[PIRT#887149] Multiple brands on AS27823 200.58.114.129
CastleCops
->
PIRT Fried Phish Reports
Author:
downie
,
Posted: Sun Jul 06, 2008 3:23 am
Post subject:
[PIRT#887149] Multiple brands on AS27823 200.58.114.129
Phish Alert
Full Report:
/Bank_of_Montreal_Lloyds_TSB_Regions_Bank_Wachovia_Wells_Fargo_Yorkshire_Bank_phish887149.html
Consumed following related reports:
[886330]
http://www.infofiesta.com/web/administrator/includes/pcl/update.htm
[887360]
http://infofiesta.com/web/components/com_magazine/bmo.php
[887383]
http://infofiesta.com/web/html/components/com_poll/index.htm
The URL accesses a Lloyds TSB phishing site, active at the time of investigation.
A page fetch was successful.
There is a WAchovia phish at
http://infofiesta.com/web/html/components/com_poll/index.htm
There is a BMO phish at
http://infofiesta.com/web/components/com_magazine/bmo.php
There is a Wells Fargo phish at
http://www.infofiesta.com/web/administrator/includes/pcl/update.htmChanged
status to confirmed phish.IP Converted: 200.58.114.129
dword = 3359273601
hex1 = 0xc83a7281
hex2 = 0xc8.0x3a.0x72.0x81
oct = 0310.072.0162.0201
View CIDR AS27823 Report:
http://www.cidr-report.org/cgi-bin/as-report?as=27823
"27823 | AR | lacnic | 2006-05-12 | Dattatec.com"<br />
Extended information for AS27823:
State/Province:
Country: ar
Responsible Domain: dattatec.com
Abuse Email:
marketing@dattatec.com
Yorkshire Bank phish at
http://infofiesta.com/portal/components/com_zoom/lib/home.ybonline.co.uk/index.htmlRegions
Bank phish at
http://infofiesta.com/web/editor/Login.htmGenerated
and sent email phish alert to respective parties.
Quote:
http://infofiesta.com/portal/includes/Archive/index.php
CastleCops
->
PIRT Fried Phish Reports
All times are GMT
Page
1
of
1
Powered by
phpBB
© 2001 phpBB Group