Speculators snap up Virginia Tech-related domains

Spammers and malware purveyors feed on tragedy

Speculators have registered Web domains related to the Virginia Tech killings, including URLs such as vatechshooting.com and vtmurders.com. Some are for sale for as much as $1 million.

Numerous domains have been registered at GoDaddy.com since Monday's shootings, according to searches at the discount registrar. They include vatechshooting.com, vtmurders.com, vtkillings.com, vatechshooting.net, vtrampage.com and vatechmassacre.com.

The domains were registered Monday, the day of the shootings; several were registered via an anonymous registrant service that masks the name, phone number and mailing address of the person who purchased the URL.

According to reports in the Roanoke Times in Virginia, Joseph Parker of Christiansburg, Va., registered vtmurders.com and vtkillings.com, both of which he placed for sale on his Web site at $250,000. Parker is allegedly offering other domains, including choseng-hui.com, for $1 million. His Web site, although online earlier Wednesday, was greeting visitors later that afternoon with the message, "Site Down For Service." Parker did not reply to e-mail from Computerworld.

As of late Wednesday, several Virginia Tech-related domains were for sale on eBay, including a three-URL package of virginiatech2007.com, virginiatech2007.net and virginiatech2007.org, priced at $45,000.

As recently as Tuesday, however, additional graphic domains and URLs that could potentially be used for fraud were posted on the online auction site, including vatechcarnage.com ($100,000 to buy immediately) and vatechvictimsfund.com (offered at $10,000). Those auctions, however, had been yanked from the site by Wednesday.

Domain registration spikes are not unusual in the aftermath of major news events, with those registering either expecting a windfall on the sale of notable URLs or, in some cases, using them as lures for spam or phishing attacks. After the Asian tidal wave disaster of December 2004, for example, a Canadian art student tried to sell tsunamirelief.com on eBay for $50,000. Several bogus sites playing off the Katrina hurricane of 2005 raked in money from people fooled into thinking they were donating to the American Red Cross.

Although not related to the domain registrations, at least one spammed Virginia Tech scam is already in circulation, a security company said today. Spam claiming to offer video of the shootings is being sent, said Sophos PLC, but the message's attachment -- a Windows screen-saver file named TERROR_EM_VIRGINIA.scr -- is actually an identity-stealing Trojan designed to pinch banking usernames and passwords.

"It is extremely disturbing that criminals have so quickly jumped to exploiting this horrible tragedy," said Ron O'Brien, a Sophos senior security analyst, in a statement. "Unfortunately, it’s not that surprising. We’ve seen similar behavior with other tragedies, like Hurricane Katrina and the death of Pope John Paul II."

Virginia Tech's official Web site is up and running, as is a memorial site the university has set up.

Copyright © 2007 IDG Communications, Inc.

Bing’s AI chatbot came to work for me. I had to fire it.
Shop Tech Products at Amazon