Hello, welcome to the Thursday, October 4th, 2018 edition of the Zanzan and Storm Center's

Stormcast. My name is Johannes Ulrich. And I'm recording from Honolulu, Hawaii.

We got a pretty neat guest post today from Nick Carter. Now, he came across a fishing site that

wasn't very well protected and allowed access to logs and a number of additional details about the site, including a SIP archive that contained the code behind the site. This is always nice from a research point of view because it gives you a little bit inside in sort of how the

back end of all of this works. In this case, it even led to the email address of the person

receiving all of the data from this fishing site. Also, gives you a handle on how many people

actually fall for these fishing attacks. One other sort of interesting facet about

this particular attack. The attacker here used a long list of IP addresses from which it would

not accept any connections. Now, these include a lot of cloud providers and the like. The reason why

you find cloud providers in blacklists

like this is, well, normal users, they don't connect from cloud providers. They connect from

home systems, maybe from business systems, but not from networks that are typically only

housing servers. On the other hand, a lot of researchers, of course,

they use cloud systems either to run little virtual machines that make it easier and safer

to access malicious sites or just to run automated scripts to, for example, probe for fishing

sites like this. And if you come across anything interesting like this, of course, let us know.

And yes, we do accept guest posts.

They have to be current, have to be technically interesting, and of course, please no marketing.

Now, sticking with fishing for our next story, apparently Microsoft Asia blob storage is being used to host fishing sites.

The trick here is not just that you now have a site with a good IP reputation and such that's probably not going to get blocked easily,

but as an added benefit, you'll also get a Microsoft TLS certificate.

This blob storage is usually a subdomain under blob.core.org.

...