[nsp-sec] Phishing site - redirect L3

[Janish, Nathan]

We are in the process of notifying our customer now.  Per Level3 policy we provide them with a two hour window to remove the material.  If the material is not removed within two hours we will block traffic to 216.246.8.53.

Regards,

Nathan Janish
Level3 Network Security
720.888.0012 - opt 2 / opt1
securityoperations at level3.com

CONFIDENTIALITY NOTICE:
THE INFORMATION CONTAINED IN THIS MESSAGE MAY BE ATTORNEY PRIVILEGED AND CONFIDENTIAL INFORMATION INTENDED ONLY FOR THE USE OF THE INDIVIDUALS OR ENTITIES NAMED ABOVE. IF THE READER OF THIS MESSAGE IS NOT THE INTENDED RECIPIENT, OR THE EMPLOYEE OR AGENT RESPONSIBLE FOR DELIVERY OF IT TO THE INTENDED RECIPIENT, YOU ARE HEREBY NOTIFIED THAT ANY DISSEMINATION, DISTRIBUTION OR COPYING OF THIS COMMUNICATION IS STRICTLY PROHIBITED. IF YOU RECEIVED THIS COMMUNICATION IN ERROR, PLEASE IMMEDIATELY NOTIFY ME BY TELEPHONE OR E-MAIL, AND DESTROY THIS MESSAGE. THANK YOU.


-----Original Message-----
From: nsp-security-bounces at puck.nether.net [mailto:nsp-security-bounces at puck.nether.net] On Behalf Of Heather Schiller
Sent: Thursday, March 06, 2008 12:31 PM
To: nsp-security at puck.nether.net
Subject: [nsp-sec] Phishing site - redirect L3

----------- nsp-security Confidential --------


The phishing site at:

URL: http://208.251.212.68/indexx.html
IP: 208.251.212.68

For Caja Madrid Bank - is redirecting to

http://216.246.8.53/temp/madrid/login.htm

53.8.246.216.in-addr.arpa domain name pointer
what.the.hell.are.You.looking.at.bitch.name.

Can someone at L3 get this shut down?

Thanks,

--Heather


~*~*~*~*~*~*~*~*~*~*~*~
  Heather Schiller
  Customer Security
  IP Address Management
  1.800.900.0241
~*~*~*~*~*~*~*~*~*~*~*~



_______________________________________________
nsp-security mailing list
nsp-security at puck.nether.net
https://puck.nether.net/mailman/listinfo/nsp-security

Please do not Forward, CC, or BCC this E-mail outside of the nsp-security
community. Confidentiality is essential for effective Internet security counter-measures.
_______________________________________________