Zombies used to host DNS for phishing
May 04, 2005
Fraudsters are using a botnet to host not only the malicious websites, but also the DNS servers that provide domain resolution services for the targeted domain name.
The new technique makes it significantly harder to shut down phishing sites.
A conventional phishing scam site can only operate for a limited time before it is shut down, normally by the ISP that hosts the site. But the criminals have started using botnets to get around the problem.
A botnet consolidates a number of zombies so that they can be organized to work together. A zombie is a machine infected by a worm or virus awaiting instructions from hackers and fraudsters.
Using a botnet, a scammer can host the same malicious site at several zombies, and when one is shut down, modify the DNS record for the domain to point to another compromised computer.
According to a recent CipherTrust study, an average of 157,000 new zombies are identified each day.
Related: Zombies everywhere