SIte might be in .ch but all the graphics are coming from http://ourworld.cs.com/r1vsrr/remote/en_US/i/nav/
At 9:11 AM -0800 2/8/07, [EMAIL PROTECTED] wrote: >Oh .. sorry for a misleading comment!! The phish didn't crash my >system .. another program did and it was totally unrelated to the phish. >No, I deal with phish very carefully .. > >This one was going to .ch .. so I'm not expecting instant results. I'm >hoping before the weekend ... > > >On 7 Feb 2007 at 20:12, Steve Pirk wrote: > >> Wow, sorry it crashed your browser. I usually hit the pages >> with links or wget on linux. Seems safer that way... >> >> -- >> Steve >> panic: can't find / >> >> On Wed, 7 Feb 2007 [EMAIL PROTECTED] wrote: >> >> > >> > Reported .. after my BSOD! >> > >> > Tnx. >> > >> > On 6 Feb 2007 at 22:27, Steve Pirk wrote: >> > >> > > Paypal phishing site at: >> > > > > > > http://www.rahme-lade.ch/data/.m4/.us/refund_jewelryinc/Wmin-id327 >> > > 823/ cmd_run/ssl_secure_encrypted/login.htm >> > > >> > > Active as of Feb 6th at 10:30 pm PST >> > > -- >> > > Steve >> > > panic: can't find / >> > > >> > > ---------- Forwarded message ---------- >> > > Return-Path: <[EMAIL PROTECTED]> >> > > Received: from dante.beglobal.com >> > > (ev1s-67-15-192-32.ev1servers.net >> > > [67.15.192.32] (may be forged)) >> > > by mail.pirk.com (8.13.7/8.12.0.Beta19) with ESMTP id >> > > l175vkot014819 for <[EMAIL PROTECTED]>; Tue, 6 Feb 2007 >> > > 21:57:46 -0800 >> > > Received: from localhost ([127.0.0.1] helo=localhost.localdomain) >> > > by dante.beglobal.com with esmtp (Exim 4.63) >> > > (envelope-from <[EMAIL PROTECTED]>) >> > > id 1HEfoJ-0007Zz-OE >> > > for [EMAIL PROTECTED]; Tue, 06 Feb 2007 23:57:39 -0600 >> > > Date: Tue, 6 Feb 2007 23:57:39 -0600 >> > > To: "[EMAIL PROTECTED]" <[EMAIL PROTECTED]> >> > > From: [EMAIL PROTECTED] >> > > Subject: Receipt for your payment to [EMAIL PROTECTED] >> > > Message-ID: >> > > <[EMAIL PROTECTED]> >> > > X-Priority: 3 X-Mailer: PHPMailer [version 1.72] MIME-Version: 1.0 >> > > Content-Transfer-Encoding: 8bit Content-Type: text/html; >> > > charset="iso-8859-1" X-AntiAbuse: This header was added to track >> > > abuse, >> > > please include it with any abuse report >> > > X-AntiAbuse: Primary Hostname - dante.beglobal.com >> > > X-AntiAbuse: Original Domain - gypsywind.com >> > > X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] >> > > X-AntiAbuse: Sender Address Domain - paypal.com >> > > X-Source: >> > > X-Source-Args: >> > > X-Source-Dir: >> > > >> > > PayPal >> > > [pixel.gif] >> > > [pixel.gif] >> > > Dear PayPal Member, >> > > >> > > This email confirms that you have paid DIAMONDJEWELRY Inc. >> > > ([EMAIL PROTECTED]) $325.00 USD using PayPal. >> > > >> > > This credit card transaction will appear on your bill as "PAYPAL >> > > DIAMONDJEWELRY*". >> > > >> > > __________________________________________________________________ >> > > ____ __________ PayPal Shopping Cart Contents Item Name: >> > > [pixel.gif] 14kt yellow and white gold necklace Quantity: >> > > [pixel.gif] 1 [pixel.gif] Total: [pixel.gif] $305.00 USD >> > > [pixel.gif] [pixel.gif] [pixel.gif] [pixel.gif] Cart Subtotal: >> > > [pixel.gif] $305.00 USD Shipping Charge: [pixel.gif] $20.00 USD >> > > Cart Total: [pixel.gif] $325.00 USD [pixel.gif] [pixel.gif] >> > > [pixel.gif] >> > > >> > > __________________________________________________________________ >> > > ____ __________ Shipping Information Shipping Info: [pixel.gif] >> > > Charles Edwards 1015 Pleasant St Rehoboth, MA 02769 United States >> > > Address Status: [pixel.gif] Unconfirmed [scr_symQuestion.gif] >> > > >> > > __________________________________________________________________ >> > > ____ __________ If you haven't authorized this charge, click the >> > > link below to cancel the payment and get a full refund. >> > > Dispute Transaction > > > > >> > > __________________________________________________________________ >> > > ____ __________ Thank you for using PayPal! The PayPal Team Please >> > > do not reply to this e-mail. Mail sent to this address cannot be >> > > answered. For assistance, log in to your PayPal account and choose >> > > the "Help" link in the footer of any page. [pixel.gif] PayPal >> > > Email ID PP120 >> > > >> > > [pixel.gif] >> > > _______________________________________________ >> > > phishing mailing list >> > > [email protected] >> > > http://www.whitestar.linuxbox.org/mailman/listinfo/phishing >> > > >> > >> > >> > >> _______________________________________________ >> phishing mailing list >> [email protected] >> http://www.whitestar.linuxbox.org/mailman/listinfo/phishing >> > > >_______________________________________________ >phishing mailing list >[email protected] >http://www.whitestar.linuxbox.org/mailman/listinfo/phishing -- Tom Shaw - Chief Engineer, OITC <[EMAIL PROTECTED]>, http://www.oitc.com/ US Phone Numbers: 321-984-3714, 321-729-6258(fax), 321-258-2475(cell/voice mail,pager) Text Paging: http://www.oitc.com/Pager/sendmessage.html AIM/iChat: [EMAIL PROTECTED] Google Talk: [EMAIL PROTECTED] skype: trshaw _______________________________________________ phishing mailing list [email protected] http://www.whitestar.linuxbox.org/mailman/listinfo/phishing
