Yahoo Phishing Mass Bait

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Thu Sep 24, 2009 12:14 am

While I'm waiting for my current pet bait to wind to a close I noticed this in my baiting inbox.

Quote:

From Yahoo_admin Wed Sep 23 13:11:43 2009
X-Apparently-To: *********@yahoo.com via 67.195.15.212; Wed, 23 Sep 2009 06:11:45 -0700
Return-Path: <[email protected]>
X-YMailISG:
*snip*
X-Originating-IP: [216.200.145.38]
Authentication-Results: mta246.mail.re2.yahoo.com from=yahoo.com; domainkeys=neutral (no sig); from=yahoo.com; dkim=neutral (no sig)
Received: from 216.200.145.38 (EHLO omta0110.mta.everyone.net) (216.200.145.3 Cool

by mta246.mail.re2.yahoo.com with SMTP; Wed, 23 Sep 2009 06:11:44 -0700
Received: from sj1-dm102.mta.everyone.net (sj1-slb03-gw2 [172.16.1.96]) by omta0110.mta.everyone.net (Postfix) with ESMTP id 77F6B63961C for <**********@yahoo.com>; Wed, 23 Sep 2009 06:11:44 -0700 (PDT)
X-Eon-Dm: sj1-dm102
Received: by sj1-dm102.mta.everyone.net (EON-AUTHRELAY2 - 29f915d2) id sj1-dm102.4aa06080.777e32 for <************@yahoo.com>; Wed, 23 Sep 2009 06:11:43 -0700
X-Eon-Sig: AQMIlJZKuh6P8945EwIAAAAB,398e7fded8c22dfc4cd99a524eadd10d
From: "Yahoo_admin" <[email protected]> Add sender to Contacts
Subject: Resume your account
To: ******************@yahoo.com
Content-Type: multipart/alternative; boundary="=_NextPart_2rfkindysadvnqw3nerasdf"; charset="US-ASCII"
MIME-Version: 1.0
Reply-To: [email protected]
Date: Wed, 23 Sep 2009 15:11:43 +0200
X-Priority: 3
Message-Id: <[email protected]>
Content-Length: 1926

LAST NOTIFICATION(detection of intrusion into your account by a third party and several ip addresses) if you have recently used a internet space or if you sent your identification password to another person the security of your yahoo account is actually vulnerable to the fraudulent use, your account will be limited in messages sending and also other features and options will be disabled your account is right now under investigation ,please try to resolve this matter as soon as possible if you dont act soon your account will be deleted permanantely
First try to connect to your account to validate your profile and update it within the period of 24 hours.

resume here if you are not able to connect retry later

why my account will be deleted? we recommend you to visit the centre (Help) above and remember this is a security procedure to protect you against potential fraud. we apologize for any incovenient.

Help center
best regards

Now, I have a spare Yahoo account that I set up for JUST such an occasion, and I've been wanting to host a phishing bait for quite a while now, SO...

bring me your catcher accounts, bring me your baiter accounts, bring me any addy you want to get out to ladland, because I'm about to hand an address book over to my newest pet. I've already loaded it up with every baiting addy I have, now I invite you. The address is:

SO, send me a message from your account, I'll add you to my address book and send the info off to the "yahoo admins" on Monday. (Then I'll forward the E-mail to Yahoo to let them at the fake site, unless another baiter wants to claim the flag.)

I look forward to hearing from you!

EDIT: Fixed E-mail so that it is really masked...

Hellish Taskmaster Joined: 31 Dec 2008 Posts: 537

Email sent with 5 of my baiting accounts.

Posted: Fri Sep 25, 2009 2:06 am

Hey, thanks to everyone who has sent E-mail addresses to my account.

A few housekeeping notes:

I'm thinking about kicking this thing off a tad early for fear that the lad's site will be killed before I can get to it. If it's OK with everyone, I'll send the details Friday, but you can still get in on it even after the lad hijacks the account...

The name on the account is Edward Ninnymuggins. I will be playing Edward's elderly (and slightly senile) father. His mother Margie recently passed away from lungs cancer.

I figure the more organized we are the better, so I claim daddy (and maybe mommy if he really proves fruitful -she may have faked her death to escape from her numbskull husband)

Good luck everyone!

EDIT - DISASTER EVERYONE! I checked on the site tonight and someone has killed it. I tried just responsing to the lad in question, and we'll see if he gets back to me with a site, but if not, I guess we're going to have to look for a new phisher. I still have the account set up, so theoretically all we have to do is find a new lad and send him the details instead. If anyone has gotten a Yahoo phishing (or any other service, I suppose, I can transfer the details easy enough) format, please PM it to me.

Posted: Fri Sep 25, 2009 3:22 am

it's not actually a disaster, it's protecting people who don't know better Wink

Posted: Fri Sep 25, 2009 11:55 am

@jay -point taken, you know what I mean.

Thankfully though, we have a new lad on the line. The E-mail will go out this afternoon and hopefully we'll catch ourselves a halfway decent lad!

Master Baiter Joined: 06 Sep 2009 Posts: 192

Email sent w\ 2 of my baiting acc's. Smile

Posted: Fri Sep 25, 2009 10:49 pm

Maintain that honeypot! If you use the next while to keep some reasonably realistic looking emails to-ing and fro-ing, forwarding viral and chainletter crap, etc to the box, it will help it look real and lived-in, and a real prize for a spam lad - then the next person to get a suitable phishing attempt can hand the box over for you, and the fun can begin...

Not quite a Newb Joined: 18 Mar 2009 Posts: 41

Three addys sent....sorry for being late!

Posted: Sat Sep 26, 2009 3:53 pm

no worries, I sent the details off to two phishers now, and neither one has acted yet, may take the weekend yet...

I think for the sake of the bait, anyone who wants to get in now should send a message from their account as if it were directed to Edward, that way if I don't get to it before the phisher does he will see what looks like a new E-mail instead of a list of baiter addys.

We'll see how long it takes him to take control of the account. Naturally I did it on Friday so I don't exect too much over the weekend.