Netcraft blocked more than 1,400 Steam phishing URLs last month, spread across 331 different websites. Surprisingly, more than 90% of these sites were hosted by just one company: Hostinger.
With more than 125 million active accounts, Steam continues to make an attractive target for fraudsters. The number of phishing attacks targeting Steam rose significantly last month, even though the fraudsters behind these attacks have had to change their tactics a few times. Last year, a popular ruse was to use Steam’s own chat client to trick victims into visiting look-alike domain names similar to the genuine steamcommunity.com. This modus operandi continued into 2015, but became less effective after Steam started to remove suspicious links from chat messages.
Consequently, many Steam phishers have abandoned the idea of registering their own look-alike domains (only two were blocked last month), and are instead using subdomains provided by free hosting services such as Hostinger. These allow the fraudsters to host Steam phishing sites with addresses like steamcommuniity.hol.es, steampoweredssuport.esy.es and steamcomcoomity.16mb.com – not quite as convincing as the hostnames used in previous attacks, although the deliberate misspellings are similar.
A Steam phishing site hosted by Hostinger at steamcomcoomity.16mb.com
Lithuania-based Hostinger provides many different second-level domains under which its customers can host a website, and the most common ones used in these attacks were esy.es, besaba.com, 16mb.com, wc.lt, hol.es and pe.hu.
Hostinger displays this content on each of its free hosting domains. Hostinger covers its costs by offering paid upgrades for those who need more resources.
Free hosting providers are an obvious choice for fraudsters who wish to carry out phishing attacks without leaving a financial trail. Hostinger’s offerings look particularly conducive for phishing, as they do not display ads on their customers’ sites, and they provide support for PHP (nearly all phishing kits are written in PHP).
Nonetheless, the incredible popularity of Hostinger within the Steam phishing arena is rather unusual. While Hostinger was used to host over 90% of all Steam phishing URLs, it hosted only 0.6% of all other phishing attacks that were blocked during March.
This preference of using Hostinger could suggest that the fraudsters behind most of these Steam phishing attacks are working together or copying each others’ methodologies. In addition, there are examples of phishing sites that have remained up for long periods of time, which makes it an attractive hosting location for phishers. The hostname steamcomcoomity.16mb.com (shown in the earlier screenshot) has been serving a Steam phishing site from Hostinger’s infrastructure since last year and is still serving it at the time of writing.
Netcraft provides a Phishing Alerts service for hosting providers and domain registrars who are unwittingly providing facilities for phishing. Brand owners can also use Netcraft’s Takedown service to identify phishing attacks against them and get fraudulent sites shut down.