[jitsi-dev] scam site

Eeri_Kask · 2014-01-22 17:53:57 UTC

There's not much else we can do.

How about going as much public as possible? ("The guardian" is probably
not interested though.) There's lots of reputation at stake and silence
would unavoidably "support their game".

Sean_Whalen · 2014-01-22 18:39:50 UTC

Please do not contact premiumhosting[.]cl about this. That is a
(unrelated?) web host , not the domain registrar, who would need to be
the one to be contacted about this.

They actually are hosting the malware, and would want to know.
lee@dev01:~$ ping tijsi.com
PING tijsi.com (162.248.50.103) 56(84) bytes of data.
64 bytes from lightning.premiumhosting.cl (162.248.50.103): icmp_req=1
ttl=53 time=53.5 ms
64 bytes from lightning.premiumhosting.cl (162.248.50.103): icmp_req=2
ttl=53 time=48.1 ms
64 bytes from lightning.premiumhosting.cl (162.248.50.103): icmp_req=3
ttl=53 time=47.0 ms

They are also hosting the DNS at NS1.MIHOSTINGWEB.NET because
www.MIHOSTINGWEB.NET resolves to http://premiumhosting.cl/

Apologizes. I don't know how I missed that relationship on robtex. That's
what I get for investigating with my phone

···

On Wed, Jan 22, 2014 at 11:55 AM, Lee Sharp <leesharp@hal-pc.org> wrote:

On 01/22/2014 07:08 AM, Sean Whalen wrote:

On Wed, Jan 22, 2014 at 12:53 PM, Eeri Kask <Eeri.Kask@mailbox.tu-dresden.de > wrote:

> There's not much else we can do.

How about going as much public as possible? ("The guardian" is probably
not interested though.) There's lots of reputation at stake and silence
would unavoidably "support their game".

That would probably do more harm than good. Those who don't know Jitsi
might associate it with "that malware site". As previously mentioned, there
are plenty of other things we can do.

Don_Alexander · 2014-01-22 19:54:57 UTC

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Please do not contact premiumhosting[.]cl about this. That is a
(unrelated?) web host , not the domain registrar, who would

need to be

        the one to be contacted about this.

    They actually are hosting the malware, and would want to know.
    lee@dev01:~$ ping tijsi.com <http://tijsi.com>
    PING tijsi.com <http://tijsi.com> (162.248.50.103) 56(84) bytes of

data.

64 bytes from lightning.premiumhosting.cl

<http://lightning.premiumhosting.cl> (162.248.50.103): icmp_req=1 ttl=53
time=53.5 ms

64 bytes from lightning.premiumhosting.cl

<http://lightning.premiumhosting.cl> (162.248.50.103): icmp_req=2 ttl=53
time=48.1 ms

64 bytes from lightning.premiumhosting.cl

<http://lightning.premiumhosting.cl> (162.248.50.103): icmp_req=3 ttl=53
time=47.0 ms

They are also hosting the DNS at NS1.MIHOSTINGWEB.NET

<http://NS1.MIHOSTINGWEB.NET> because www.MIHOSTINGWEB.NET
<http://www.MIHOSTINGWEB.NET> resolves to http://premiumhosting.cl/

Apologizes. I don't know how I missed that relationship on robtex.

That's what I get for investigating with my phone

> There's not much else we can do.

How about going as much public as possible? ("The guardian" is

probably

not interested though.) There's lots of reputation at stake and

silence

would unavoidably "support their game".

That would probably do more harm than good. Those who don't know Jitsi

might associate it with "that malware site". As previously mentioned,
there are plenty of other things we can do.

Well on the plus side.. it is nice to know that malware authors feel
Jitisi is such a popular program and that many people will look to
download it that it is worth trying to exploit the name via a phishing
site.

I say you were on the right track myself.

_______________________________________________
dev mailing list
dev@jitsi.org
Unsubscribe instructions and other list options:
http://lists.jitsi.org/mailman/listinfo/dev

- --

···

On 22/01/14 18:39, Sean Whalen wrote:

On Wed, Jan 22, 2014 at 11:55 AM, Lee Sharp <leesharp@hal-pc.org <mailto:leesharp@hal-pc.org>> wrote:
On 01/22/2014 07:08 AM, Sean Whalen wrote:
On Wed, Jan 22, 2014 at 12:53 PM, Eeri Kask <Eeri.Kask@mailbox.tu-dresden.de <mailto:Eeri.Kask@mailbox.tu-dresden.de>> wrote:

==

Don Alexander

It's a tough job, but some mug has to do it...

RooSoft Ltd

Emil_Ivov1 · 2014-01-22 19:31:24 UTC

Hey all,

Most of you probably already saw Yasen's mail here but just to make sure this thread is complete:

The scam site has now been taken down:

http://lists.jitsi.org/pipermail/dev/2014-January/019724.html
http://lists.jitsi.org/pipermail/dev/2014-January/019726.html

They still have the domain name though, so we should keep an eye out for them.

Cheers,
Emil

···

On 22.01.14, 19:39, Sean Whalen wrote:

On Wed, Jan 22, 2014 at 11:55 AM, Lee Sharp <leesharp@hal-pc.org > <mailto:leesharp@hal-pc.org>> wrote:

    On 01/22/2014 07:08 AM, Sean Whalen wrote:

        Please do not contact premiumhosting[.]cl about this. That is a
        (unrelated?) web host , not the domain registrar, who would need
        to be
        the one to be contacted about this.

    They actually are hosting the malware, and would want to know.
    lee@dev01:~$ ping tijsi.com <http://tijsi.com>
    PING tijsi.com <http://tijsi.com> (162.248.50.103) 56(84) bytes of data.
    64 bytes from lightning.premiumhosting.cl
    <http://lightning.premiumhosting.cl> (162.248.50.103): icmp_req=1
    ttl=53 time=53.5 ms
    64 bytes from lightning.premiumhosting.cl
    <http://lightning.premiumhosting.cl> (162.248.50.103): icmp_req=2
    ttl=53 time=48.1 ms
    64 bytes from lightning.premiumhosting.cl
    <http://lightning.premiumhosting.cl> (162.248.50.103): icmp_req=3
    ttl=53 time=47.0 ms

    They are also hosting the DNS at NS1.MIHOSTINGWEB.NET
    <http://NS1.MIHOSTINGWEB.NET> because www.MIHOSTINGWEB.NET
    <http://www.MIHOSTINGWEB.NET> resolves to http://premiumhosting.cl/

Apologizes. I don't know how I missed that relationship on robtex.
That's what I get for investigating with my phone

On Wed, Jan 22, 2014 at 12:53 PM, Eeri Kask > <Eeri.Kask@mailbox.tu-dresden.de > <mailto:Eeri.Kask@mailbox.tu-dresden.de>> wrote:

     > There's not much else we can do.

    How about going as much public as possible? ("The guardian" is probably
    not interested though.) There's lots of reputation at stake and silence
    would unavoidably "support their game".

That would probably do more harm than good. Those who don't know Jitsi
might associate it with "that malware site". As previously mentioned,
there are plenty of other things we can do.

_______________________________________________
dev mailing list
dev@jitsi.org
Unsubscribe instructions and other list options:
http://lists.jitsi.org/mailman/listinfo/dev

--
https://jitsi.org