Craigslist phishing?

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Fri Nov 12, 2010 10:07 pm

Got this today:

Quote:

FORGED_OUTLOOK_HTML,FORGED_OUTLOOK_TAGS,FROM_MISSP_EH_MATCH,FROM_MISSP_MSFT,
FROM_MISSP_TO_UNDISC,FROM_MISSP_USER,FSL_CTYPE_WIN1251,HTML_MESSAGE,
MIME_HTML_ONLY,MSOE_MID_WRONG_CASE,NSL_RCVD_FROM_USER,RAZOR2_CF_RANGE_51_100,
RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,RCVD_IN_BRBL_LASTEXT,RDNS_NONE
shortcircuit=no autolearn=disabled version=3.3.1
X-Spam-Report:
* 1.6 RCVD_IN_BRBL_LASTEXT RBL: RCVD_IN_BRBL_LASTEXT
* [58.53.146.24 listed in bb.barracudacentral.org]
* 3.5 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
* 1.6 NSL_RCVD_FROM_USER Received from User
* 0.0 HTML_MESSAGE BODY: HTML included in message
* 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
* 1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
* 0.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level
* above 50%
* [cf: 61]
* 0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
* [cf: 61]
* 0.6 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
* 0.3 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
* 1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
* 0.0 FROM_MISSP_EH_MATCH From misspaced, matches envelope
* 3.4 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE
* 0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
* 1.1 FROM_MISSP_TO_UNDISC From misspaced, To undisclosed
* 1.4 FROM_MISSP_USER From misspaced, from "User"
* 2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
X-Original-To: Received: from localhost (localhost [127.0.0.1])
by mc3.midcoast.com (Postfix) with ESMTP id 52D9CF4C18
for <>; Fri, 12 Nov 2010 13:32:01 -0500 (EST)
X-Virus-Scanned: by amavisd-new at midcoast.com
Received: from mc3.midcoast.com ([127.0.0.1])
by localhost (mc3.midcoast.com [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id K6dJ89-0Rl7D for <>;
Fri, 12 Nov 2010 13:32:01 -0500 (EST)
Received: from mx1.midcoast.com (mx1.midcoast.com [69.39.100.26])
by mc3.midcoast.com (Postfix) with ESMTP id 14590F3FE4
for <>; Fri, 12 Nov 2010 13:32:01 -0500 (EST)
Received: from dfsy.com.cn (unknown [58.53.146.24])
by mx1.midcoast.com (Postfix) with SMTP id 0CCB2BF395
for <>; Fri, 12 Nov 2010 13:31:59 -0500 (EST)
Received: from User ([86.98.33.51])
(envelope-sender <[email protected]>)
by 172.28.105.4 with ESMTP
for <[email protected]>; Sat, 13 Nov 2010 02:22:35 +0800
From: "craigslist.org"<[email protected]>
Subject: PJM-> Your craigslits account will be blocked.?
Date: Fri, 12 Nov 2010 22:22:26 +0400
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-Id: <[email protected]>
To: undisclosed-recipients:;
X-Spam-Prev-Subject: Your craigslits account will be blocked.?

<html><head></head><body>Important Craigslist Information 

CRAIGSLIST TERMS OF USE

 We reserve the right, at our sole discretion, to change, modify or otherwise alter your
 account at any time. Therefore your account will be blocked.
 To avoid deletion of your Craigslist account please Sign In:
 

<a target="_blank" href="http://cleo.blindomail.it/cg/">Click here to confirm your Craigslist account.</a>
 
 Thanks,
 Craigslist team</body></html>

I do have an acct, but only listed one item once about a year ago.

Posted: Fri Nov 12, 2010 10:14 pm

Don't click on the link or sign in. If it is really Craigslist and they close your account, so what. You can open a new account should you ever need or want to post an item.

Just my 2 cents worth.

Posted: Fri Nov 12, 2010 10:26 pm

Typically, you forward those onto the company being phished. However, CL isn't too responsive from past experience.

I would recommend forward it to the host of the domain, which looks to be COMUNE DI ARAGONA [email protected]

They should take care of it.

Posted: Fri Nov 12, 2010 10:29 pm

Phishing plain and simple.

Quote:

PJM-> Your craigslits account will be blocked.

Craigslist would make sure they have their name right...

Quote:

172.28.105.4 Check 172.28.105.4 at Senderbase.org Check 172.28.105.4 at Reputationauthority.org Unknown Unknown Unknown
86.98.33.51 Check 86.98.33.51 at Senderbase.org Check 86.98.33.51 at Reputationauthority.org Emirates Telecommunications Corporation Dubai United Arab Emirates

Given the poor writing and location info, I would guess looking for established accounts to hijack for placing fake ads.

Posted: Fri Nov 12, 2010 11:15 pm

It's already been reported

Quote:

Reported Web Forgery!

This web page at cleo.blindomail.it has been reported as a web forgery and has been blocked based on your security preferences.