Welcome to duststar theory

Asiasoftt.net demystified

Author duststar | 08.01.2010 | Category Cyber Security, MapleSEA

Introduction

Chrisloup at Asiasoft MapleSEA Forum alerted that a phishing site using the domain “asiasoftt.net” was being spammed in Free Market.

Demystifying the phish site

1. WHOIS Details

Domain Name: asiasoftt.net

Registrar: HICHINA ZHICHENG TECHNOLOGY LTD.
Whois Server: grs.hichina.com
Referral URL: http://www.net.cn
Status: OK

Expiration Date: 2011-01-06
Creation Date: 2010-01-06
Last Update Date: 2010-01-06

Registrant ID ………………. hc397045121-cn
Registrant Name …………….. asaaf fsafd
Registrant Organization ……… huangjuntan
Registrant Address ………….. fdsfsdfs
Registrant City …………….. xiamenshi
Registrant Province/State ……. fujian
Registrant Postal Code ………. 361000
Registrant Country Code ……… CN
Registrant Phone Number ……… +86.05926286282 -
Registrant Fax ……………… +86.05926286282 -
Registrant Email ……………. 53474113@qq.com

The domain was registered using incomplete information. Notice the “Registrant Name” and “Registrant Address” were “randomised”. However, the registrant was not very smart as “He” left a traceable e-mail address, and “Registrant Organization”.

2. DNS Records

asiasoftt.net A 1 hour  76.73.42.94 ()
asiasoftt.net MX 1 hour 10 mail.asiasoftt.net
asiasoftt.net NS 1 hour  dns17.hichina.com
asiasoftt.net NS 1 hour  dns18.hichina.com
asiasoftt.net SOA 1 hour  dns17.hichina.com. hostmaster.hichina.com. 2010010624 10800 2000 691200 50000
mail.asiasoftt.net A 1 hour  76.73.42.94 ()
www.asiasoftt.net A 1 hour  76.73.42.94 ()

IP: 76.73.42.94
Website Status: active
Server Type: Microsoft-IIS/6.0

When you enter http://76.73.42.94, you get redirected to http://www.free258.com. Therefore, asiasoftt.net was hosted on a “Free webspace” account.

3. Who is the owner of the domain?

Tracing 53474113@qq.com lead us to establish certain facts:
a. This e-mail was used in a Chinese forum looking for potential partners to conduct MMO games currency trading business. (in short: selling of game currency to profit in real world)
b. Thie e-mail was also used in a job advertisement.

The owner real name is 黄俊坦 (Huang Jun Tan – Remeber earlier on “Registrant Organization” = ”huangjuntan”?). He is the General Manager of 厦门旺佳游网络有限公司 (51 to 100 employees). The company is located in China: 厦门市湖滨南路811号1204室.

It cost $4,000 Chinese Yuan per month to hire a web developer (In the above job advertisement). That is roughly $820 Singapore Dollars. I think it make sense for them to phish maplers, empty out their items, sell for mesos then sell for Singapore Dollars. Every 8 billion mesos they sell can feed a web developer for 1 month.

.duststar