-----BEGIN PGP SIGNED MESSAGE----- > Details: > Phish URL: > https://business-eb.ibanking-services.com/K1/sb_login.jsp
The above is a legitimate URL. The href in the phish I saw goes to http://www.bbandt-banking.net/K1/ which points to several European ip's: www.bbandt-banking.net has address 80.61.230.46 www.bbandt-banking.net has address 82.237.121.9 www.bbandt-banking.net has address 82.248.8.175 www.bbandt-banking.net has address 84.171.90.71 www.bbandt-banking.net has address 87.52.93.144 46.230.61.80.in-addr.arpa domain name pointer ip503de62e.speed.planet.nl. 9.121.237.82.in-addr.arpa domain name pointer smt13-2-82-237-121-9.fbx.proxad.net. 175.8.248.82.in-addr.arpa domain name pointer lns-bzn-27-82-248-8-175.adsl.proxad.net. 71.90.171.84.in-addr.arpa domain name pointer p54AB5A47.dip.t-dialin.net. 144.93.52.87.in-addr.arpa domain name pointer 0x57345d90.hrnxx14.adsl-dhcp.tele.dk. Domain Name: BBANDT-BANKING.NET Registrar: MONIKER ONLINE SERVICES, INC. Whois Server: whois.moniker.com Referral URL: http://www.moniker.com/whois/whois.jsp Name Server: NS1.NOBODY-NO.COM Name Server: NS2.NOBODY-NO.COM Status: clientDeleteProhibited Status: clientTransferProhibited Status: clientUpdateProhibited Updated Date: 31-jan-2007 Creation Date: 31-jan-2007 Expiration Date: 31-jan-2008 -----BEGIN PGP SIGNATURE----- Version: PGP 6.5.8 iQCVAwUBRcIgujSDRNdrkDjdAQFOmQP/SW6QvSs80ezZtH09plZEFByXo/fLZix2 dA6WrdfwFTnS5eN9NhbmgP/WoF3fmbF3g08G/AjDmbL6CbCj+UNbUAWUgcSf07Lm Tg4+h15f3JWGSYQHn33YUJlRyWxOL49eYnD4AEICxqEKQgpggyYWE1w5K1YRtv/c 1RJtzi9lIeo= =1yFS -----END PGP SIGNATURE----- _______________________________________________ phishing mailing list [email protected] http://www.whitestar.linuxbox.org/mailman/listinfo/phishing
