CastleCops® Fried Phish Apr 02: French Chase Phish

Need help? Click here to register for free! Absolutely zero advertisements on this site!

	Donation/Premium

	Donations. Become Premium Today!

	Security Central

	· Home · PIRT/Fried Phish · MIRT · SIRT · Deutsch · Wiki · Newsletter · O16/ActiveX · CLSID List · Contest2007 · Downloads · Feedback (send) · Forums · HijackThis · Hijacktrend · LSPs · My Downloads · O18 · O20 · O21 · O22 · O23 · O9 · Premium · Private Messages · Proxomitron · Reviews · Search · StartupList · Stories Archive · Submit News · WsIRT · Your Account · Acceptable Use Policy

Forum FAQ

Usergroups

Profile

Select FavForums

Fried Phish Apr 02: French Chase Phish

All -> FavForums -> PIRT Fried Phish Reports

[del.icio.us!] [digg it!] [reddit!]

View previous topic :: View next topic

Author

Message

daveai

1st Responder
Premium Member

Joined: Dec 07, 2004
Posts: 1987
Location: USA

Posted: Sun Apr 02, 2006 8:05 pm Post subject: Fried Phish Apr 02: French Chase Phish

Phish Alert

Full Report: CastleCops Link /modules.php?name=Fried_Phish&fp=phish&id=1888&in=1

Duplicate/Related Report(s): 1972,

IP Converted: 82.244.9.85

dword = 1391724885
hex1 = 0x52f40955
hex2 = 0x52.0xf4.0x9.0x55
oct = 0122.0364.011.0125

View CIDR AS12322 Report: http://www.cidr-report.org/cgi-bin/as-report?as=12322

"12322 | FR | ripencc | 1999-03-11 | PROXAD AS for Proxad ISP"<br />

Phish url: http://www.elijoe.com/webauth/index.htm
page fetch failed 1st time; suceeded 2nd time.
The URL directs to a French server hosting an imitation Chase banking site. The site was active at the time of investigation.

multiple A records:
;; QUESTION SECTION:
;www.elijoe.com. IN A

;; ANSWER SECTION:
www.elijoe.com. 179 IN A 24.222.156.26
www.elijoe.com. 179 IN A 82.236.59.61
www.elijoe.com. 179 IN A 82.239.10.81
www.elijoe.com. 179 IN A 82.232.86.105
www.elijoe.com. 179 IN A 212.122.115.175

IP Converted: 24.222.156.26

dword = 417242138
hex1 = 0x18de9c1a
hex2 = 0x18.0xde.0x9c.0x1a
oct = 030.0336.0234.032

View CIDR AS11260 Report: http://www.cidr-report.org/cgi-bin/as-report?as=11260

"11260 | CA | arin | 1998-06-04 | ANDARA-HSI - Andara High Speed Internet c/o Halifax Cable Ltd."<br />

IP Converted: 82.236.59.61

dword = 1391213373
hex1 = 0x52ec3b3d
hex2 = 0x52.0xec.0x3b.0x3d
oct = 0122.0354.073.075

View CIDR AS12322 Report: http://www.cidr-report.org/cgi-bin/as-report?as=12322

"12322 | FR | ripencc | 1999-03-11 | PROXAD AS for Proxad ISP"<br />

IP Converted: 212.122.115.175

dword = 3564794799
hex1 = 0xd47a73af
hex2 = 0xd4.0x7a.0x73.0xaf
oct = 0324.0172.0163.0257

View CIDR AS6739 Report: http://www.cidr-report.org/cgi-bin/as-report?as=6739

"6739 | ES | ripencc | 1999-11-24 | ONO-AS Cableuropa - ONO"<br />

Quote:

From Fri Mar 31 03:07:07 2006
Received: from cougar.accuray.com (mail.accuray.com [67.108.13.68])
by bugsbunny.castlecops.com (8.13.6/8.13.6) with ESMTP id k2V874Q4009352
for <>; Fri, 31 Mar 2006 03:07:06 -0500
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1506
References: <>
MIME-Version: 1.0
Content-Type: multipart/related;
boundary="----_=_NextPart_001_01C6549A.155AD38E";
type="multipart/alternative"
Content-Class: urn:content-classes:message
Subject: FW: Verify account information
Date: Fri, 31 Mar 2006 00:06:58 -0800
Message-ID: <>
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
Thread-Topic: Verify account information
thread-index: AcZUmdtHhbGoU5jlQQWgqpiig3XyOAAADYID
From: "Eric Earn

	All -> FavForums -> PIRT Fried Phish Reports	All times are GMT
Page 1 of 1

You can post new topics in this forum
You can reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum


	2002-2008 � Computer Cops LLC dba CastleCops®. All rights reserved. Acceptable Use Policy. Use signifies your agreement. 186ppm 0.176s (0.034s) Making cybercriminals unhappy since 2002*