PIRT (Phishing Incident Reporting and Termination) is making headlines around the web, but take their plans with a grain’s worth of salt for now. For those of you that haven’t heard or can’t be troubled to follow the links, PIRT is a non-profit organization comprised of volunteers, dedicated to tracking links in spam to phishing websites and concentrating their efforts on "shutting those sites down." It may sound like a valiant and praise-worthy effort, but our researchers are unearthing more details that may cast a shadow of doubt on this organizations methods and goals.
PIRT’s methods for "shutting down" sites aren’t too clearly defined, their homepage mentions contacting hosts and ISPs and requesting their cooperation, but as Netcraft reports, most phishing schemes launch from the same netblocks repeatedly:
Fraudsters will often host their sites in developing countries with limited law enforcement resources and incentivize the hosting company to keep the site running as long as it possibly can. Indeed, some unscrupulous hosting companies actually promote fraud hosting as a service. Some hosting companies offer fraud hosting as a service whereby they are incentivized to keep the site up as long as possible, and this necessitates more extensive action.