full-disclosure - strange domain name in phishing email

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.64.0603142134010.32040@localhost.localdomain>
Date: Wed Mar 15 02:45:29 2006
From: gboyce at badbelly.com (gboyce)
Subject: strange domain name in phishing email

I tried this trick against my personal Apache 2 webserver, and got a 400 
bad request as well.  The apache log is showing "Client sent malformed 
Host header".

It looks like Apache is getting the decimal host header, and doesn't 
understand what to do with it.  Oddly, the host mentioned in the initial 
e-mail is also Apache, but it's Apache 1.3.

Is your Apache on windows server 1.x or 2.x?

On Tue, 14 Mar 2006, Alice Bryson wrote:

> BTW, this kind of ip address would not always work. i try to use
> http://2887060730/ to access an internal web server
> http://172.21.12.250, but failed.
> It said 400 bad request.
> I use Windows XP IE 6, web server is Apache on Windows 2003, does
> anyone know why?
>
>
>
> 2006/3/11, Jianqiang Xin <jqxin2006@...il.com>:
>> hi,
>> I received several phishing emails. One interesting thing is the link to
>> phishing website has the link:
>> http://1406379699/dbweb/ws/ebay/index.htm
>>
>> If you click it, it goes to a fake ebay server. The DNS result shows:
>>
>>> 1406379699
>> Server:
>> Address:
>>
>> Name:    ip-166-179.sn2.eutelia.it
>> Address:  83.211.166.179
>>
>> I do not understand why 1406379699 equal to ip-166-179.sn2.eutelia.it?
>> Thanks for your help.
>>
>>
>> yours,
>> jqxin2006
>>
>> _______________________________________________
>> Full-Disclosure - We believe in it.
>> Charter:
>> http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
>>
>>
>
>
> --
> Homepage:http://www.lwang.org
> We collect spam for research at:
> mailto:abryson@...efocus.com
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>