Has anyone else seen any other phishing attempts on Trade Me before? Are there many of these coming through at the moment?? Cheers, Paul. ---------- *From:* mailer(a)trademe.co.nz[SMTP:MAILER(a)TRADEME.CO.NZ] *Sent:* Friday, August 26, 2005 11:24:06 AM *To:* Help Desk *Subject:* Your Trade Me Bid was Cancelled !!! *Auto forwarded by a Rule* ** ** * Dear Customer,* ** *The bid that has been entered in error was cancelled, **Click Here *http://004c256.netsolhost.com/ * to view the reason provided for the cancellation.* ** *Happy Trading! Trade Me Customer Support Team **http://www.trademe.co.nz* http://www.trademe.co.nz/
There was a very small scale one about a year ago. This is the first one I ve seen since, and it looks like theyre pumping out a lot of them. Any ideas where they are coming from anyone? Perhaps one of those alleged 5% who reside in NZ? Regards, Erin Salmon Managing Director Unleash Computers Ltd Mobile: 021 877 913 Landline: 03 365 1273 www.unleash.co.nz http://www.unleash.co.nz/ -----Original Message----- From: Paul Adshead [mailto:paul.adshead(a)gmail.com] Sent: 26 August 2005 11:46 a.m. To: nznog(a)list.waikato.ac.nz Subject: [nznog] Trade Me phishing scam?? Has anyone else seen any other phishing attempts on Trade Me before? Are there many of these coming through at the moment?? Cheers, Paul. ---------- From: mailer(a)trademe.co.nz[ SMTP:MAILER(a)TRADEME.CO.NZ mailto:SMTP:MAILER(a)TRADEME.CO.NZ ] Sent: Friday, August 26, 2005 11:24:06 AM To: Help Desk Subject: Your Trade Me Bid was Cancelled !!! Auto forwarded by a Rule Dear Customer, The bid that has been entered in error was cancelled, Click Here http://004c256.netsolhost.com/ to view the reason provided for the cancellation. Happy Trading! Trade Me Customer Support Team http://www.trademe.co.nz http://www.trademe.co.nz/
Hmm, if people are going to post copies next time could they include full headers. For example it looks like (from a couple of have seen) the timezone in the emails is at -0500 and there don't seem to be many different originating IPs. -- Simon J. Lyall. | Very Busy | Mail: simon(a)darkmere.gen.nz "To stay awake all night adds a day to your life" - Stilgar | eMT.
The Main IP Address its coming from that I can see is: 66.206.6.48 (any
others that people know of)
Link to http://004c256.netsolhost.com (left a message with contact of
netblock)
Redirects to: http://66.206.0.140/cgi-bin/secure/login.htm (can't contact
the admin for this site)
Blocking this helps alot. but a lot of trademe messages are forwarded from
other places who are not blocking it.
Thanks
Craig
---------------------------------
Return-path:
Hmm, if people are going to post copies next time could they include full headers. For example it looks like (from a couple of have seen) the timezone in the emails is at -0500 and there don't seem to be many different originating IPs.
-- Simon J. Lyall. | Very Busy | Mail: simon(a)darkmere.gen.nz "To stay awake all night adds a day to your life" - Stilgar | eMT.
_______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog
On Fri, 26 Aug 2005 12:44, Craig Whitmore wrote:
The Main IP Address its coming from that I can see is: 66.206.6.48 (any others that people know of) Link to http://004c256.netsolhost.com (left a message with contact of netblock)
I've just been on the phone with Network Solutions (owner of the netsolhost.com domain) and placed a request to have that redirect removed which I got escalated to a "VIP" status. Let's see if they actually do anything. If that redirect goes away we may see some (at least temporary) relief.
Redirects to: http://66.206.0.140/cgi-bin/secure/login.htm (can't contact the admin for this site) Blocking this helps alot. but a lot of trademe messages are forwarded from other places who are not blocking it.
hads -- The question of whether a computer can think is no more interesting than the question of whether a submarine can swim. Edsger W. Dijkstra
As of when I post, it's still up. Currently it redirects to: http://66.206.0.140/cgi-bin/secure/login.htm AW On Fri, 26 Aug 2005 12:50, Hadley Rich wrote: | On Fri, 26 Aug 2005 12:44, Craig Whitmore wrote: | > The Main IP Address its coming from that I can see is: 66.206.6.48 (any | > others that people know of) | > Link to http://004c256.netsolhost.com (left a message with contact | > of netblock) | | I've just been on the phone with Network Solutions (owner of the | netsolhost.com domain) and placed a request to have that redirect removed | which I got escalated to a "VIP" status. Let's see if they actually do | anything. |
On Sat, 27 Aug 2005 09:58, Andrew Walters wrote:
As of when I post, it's still up. Currently it redirects to:
Yeah, I'm not surprised they haven't done anything. It actually does a meta-refresh to http://66.206.0.135/index.php which then does a 302 redirect to http://66.206.0.140/cgi-bin/secure/login.htm Both of those servers are hosted by http://cwiservices.com/ with who I also left a message yesterday but it seems they haven't done anything either. Humph. hads -- Live within your income, even if you have to borrow to do so. -- Josh Billings
I've also emailed every contact I can find.. (Owners of IP Addresses/Owners of machines which have been Hacked, Website owners, Web site company ,... and nothing yet). I even tried calling on the phone a few of the people and left messages, but alas nothing.. Thanks
There's simply so much money in spam. The people on the receiving end of the cheques will drag it out as long as possible. I think a public announcement of who ever turns out to be behind it would be a good idea, so we can all go and egg his house. :) Erin Salmon Managing Director Unleash Computers Ltd Mobile: 021 877 913 Landline: 03 365 1273 www.unleash.co.nz -----Original Message----- From: Craig Whitmore [mailto:lennon(a)orcon.net.nz] Sent: 27 August 2005 11:10 a.m. To: Hadley Rich; nznog(a)list.waikato.ac.nz Subject: Re: [nznog] Trade Me phishing scam?? I've also emailed every contact I can find.. (Owners of IP Addresses/Owners of machines which have been Hacked, Website owners, Web site company ,... and nothing yet). I even tried calling on the phone a few of the people and left messages, but alas nothing.. Thanks _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog
Well actually trademe should be able to do something. Have they? I presume
they know all about this..
Can they not just check the referrer and if its the phish website, deny it..
The phish is running on a windows server under the epnix.com website which
is easy to find out when you don't put proper information into the form (+
other ways)
Notice: Undefined index: user_email in
D:\Inetpub\epnix.com\cgi-bin\secure\email.php on line 129
As you are a registred member of
Notice: Undefined offset: 1 in
D:\Inetpub\epnix.com\cgi-bin\secure\email.php on line 132
Notice: Undefined offset: 1 in
D:\Inetpub\epnix.com\cgi-bin\secure\email.php on line 132
, confirm your email account password for validation.
Thanks
Craig
----- Original Message -----
From: "Erin Salmon - Unleash Computers Ltd"
There's simply so much money in spam. The people on the receiving end of the cheques will drag it out as long as possible. I think a public announcement of who ever turns out to be behind it would be a good idea, so we can all go and egg his house.
On Sat, 27 Aug 2005 11:39, Craig Whitmore wrote:
Well actually trademe should be able to do something. Have they? I presume they know all about this..
Yeah, that's what I thought, I was going to let them know to make sure but their lack of contact details annoyed me so I stopped.
Can they not just check the referrer and if its the phish website, deny it..
Would make sense wouldn't it... hads -- Life only demands from you the strength you possess. Only one feat is possible -- not to have run away. -- Dag Hammarskjold
On Sat, 27 Aug 2005 11:39, Craig Whitmore wrote:
Well actually trademe should be able to do something. Have they? I presume they know all about this..
After more than a little looking around their site I found that while going through their 'Contact Us' forms, that they had a note of recent issues, in which was a listing: --- "26 August - Phishing emails update The fraudulent "phishing" email mentioned below is still being distributed. Do not click on the link in this email. Please read our online help about phishing emails. Whenever you login to Trade Me please ensure the website address begins with www.trademe.co.nz Trade Me will never ask for your password in an email and will always use your first name to address you." --- That tracks down to be off the "Community" > "Message Boards" > "Site Announcements" (http://www.trademe.co.nz/announcement.asp), which is great, but how many people honestly check that regularly? So they at least know and acknowledge it, but something that was visible from the home page would have been nicer idea imho. Regards, Daniel Hopkirk ----------------------------------------+ Beware the fury of a patient man. -- John Dryden ----------------------------------------+
Can they not just check the referrer and if its the phish website, deny it..
Unfortunately, the damage has been done before the phishing website really makes any unsuspecting user click on a trademe related link. The form keeps redirecting to itself, so if they keep entering their data they will only end up in a loop. Though, throwing a nice "Change your password NOW plzkthxbye." would be appropriate in a trigger to clicking a link off the site. - Drew
Though, throwing a nice "Change your password NOW plzkthxbye." would be appropriate in a trigger to clicking a link off the site.
On undernet if we detect them coming from a phishing site, we just change their password to something they don't know. Then they have to go through the forgotten password procedure. We also have several "dummy" accounts that when we detect phishing we "login" as. Then when the dummy accounts turn up being used on our site we can use that to figure out which other accounts have been lost.
On Sat, 27 Aug 2005 09:58, Andrew Walters wrote:
As of when I post, it's still up. Currently it redirects to:
Please excuse the double post, but by the way it looks as if that IP is the same server/virtualserver as epnix.com for which there is a contact listed. Technical Contact: Peters, Micheal webmaster(a)epnix.com Epnix 80 Tremont Ave Kenmore, NY 14217 US (716) 876-7860 (716) 876-7860 hads -- With every passing hour our solar system comes forty-three thousand miles closer to globular cluster M13 in the constellation Hercules, and still there are some misfits who continue to insist that there is no such thing as progress. -- Ransom K. Ferm
Here is one for you:
Microsoft Mail Internet Headers Version 2.0
Received: from vtf-kys-18.corp.trademe.co.nz ([10.184.0.196]) by
mail.newjobz.co.nz with Microsoft SMTPSVC(6.0.3790.211);
Fri, 26 Aug 2005 11:43:39 +1200
Received: from mxpool21 (127.0.0.1) by vtf-kys-18.corp.trademe.co.nz (LSMTP
for Windows NT v1.1b) with SMTP id
<12.0000059D(a)vtf-kys-18.corp.trademe.co.nz>; Thu, 25 Aug 2005 18:34:53 -0500
From: "=?iso-8859-1?B?bWFpbGVyQHRyYWRlbWUuY28ubno=?="
Yes we are getting quite a few of these. Currently null routing the IP/s of the hosts, for our users, as we receive them. Regards, ---------------------------------------- Matt Dalziel Actrix Networks Ltd m.dalziel(a)actrix.co.nz Paul Adshead wrote:
Has anyone else seen any other phishing attempts on Trade Me before? Are there many of these coming through at the moment??
Cheers, Paul.
----------
*From:* mailer(a)trademe.co.nz[ SMTP:MAILER(a)TRADEME.CO.NZ mailto:SMTP:MAILER(a)TRADEME.CO.NZ] *Sent:* Friday, August 26, 2005 11:24:06 AM *To:* Help Desk *Subject:* Your Trade Me Bid was Cancelled !!! *Auto forwarded by a Rule*
* Dear Customer,*
*The bid that has been entered in error was cancelled, **Click Here * http://004c256.netsolhost.com/* to view the reason provided for the cancellation. *
*Happy Trading!
Trade Me Customer Support Team **http://www.trademe.co.nz * http://www.trademe.co.nz/
------------------------------------------------------------------------
_______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog
participants (11)
-
Andrew Walters -
Craig Whitmore -
Daniel Hopkirk -
Drew Broadley -
Erin Salmon - Unleash Computers Ltd -
Hadley Rich -
James Butler -
Matt Dalziel -
Paul Adshead -
Perry Lorier -
Simon Lyall