A few days ago, the #Rock phishing group has -again- switched its geographical targets for the numerous domain names they used to host phishing websites.

After .hk (Hong-Kong), the favorite domain name extension is now ".fm", delegated to the federation of Micronesia Islands. Such move might well be used to evade LE investigations, but also to "test" the online longevity of the fake websites and the responsiveness of the various registries.

For example, these domains have been used by #rock since the begining of this week:

• chiblog.fm
• chisite.fm
• bestchi.fm
• chilive.fm
• sls.fm

Unfortunately for the security community, around 250 country-code Top Level Domain name are currently accredited...

We hope BRS Media -the American company in charge of the ".fm" extension- will be more responsible and sensitive to this issue than the previous one, HKDNR.