CastleCops :: View topic - Fried Phish Apr 02: Austrian Chase Phish

Fried Phish Apr 02: Austrian Chase Phish

CastleCops -> PIRT Fried Phish Reports

Author: daveai, Location: USA

Posted: Sun Apr 02, 2006 10:27 pm Post subject: Fried Phish Apr 02: Austrian Chase Phish

Phish Alert

Full Report: CastleCops Link

/modules.php?name=Fried_Phish&fp=phish&id=1949&in=1

Duplicate/Related Report(s): 2009,

IP Converted: 81.223.238.227

dword = 1373630179
hex1 = 0x51dfeee3
hex2 = 0x51.0xdf.0xee.0xe3
oct = 0121.0337.0356.0343

View CIDR AS8514 Report: http://www.cidr-report.org/cgi-bin/as-report?as=8514

"8514 | AT | ripencc | 1997-10-20 | INODE inode Telekommunikationsdienstleistungs GmbH"<br />

Phish url: http://www.chase.onlines1.com
Browser access directs to an Austrian server hosting an imitation Chase site.
The site was active at the time of investigation.
Page fetch suceeded

Additional suspicious url in phish email:
http://chaseonline.chase.com.infiv.com/%20/Chase/cgi-bin/login_chase.htm#ssu_login.jsp?login_form
Browser access returns: 'The page cannot be displayed"
Whois returns: No match for domain "CHASEONLINE.CHASE.COM.INFIV.COM".

Quote:

From Fri Mar 31 07:47:47 2006
Received: from mail2.hagenhosting.com (ns1.hagenhosting.com [63.97.115.194])
by bugsbunny.castlecops.com (8.13.6/8.13.6) with ESMTP id k2VClkLN026743
for <>; Fri, 31 Mar 2006 07:47:47 -0500
Received: from www1.sprit.org ([81.223.238.227] helo=http2.sprit.org)
by mail2.hagenhosting.com with esmtp (Exim 4.60)
(envelope-from <>)
id 1FPJ2d-0006JW-6j
for ; Fri, 31 Mar 2006 07:47:51 -0500
Received: by http2.sprit.org (Postfix, from userid 30)
id 76CA4198574; Fri, 31 Mar 2006 14:47:48 +0200 (CEST)
X-fromdir: /home/ultraviolet/www.introvertire.biz/y
To:
Reply-To:
MIME-Version: 1.0
Content-Type: text/html
Message-Id: <>
Date: Fri, 31 Mar 2006 14:47:48 +0200 (CEST)
Content-Transfer-Encoding:

CastleCops -> PIRT Fried Phish Reports

All times are GMT

Page 1 of 1