[PIRT#887149] Multiple brands on AS27823 200.58.114.129

CastleCops -> PIRT Fried Phish Reports

Author: downie PostPosted: Sun Jul 06, 2008 3:23 am    Post subject: [PIRT#887149] Multiple brands on AS27823 200.58.114.129

Phish Alert
 
 Full Report: CastleCops Link/Bank_of_Montreal_Lloyds_TSB_Regions_Bank_Wachovia_Wells_Fargo_Yorkshire_Bank_phish887149.html
 
 Consumed following related reports:

[886330] http://www.infofiesta.com/web/administrator/includes/pcl/update.htm
[887360] http://infofiesta.com/web/components/com_magazine/bmo.php
[887383] http://infofiesta.com/web/html/components/com_poll/index.htm
The URL accesses a Lloyds TSB phishing site, active at the time of investigation.
A page fetch was successful.
There is a WAchovia phish at
http://infofiesta.com/web/html/components/com_poll/index.htm
There is a BMO phish at
http://infofiesta.com/web/components/com_magazine/bmo.php
There is a Wells Fargo phish at
http://www.infofiesta.com/web/administrator/includes/pcl/update.htmChanged status to confirmed phish.IP Converted: 200.58.114.129

dword = 3359273601
hex1 = 0xc83a7281
hex2 = 0xc8.0x3a.0x72.0x81
oct = 0310.072.0162.0201
View CIDR AS27823 Report: http://www.cidr-report.org/cgi-bin/as-report?as=27823

"27823 | AR | lacnic | 2006-05-12 | Dattatec.com"<br />
Extended information for AS27823:
State/Province:
Country: ar
Responsible Domain: dattatec.com
Abuse Email: marketing@dattatec.com
Yorkshire Bank phish at
http://infofiesta.com/portal/components/com_zoom/lib/home.ybonline.co.uk/index.htmlRegions Bank phish at
http://infofiesta.com/web/editor/Login.htmGenerated and sent email phish alert to respective parties.
Quote:
http://infofiesta.com/portal/includes/Archive/index.php



CastleCops -> PIRT Fried Phish Reports

All times are GMT

Page 1 of 1


Powered by phpBB © 2001 phpBB Group