0 Members and 2 Guests are viewing this topic.
These domains appear to be used in rotation: a group is activated for a period of time, and then replaced by another group. Previous reports at PhishTank show that these domains once resided on other IP addresses, so they may be relocated periodically, possibly to avoid IP filtering:confirmed: http://sameid.net/ip/87.237.13.68/http://www.google.com/search?q=ymlp*.net+AS8368+site:phishtank.com