaims-nola.org
    gustavclaims-texas.com
    gustavclaims-texas.org
    gustavclaims-tx.com
    gustavclaims-tx.org
    gustavclaims.info
    gustavclaims.org
    gustavclaimsnow.com
    gustavclaimsonline.com
    gustavclaimssite.com
    gustavcleanup.org
    gustavdatarecovery.com
    gustavdatarecovery.org
    gustavdisaster.net
    gustavdisaster.org
    gustavdisasterfund.com
    gustavdisastersupport.com
    gustavemergency.com
    gustavemergencyrelieffund.com
    gustavfirstaid.com
    gustavfoundpets.com
    gustavfoundpets.org
    gustavfund.info
    gustavhope.com
    gustavhope.org
    gustavhurricaneaid.com
    gustavhurricaneblog.com
    gustavhurricanepictures.com
    gustavhurricanesite.com
    gustavimpact.info
    gustavjohannesson.com
    gustavkatrina.com
    gustavlegal.com
    gustavlegalhelp.com
    gustavlooters.com
    gustavonline.com
    gustavpost.com
    gustavrecovery.info
    gustavrelief-now.com
    gustavrelief-now.info
    gustavrelief-now.org
    gustavrelief2008.com
    gustavrelief2008.org
    gustavrelieffund.net
    gustavreliefnow.com
    gustavreliefnow.info
    gustavreliefnow.org
    gustavreliefonline.com
    gustavrescue.com
    gustavrescue.org
    gustavsangels.com
    gustavsangels.org
    gustavshelter.org
    gustavshop.com
    gustavsite.com
    gustavsite.info
    gustavsite.net
    gustavsite.org
    gustavsite.us
    gustavsrf.com
    gustavsrf.net
    gustavsrf.org
    gustavstories.com
    gustavstorm.info
    gustavsurvivor.com
    gustavsurvivor.net
    gustavveterans.com
    gustavveterans.info
    gustavveterans.net
    gustavveterans.org
    gustavvictimassistance.com
    gustavvictimassistance.org
    gustavvictimcare.com
    gustavvictimcare.org
    gustavvictimhelp.com
    gustavvictimhelp.org
    gustavvictimsfund.com
    gustavvictimsfund.org
    gustavvictoms.com
    gustavvideos.com
    gustavwind.com
    helpgustav.net
    helphurriancegustav.com
    helpwithgustav.com
    helpwithgustav.org
    hurricanegustav-firstaid.com
    hurricanegustav-relief.com
    hurricanegustav2008.info
    hurricanegustavaid.com
    hurricanegustavaid.net
    hurricanegustavassistance.com
    hurricanegustave.com
    hurricanegustaveinfo.com
    hurricanegustaveinfosite.com
    hurricanegustavhelp.info
    hurricanegustavla.info
    hurricanegustavlawyers.com
    hurricanegustavlawyers.net
    hurricanegustavrecovery.info
    hurricanegustavrecovery.net
    hurricanegustavrecovery.org
    hurricanegustavsupport.com
    hurricangustavrelief.com
    lagustavclaims.com
    newgustavclaims.com
    nogustav.com
    nomegustav.com
    obamagustav.com
    olivergustav.com
    ouragangustav.com
    thegustavfund.com
    uraganogustav.com
    victimofhurricanegustav.com
    victimsofhurricanegustav.com
    voicesofgustav.org
    volunteergustav.com
    flavioegustavo.net
    gustav-recovery.com
    gustavodepaula.com
    gustavorobledoisaza.com

Again, Probably none of these are fraud. During Katrina less than 1% were. But there's always that 1% . . .

0-= CyberCrime & Doing Time Blog
Image


Return to “EMERGING SECURITY THREATS!”

Who is online

Users browsing this forum: No registered users and 2 guests