So now we have a fourth site on the Earthlink web server 66.175.58.9 that is hosting an Authorize.net phishing page.
The phishing page has since been taken down. It’s a good thing that Authorize.net accounts are not the common unless you are a merchant of some kind.
Another domain using the same Earthlink web server (66.175.58.9) as joecroninfishing.com and ttouchequine.com
Phishing Email was routed through mail.aidsthai.net, located in Thailand via 88.208.216.223 located in the UK.
I have noticed a new round of phishing attacks using fake Authorize.net Late Fee Warning Notices.
So far I have examined two samples and both hacked websites are hosted on the same Earthlink web server (66.175.58.9).
The two domains that are currently hosting the phishing sites are ttouchequine.com and joecroninfishing.com. I’ll update this post if I find any others.