Greg6155 Posted March 15, 2018 ID:1224600 Share Posted March 15, 2018 Hello, A site was delisted yesterday - www.jssbarristers.ca Another site on the same server is being reported today, but I think it is just because they shared the same IP address (64.46.39.14) Is it possible to have that IP and/or the below domains removed: www.ufcw247.com ufcw247.com Thank you in advance, and thank you for the quick removal yesterday! Link to post Share on other sites More sharing options...
MysteryFCM Posted March 15, 2018 ID:1224601 Share Posted March 15, 2018 There' still an active phish present at; hxxp://www.ufcw247.com/files/?utm_source=oPBKWDC3&utm_medium=3k5cCIRB&utm_campaign=p94mLSGI&utm_term=niNWJ2Kg&utm_content=EH7uYot8/ Link to post Share on other sites More sharing options...
Greg6155 Posted March 15, 2018 Author ID:1224609 Share Posted March 15, 2018 Oh my, thank you for the details. That has been removed as well as several other sub directories to it. We have checked using source control and there are no more issues with www.ufcw247.com. Is there somewhere I can check to have found out that information? Link to post Share on other sites More sharing options...
MysteryFCM Posted March 15, 2018 ID:1224634 Share Posted March 15, 2018 The URL is still showing as live here. The URL could've been identified via multiple sources (e.g. PhishTank, OpenPhish, VirusTotal) Link to post Share on other sites More sharing options...
Greg6155 Posted March 15, 2018 Author ID:1224635 Share Posted March 15, 2018 I see a Forbidden page when trying to access that link. We did switch the site to a new server today, perhaps it used the old server, the old one has been cleaned as well, do you still see the URL as live? Link to post Share on other sites More sharing options...
MysteryFCM Posted March 15, 2018 ID:1224639 Share Posted March 15, 2018 It's a 403 without the querystring, but live with it. Link to post Share on other sites More sharing options...
Greg6155 Posted March 16, 2018 Author ID:1224811 Share Posted March 16, 2018 Good day, I still see ufcw247.com listed on hpHosts but cannot find any way to pull up the phishing URL. Do you still see it? Please remove if not. Thank you! Link to post Share on other sites More sharing options...
MysteryFCM Posted March 16, 2018 ID:1224816 Share Posted March 16, 2018 It' now producing a 403, thank you. The block will be removed on the next update. Link to post Share on other sites More sharing options...
Recommended Posts