[SURBL-Discuss] Fw: heads up, massive phishing going on.

Jeff Chan jeffc at surbl.org
Thu Apr 28 23:54:29 CEST 2005


On Thursday, April 28, 2005, 10:40:25 AM, Kevin McGrail wrote:
>From a guy I trust and work on anti-spam algorithm's who also
>works at Network Solutions:

> The system running here detected a rash of ebay and paypal
> phishing earlier today and it is still going on.  Hope this
> info can help find and stop it before someone gets damaged. 

> Here are the IP addresses of the mail servers sending them and
> the sites they point to.

> 84.0.191.93: http://61.8.248.242/paypal/ 

> 211.207.71.179: http://ebay-loginpage.com/
[...]
> 199.222.69.90: http://211.92.164.43/paypal/login.html

> 66.163.169.223: http://62.14.104.42/popcond/cgi-bin/webscr/cmd_login/submit/login_cmd/login_params/login_cancel_cmd/login_email/login_password/submit/Log/In/login/index.htm
[...]
> 201.3.200.130: http://200.126.231.52/verify/paypalDLLUPDATE/index.html
[...]

Thanks for those, Kevin!   I've added them to SURBLs as:

61.8.248.242
ebay-loginpage.com
211.92.164.43
62.14.104.42
200.126.231.52

Good places to send phishing info to include:

  postmaster at corp.mailsecurity.net.au
  reportphishing at antiphishing.org
  spam at uce.gov
  spam at mailpolice.com
  admin at fraudwatchinternational.com

Would you please let your friend know about these reporting
addresses?

Jeff C.
--
"If it appears in hams, then don't list it."



More information about the Discuss mailing list