lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <20040320200238.WXSG3598.fep04-mail.bloor.is.net.cable.rogers.com@BillDell> From: full-disclosure at royds.net (Bill Royds) Subject: Another false Citibank e-mail...a new phishing? Phishing mails don't have any need to use the %01 exploit if they can get gullible people to click on a link in an email message that just has a plain IP address as this one does. That IP address has reverse lookup to 218-36-71-193.rev.krline.net which has whois information Registrant: KrLine (KRLINE2-DOM) #203, Shinhan bldg, 902-55 Togok-dong, Kangnamgu Seoul 135-270 KR Domain Name: KRLINE.NET Administrative Contact, Technical Contact: KrLine Internet Service Inc. (DM3184-ORG) domain@...INE.NET #203, Shinhan bldg, 802-55 Seoul, Seoul KR 82-2-3461-3282 fax: 82-2-572-3471 Record expires on 01-Oct-2006. Record created on 01-Oct-1999. Database last updated on 20-Mar-2004 14:59:12 EST. Domain servers in listed order: NS1.KRLINE.NET 211.47.128.1 NS2.KRLINE.NET 211.47.128.2 ======================================== Why do you think Citibank would use an ISP in Korea to check accounts? It is an obvious phishing expedition. The only thing new is that is using SSL for the connection to the scamp web site to allow people to feel that it is somehow secure. -----Original Message----- From: full-disclosure-admin@...ts.netsys.com [mailto:full-disclosure-admin@...ts.netsys.com] On Behalf Of Elia Florio Sent: March 20, 2004 2:24 PM To: full-disclosure@...ts.netsys.com Subject: [Full-Disclosure] Another false Citibank e-mail...a new phishing? I receveid this bad-spoofed-Citibank e-mail, which points to a PHP page which ask for credit card number..........and stole it!!! Is it the next phishing e-mail ? The link points to http://218.36.71.193:443/citi/ It does not use "%01" exploit to show a spoofed-URL in the Explorer bar. EF
Powered by blists - more mailing lists