BoA Phishing Attempt

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

419Eater is my life Joined: 12 Dec 2003 Posts: 482

This one's for the records only. Brand new into my company e-mail.
Relevant hearder info:

Code:

From: "[email protected]" <[email protected]>"
Received 2: "from sls-f1p16.paradoxcafe.net (localhost.localdomain [127.0.0.1]) by sls-f1p16.paradoxcafe.net (8.12.10/8.12.10) with ESMTP id l0TIKbxg018705 for <[email protected]>; Mon, 29 Jan 2007 18:20:37 GMT"
Received 1: "(from apache@localhost) by sls-f1p16.paradoxcafe.net (8.12.10/8.12.10/Submit) id l0TIKaGi018703; Mon, 29 Jan 2007 18:20:36 GMT"
SMTP Originator "[email protected]"
Subject: "Bank of America Notice"

The link in message body points to this URL:

Code:

A href="http://bonita-glass.com/catalog/images/bankofamerica/"

Quote:

Bank of America Account Notice - MBNA Bank is now part of Bank of America

We recently have discovered that multiple computers have attempted to log into your Bank of America Online Account, and multiple password failures were presented before the logons. We now require you to update your account information . If this is not completed by January 31, 2007, we will be forced to suspend your account indefinitely, as it may have been used for fraudulent purposes. To continue please [don't click href="http://bonita-glass.com/catalog/images/bankofamerica/"]CLICK HERE[/don't click] or on the link
below to re-validate your account information :
[don't click]
href="http://bonita-glass.com/catalog/images/bankofamerica/">http://www.bankofamerica.com/cards/[/don/t click]
Sincerely,
Bank of America Team
Bank of America Security

Bank of America is the source of information about and access to domestic financial services provided by Bank of America retail banking .

419Eater is my life Joined: 12 Dec 2003 Posts: 482

I sent a notification to [email protected] - the e-mail link on the legit site's contact page - to notify him that he has a phishing page on his server and/or web site. I'll check later to see if he replies.

The path to /catalog/images/ is login protected and now displays this message:

Quote:

0wn3d by 3sRaR
3sRaR@LİnuxmaiL.Org

Master Baiter Joined: 05 Sep 2006 Posts: 170

Looks like the site is being rebuilt. So looks like the real owner caught it and is working on it....

Hopefully.

419Eater is my life Joined: 12 Dec 2003 Posts: 482

I chased this one a little bit more earlier, because I thought it was unusual to see a case of a script-kiddie defacement - "0wn3d by 3sRaR - 3sRaR@LİnuxmaiL.Org" who you can find has 14 pages of stuff up at http://www.zone-h.org - plus a phishing attempt on top of the server intrusion. Another domain kaydeerecords.com/catalog that was defaced by this same script kid contains the phrase ACIKLARINIZI KAPATIN.

Searching for the language reveals the source of this defacer is possibly Baku, Azerbaijan, which is within the former Soviet Union. That could indicate this script-kid group could originate from Azerbaijan, Iran, or possibly Turkey. Actually any number of possible Turkic-speaking script-kid groups, including Europe or the U.S.

Posted: Tue Jan 30, 2007 2:48 am

I think we have seen this group before. If it is the same one I'm thinking of, they find a script for "hacking" specific vulnerability of unpatched sites and use the script to "hack" in. Nothing clever but they think they are.