Slashdot Mirror
A Tour of the Google Blacklist
WienerPizza writes "Michael Sutton takes us on a tour of the Google blacklist, a list of suspected phishing sites. He finds that eBay, PayPal and Bank of America combined account for 63% of the active phishing sites. Amusingly, he also reveals that Yahoo! has a nasty habit of hosting phishing sites that harvest — you guessed it — Yahoo! credentials!"
Try telling Ebay or Paypal that there's a problem. All they do is flood you with propaganda about how they're keeping you safe.
After a bad experience I closed my Paypal account and only use Ebay for small purchases.
These posts express my own personal views, not those of my employer
Do any of you guys actively block IPs and IP blocks of phishing sites? And also those "fake domains" which just have search results? If so, how is that working out?
"Thanks for all the money you paid to us. We've used it to buy off ISO among other things" -Microsoft
That guy on eBay who told me to use my Bank of America account to send money to Paypal all through his link may not have been legit?
I still get phishing emails and see sites every week. It will be a glorious day when phishing sites and emails can be shutdown within seconds of being setup. This has the downside, that if google can do it with phishing. What if the government forces them to do it with something like pr0n? or build a p2p blacklist?
Here is one of the last entries on the Google blacklist:
. ..
+http://zeta-os.com/astats/bankofamerica/........
For those not in the know, Zeta-os.com is/was the successor developer to YellowTab, which was developing a new operating system based on the old BeOS code. Now, zeta-os.com (or at least a part of it) has been reduced to a phishing site. *sigh*
Bill Clinton: Pimp we can believe in. - The Shirt!!!
...that blasts people with security information/education.
Judging by the huge proportion of the blacklisted sites that are offline (and the tiny fraction that are actually phishing sites) it seems Google isn't taking this seriously enough. There is much, much more than 341 phishing sites in the world. This list should be being updated daily, they should start a way for suggesting sites or, if it exists, make it more visible.
For the only external blacklisting organisation on Firefox, and as the provider for possibly the most widely used toolbar ever, they're not taking this seriously enough. But would any security company come in with a better free blacklist?
Any grammatical or spelling errors above are for comic effect, and do not signify imperfection in the writer.
What I find irritating is when i try to go and visit one of these sites, usually not the phishing sites but "know malware sites", it does not provide you a link. You are given the link in a text form and it is not the most handy of ways to get there.
Dear google, Thanks for keeping me safe now can I go on? No? Why not? Oh because "you are keeping me safe" and you blacklist is perfect and knows what I shouldnt visit.
I want to be able via my google account to add or remove sites (blacklist, whitelist or even better graylist [hey you be careful in there, its got spyware all over it. Just click through])
Let me guess the feature is a "beta"
Procrastinating life a way at a rapid rate of speed.
Banned IP Address - a lot of them are spammers or fake bots that will look around your website and fill your forms in the attempt to spam you or your forums/blog or whatever else you might have
Go there and put in false information. Make it harder for them to get valid data.
Once I was a four stone apology. Now I am two separate gorillas.
Either Google is really paranoid or they have yet to find a site to put on the whitelist that was linked to.
See for yourself what I mean Nothing there.
Procrastinating life a way at a rapid rate of speed.
I tried signing into one of the listed Geocities site and nothing happened... what gives?
You mean to tell me this is not a legit Yahoo Photos gateway?!
That's good to know that blacklists like these are available. This will help in prevent or even reduce the number of credit card frauds and thefts that do occur on the web today.
Chris ,
Php Programmers.
Google have fixed this link now but that was funny, most of the logins/passwords were for gmail accounts...
Am I the only one that has had a good experience with Paypal? I mean, yah normal banks can handle a deposited check, but they also charge a monthly fee. Paypal OTOH cuts me a check for *interest*, and that is ontop of the 1.5% cash back they offer. I can sell junk on EBay, and take my PayPal card right to the liquor store. That's the best banking scenario I can imagine!
Zhrodague.net - I do projects and stuff too.
This blurb is horribly biased, using ! and "amusingly" and "you guessed it". Google don't own any properties like Geocities, and don't have that problem. Yahoo! have several people weeding out scam stuff all day long.
At least Google made efforts to weed out these sites. http://www.ituloyangsulong.org/
Date: Fri, 05 Jan 2007 12:44:23 +0000
From: Bank of America
Subject: Secure SSL server update
[-- text/html is unsupported (use 'v' to view this part) --]
It made my ass laugh at 6am.
You are welcome on my lawn.
A. This problem has been discussed in depth on various
anti-spam mailng lists and newsgroups for many years.
This long-standing problem has been steadfastly ignored
by Yahoo, who went so far as to dismiss the key people
on their own abuse staff when they tried to address it.
As a consequence, it's now a better-than-even bet
that any site hosted by Yahoo belongs to a spammer,
phisher, spyware injector, child pornographer, scammer
or other lowlife. My own meager list of Yahoo-hosted
dropboxes for such stands at 26,831 this morning and
those are just the ones that brought themselves to
my attention, i.e. I'm passively noting them and not
actively searching them out.
As a result, Yahoo is one of the biggest spam-sending
and spam-supporting operations on the entire Internet.
(Oh, and Geocities is now completely infested. Rejecting
all inbound mail [except anti-spam discussions] that contains
a Geocities URL is a surprising effective tactic.)
B. They're not alone. For instance, MSN BCentral should
be renamed MSN SpamCentral -- it's just as bad. And Hotmail
cheerfully hosts spammer dropboxes by the tens of thousands.
There are others, but what makes these two particularly
annoying is that they make a public show of being anti-spam
by promoting snake-oil like SenderID and DomainKeys, both
of which are worthless. (If it isn't obvious why, then think
about the hundreds of millions of zombies -- hijacked Windows
systems -- out there and consider that their new masters
have possession of all email credentials belonging to their
former owners -- from POP passwords to PGP keys. It is not
possible to solve the forgery problem -- for any useful
definition of "solve" -- without solving this problem first.
Good luck. This same thing applies to SPF and variants, by
the way, all of which are complete failures.)
Another thing that distinguishes them is the absolutely
irresponsible, totally clueless way in which abuse reports
are handled. Most seem to disappear into black holes. The
majority of the rest are returned with semi-literate denials
that the abuse has any connection with their operation -- even
when their own IP address are clearly the source. If you'd
like to browse a huge number of examples of this, go to
Usenet's news.admin.net-abuse.email and search for
"Yahoo clueless" or "Hotmail clueless". Make coffee first.
The bottom line is that both of these services are huge abuse
magnets and have been for years, so I find it curious that
yet another report of the same old thing is deemed noteworthy.
How does Google monitor these sites for content updates to update the Google index? Does Google offer the public (or private subscribers) a way to register a website or URL to be polled ongoing? Notification that it's changed? Web services offering "uptime" monitors seem to do this, as does apparently Google News. Can mere mortals access the feature?
--
make install -not war
>>>
Amusingly, he also reveals that Yahoo! has a nasty habit of hosting phishing sites that harvest -- you guessed it -- Yahoo! credentials!"
No kidding? You mean the happiest host for the world's biggest spamhaus/scamhaus is hosting phishing sites too? No... I can't believe that.
Try reading craigslist sometime, particularly the personals sections. Every day, thousands (if not tens of thousands) of posts advertising scam porn/photo sites. Every site name includes the term 'pics' or 'photos'. All of the domains are registered with Yahoo domains and hosted on Yahoo servers. Same guy has gone through about 50 domains, always with 'photo' or 'pic' in the name - and Yahoo keeps allowing him to create new ones.
Then have a look at the thousands (if not tens of thousands) of posts every day for a credit card scam that uses Yahoo Geocities sites. At least 2 per day per city on craigslist. Yahoo Geocities allows the guy to create thousands of sites.
They are fully aware of the spamming and scamming activities of both operators (I've e-mailed them at least a dozen times and I'm sure others have done so too). They do nothing about it.
Yahoo inflates their user roles with those spammer accounts. At least a million and probably more than two million "user" accounts on Yahoo are porn bot accounts, used to spam and scam in the Yahoo chat rooms.
And you tell me that Yahoo hosts phishing sites? Why, one might start to think that Yahoo and Spam are synonyms...
Hmm, looks suspicious to me.
i went to mail.yahoo.com and they asked my name and password. i am smart and i fooled them by giving my gmail password.
Eclipse PDE and Me
The owners of the original sites should regularly rename the real image files, and replace the old files with images that would help inform the potential victim that they were on a scam site.
Next step is that the phishers no longer link to the image files, but copy them instead ... but this gives the real site owner another legal tool (copyright infringement) to shut down the phishing site plus a clear legal path to extract money from the phisher.
No. Banks are about PROFIT, not aggregation.
Aggregation may be a handy way of profiting, but so are obfuscated pricing structures and excessive fees. Someone with $200 in their account who gets laid off and bounces a check when one of their other checks is late coming in, then bounces ten more within a week because the bank happens to be a little slow notifying them that the first bounced check's overdraft fees wiped out their balance is going to net the bank a lot more than someone with $2,000 in their account.
Happened to my roommate last year. He doesn't use Wells Fargo anymore, but they made more money off the chained fees from that train-wreck than they would have off his balance in a decade.
The only thing worse than banks is those paycheck loan outfits... clear proof that God and most states in the US want the poor to stay that way.
"We have to go forth and crush every world view that doesn't believe in tolerance and free speech." - David Brin