: Saturday, February 14, 2004 11:13 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] New Phishing Scam
The site is finally non-responsive.
Kevin Bilbee
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Rick Klinge
Sent: Saturday, February 14, 2004 5:11
... and thought the issue had been finally addressed by A+Net
mid-day Saturday.
Darin.
- Original Message -
From: Andy Schmidt [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Sunday, February 15, 2004 11:06 AM
Subject: RE: [Declude.JunkMail] New Phishing Scam
Nope,
The original link
That is not the phishing link that is a reale link to paypal
Kevin Bilbee
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Andy Schmidt
Sent: Sunday, February 15, 2004 8:06 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] New Phishing Scam
, February 14, 2004 5:11 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] New Phishing Scam
I thought about that earlier too.. But then I soon realized.. They are not
that swift.
~Rick
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Andy Schmidt
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] New Phishing Scam
Pretty wild for sure.. Anyone send it to [EMAIL PROTECTED] ?
~Rick
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Matt
Sent: Saturday, February 14, 2004 1:09 AM
To: [EMAIL
: [Declude.JunkMail] New Phishing Scam
I believe Kevin said that he did something like that when he
posted it.
It's been 30 minutes since I called and they still haven't managed to
take the site down. Maybe others might want to give their 24 hour
support line a call at 888-301-2516.
Matt
]
Subject: RE: [Declude.JunkMail] New Phishing Scam
Yes, I sent to abuse and support as per their tech support.
I just got off the phone with them. They are still disinterested
in shutting
down the site.
I have been doing some research on a place to report these issues and
actualy have someone
.
I guess my question should have been: How?
Regards,
Kami
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff
(Lists)
Sent: Friday, February 13, 2004 6:23 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] New Phishing Scam
: Saturday, February 14, 2004 5:25 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] New Phishing Scam
John..
Yes I agree it is a scam.. I visited the site and it is definitely a scam.
Needless to say PayPal would never send such an email.
But my question was not posed right
]
[mailto:[EMAIL PROTECTED]]On Behalf Of Kevin Bilbee
Sent: Saturday, February 14, 2004 12:17 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] New Phishing Scam
Yes, I sent to abuse and support as per their tech support.
I just got off the phone with them. They are still disinterested
: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Kevin Bilbee
Sent: Saturday, February 14, 2004 9:42 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] New Phishing Scam
I am on the phione with them now. I suggest we all call and take up all of
their tech supoport lines until
.
Kevin
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Kevin Bilbee
Sent: Saturday, February 14, 2004 9:42 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] New Phishing Scam
I am on the phione with them now. I suggest we all call
Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Kevin Bilbee
Sent: Saturday, February 14, 2004 9:42 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] New Phishing Scam
I am on the phione with them now. I suggest we all call and take up all of their
tech
Below is an email we received - it is an Ebay scam or so it seems. I notified verio
just to be on the safe side. It points to:
http://198.173.234.225/stats.htm
-Nick Hayer
Received: from 061093114108.ctinets.com [61.93.114.108] by mx1.vtbass.com
(SMTPD32-8.05) id A4A56045A; Sat, 14 Feb 2004
1:28 PM
Subject: RE: [Declude.JunkMail] New Phishing Scam
Still running from here.
Just got off the phone with them and told them very clearly that they are now
considered an accessory to the crime. The person I talked too that answered the phone
would not let me talk to any one else, he just
Kevin Bilbee wrote:
So, Matt I see you have called multiple times. On my last call they
asked if I was Matt or Kevin.
:)
I only spoke to their support line once, however I also called their
sales line this morning and then got a call back from a higher up after
an impassioned and forceful
]
Subject: RE: [Declude.JunkMail] New Phishing Scam #2
Below is an email we received - it is an Ebay scam or so it
seems. I notified verio just to be on the safe side. It points to:
http://198.173.234.225/stats.htm
-Nick Hayer
---
[This E-mail was scanned for viruses by Declude Virus (http
: [Declude.JunkMail] New Phishing Scam
The damn site is still up...24 hours later and these people
haven't pulled the site. I just called their sales line and asked
that they find someone at a higher level to direct this to. It's
beyond me how these people can pull up the address
Here's someone to contact directly. This is the person that I spoke
with earlier today, supposedly a manager at their company. Note that
the phone number might not be active, it's only what showed up on my
caller ID.
David Thompson
[EMAIL PROTECTED]
(858) 450-5034
I would recommend that
Resending...
Original Message
Here's someone to contact directly. This is the person that I spoke
with earlier today, supposedly a manager at their company. Note that
the phone number might not be active, it's only what showed up on my
caller ID.
David Thompson
[EMAIL
I think it may be time to Slashdot this thing. Anyone with an account
that could post it there?
These guys need to be taught a lesson.
BTW, I tried calling David with that phone number that I gave out and
it doesn't take incoming phone calls. The E-mail address though does
work.
John,
Or CNET, or anyone else that is in the press, would
do quite a bit of damage to the host...
- Original Message -
From:
Matt
To: [EMAIL PROTECTED]
Sent: Saturday, February 14, 2004 12:14
PM
Subject: Re: [Declude.JunkMail] New
Phishing Scam
I think it may
Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On
Behalf Of Matt
Sent: Saturday, February 14, 2004 12:14 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail]
New Phishing Scam
I think it may be time to Slashdot this thing.
Anyone with an account that could post
PROTECTED]
On Behalf Of Darin CoxSent: Saturday, February 14, 2004
01:04 PMTo: [EMAIL PROTECTED]Subject: Re:
[Declude.JunkMail] New Phishing Scam
Well...I called in to join the fight...but
checked the site while I was on hold and it looks like they've finally taken
it down...so I hung up
] On Behalf Of Darin Cox
Sent: Saturday, February 14, 2004 01:04 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] New Phishing Scam
Well...I called in to join the fight...but checked the site while I was on
hold and it looks like they've finally taken it down...so I hung up.
Darin
The site is finally non-responsive.
Kevin Bilbee
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Rick Klinge
Sent: Saturday, February 14, 2004 5:11 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] New Phishing Scam
I thought about
Kevin:
Could you please send the Header and the actual page- so we can see the
code.. if we are to filter it we have to see the code.. where the URL is
pointing, etc.
Regards,
Kami
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Kevin
BilbeeSent: Friday, February 13, 2004
Here is the header and source information.
Kevin
Received: from ns1.ssc-isp.net [12.9.25.242] by standardabrasives.com
(SMTPD32-8.05) id A6F11B600C2; Fri, 13 Feb 2004 15:00:01 -0800
Received: from smtp1.nix.paypal.com ([64.4.240.74])
by ns1.ssc-isp.net (SAVSMTP 3.1.3.37) with SMTP id
Of Kevin Bilbee
Sent: Friday, February 13, 2004 6:06 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] New Phishing Scam
Here is the header and source information.
Kevin
Received: from ns1.ssc-isp.net [12.9.25.242] by standardabrasives.com
(SMTPD32-8.05) id A6F11B600C2; Fri, 13 Feb 2004 15
Here is a new phishing scam...
These look like great targets for a SpamAssassin RegEx or even an
IMail rule--a dotted-decimal href followed by an oft-phished domain in
the anchor text. I don't think the headers would be what I'd target.
But that's just me...
--Sandy
-UIDL: 373607791
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Kami Razvan
Sent: Friday, February 13, 2004 3:12 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] New Phishing Scam
This is strange Kevin...
http://www.senderbase.org/search
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Kami Razvan
Sent: Friday, February 13, 2004 3:12 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] New Phishing Scam
This is strange Kevin...
http
Title: Message
Very convincing;
in the HTML view of the message Kevinsent, you can see the IP address of
the real destination, which is of course not PayPal. The website there
uses all of PayPal's actual images and HTTPS links and forms to provide the user
experience except the sucker
Of Colbeck,
AndrewSent: Friday, February 13, 2004 4:20 PMTo:
'[EMAIL PROTECTED]'Subject: RE: [Declude.JunkMail] New
Phishing Scam
Very
convincing; in the HTML view of the message Kevinsent, you can see the
IP address of the real destination, which is of course not PayPal
I can't believe that this site hasn't been pulled yet. I called the
company just now and showed them the site. Phone calls typically get a
faster response. We'll see.
Matt
Colbeck, Andrew wrote:
Message
Very
convincing; in the HTML view of the message Kevinsent, you can see the
I saw your correction and it appears that you are bypassing a gateway
server which threw me off. Still though, the same advice applies.
Credit to Andrew for this work around as well.
Matt
Matt wrote:
Kevin,
Two very important things here. The scammers are using BONDEDSENDER
IP's,
Kevin,
Two very important things here. The scammers are using BONDEDSENDER
IP's, forged in the headers, in order to fool your system into passing
this. You are clearly scanning on multiple hops, and any whitelist RBL
that you are using need to be limited to the last hop only, i.e.
Pretty wild for sure.. Anyone send it to [EMAIL PROTECTED] ?
~Rick
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Matt
Sent: Saturday, February 14, 2004 1:09 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] New Phishing Scam
I can't believe
for sure.. Anyone send it to [EMAIL PROTECTED] ?
~Rick
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Matt
Sent: Saturday, February 14, 2004 1:09 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] New Phishing Scam
I can't believe that this site hasn't
39 matches
Mail list logo
