Hurricane Gustav: Fraud Watch

For several years I've worked as an "industry partner" sharing information with the coolest Law Enforcement / Industry / Academia partnership on the planet - the National Cyber Forensics Training Alliance. One of the very first things we did together was compiling potential fraud domains for Hurricane Katrina.

Since that time, anytime we've seen a natural disaster, we've been on the lookup for domains which might be abused for fraud. It was only natural then that I retuned my settings at DomainTools yesterday to alert on Gustav domains.

Here's what we've seen so far about new domains, registered with the word "Gustav" in them:

Parked Domains

- parked at GoDaddy

contributegustav.org
contributiongustav.org
donategustav.org
donationgustav.org
gustav-relief.org
gustavassistance.org
gustavattorney.com
gustavclaims.net
gustavcontribution.org
gustavhelpers.org
gustavlawsuit.com
gustavlawyer.com
gustavlouisiana.org
gustavneworleans.org
gustavotimponi.com
gustavrecovery.org
hurricanegustavrepair.com
hurricanegustavvictims.info
hurricanegustavvictims.org
hurricanegustav08.com

Parked at IPTV Domains:

gustavcharities.com
gustavcharity.com
gustavdonation.com
gustavrelieffund.com

Parked at Mad Dog Domains & Cattle Company:

hurricanegustavresponse.info
officialhurricanegustav2008.info

Parked at Network Solutions:

gustavresponse.com


Parked on a Sedo search click ads site:

gustavhurricanerelief.com
gustavhurricanerelief.info
gustavhurricanerelief.net
gustavhurricanerelief.org
gustavlegalrelief.com
gustavlegalrelief.info

Parked at Sedoparking.com:

gustav-hurricane.info
gustav-hurricane.net
gustav-hurricane.org
gustav-hurricane.us

Points to a Sedo IP, but no content there:


hurricanegustavrelief.info
hurricanegustavrelief.net
hurricanegustavrelief.org


Parked at WebSites2You:

gustavfound.com
gustavmissing.com
survivedgustav.com
survivedgustav.net

For sale by auction on ebay and sedo by "harfordadvantage.com":

helpgustavvictims.com
helpgustavvictims.net
helpgustavvictims.org

Real Domains

There are several newly registered Gustav domains that actually contain real content!


gustavneworleans.com <== SHOCK! A real page of Gustav Information! (registered by Lawrence Muller of Virtual Corp in New York, who owns more than 400 other domains)

gustavpictures.com <== SHOCK! A real page of Gustav-related photos! (registered via Domains By Proxy by someone who seems to be "on the ground" watching the National Guard come into town)

hurricanegustavphotos.com <== SHOCK! A real page for Gustav-related photos! (registered by Cyril Payne of Theodore, Alabama. A nice frame, but no pictures yet.)

hurricanegustave.info <== SHOCK! Real information about the storm! (registered by Mark Cummings of Madisonville, Louisiana. Useful and current storm data, with Weather Channel graphics.)

Two Offering Good Deeds

Two other domains seem to be owned by Good Citizen who have reserved the domains and will give them for free to a worthy charity who would like to have the domain:


gustavrelief.info <== SHOCK! A good deed doer has reserved this domain, which he will give for free to a real charity . . .

gustavrelieffund.org <== See image



So far no signs of fraud, only Domain Speculation, but as always, we'll be keeping an eye on the situation as we move forward.

Gary Warner
Director of Research
UAB Computer Forensics
http://www.cis.uab.edu/forensics/