[nsp-sec] Phishing dropbox at gmail

[Chris Morrow]

sent along

On Fri, 16 Oct 2009, Torsten Voss wrote:

> ----------- nsp-security Confidential --------
>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Hi,
>
> we've found a phishing website, which sends the credentials to a gmail account:
>
> salamdelaroma at gmail.com
> Subject: "COM eBay user=$user pass=$pass ip=$ip"
>
> Thanks and kind regards,
>  Torsten, AS680
>
>
> - --
> Dipl.-Ing.(FH) Torsten Voss (Incident Response Team), Phone +49 40 808077-634
>
> DFN-CERT Services GmbH, https://www.dfn-cert.de, Phone  +49 40 808077-555
> Sitz / Register: Hamburg, AG Hamburg, HRB 88805, Ust-IdNr.:  DE 232129737
> Sachsenstrasse 5, 20097 Hamburg/Germany, CEO: Dr. Klaus-Peter Kossakowski
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v2.0.4-svn0 (GNU/Linux)
> Comment: Using GnuPG with SUSE - http://enigmail.mozdev.org
>
> iQEVAwUBSthtmSXNv0Upg26pAQIBFQf/SBJg8MGsJ/VvHbdl1ZfyEBlSyGS3gWKE
> rdGQ7FdK4UiB58wYLDfDAdsT/VIDcjG+eyCGP/uF0Rsln7lqsq6DIUZwxyRc5AqF
> dD0S7ijR5LTihpVfSNrNwAiceala6wmiKsAFLPIeRSBnxgpO62qXVD/B0t2B52C6
> 3IGpZSOArJXtJS3P/UYA07THnekDrRNt3nIiVzZRt6iKlNp7apkUyTxh7GMEBA/w
> dJMAtj2GQ1THDjVlljlkcai4i1Za77amKfEU8I7/uUigsDncYaproQKeWRWW5mzh
> GVnGNo86ajcZsM2YmN9/ulblJOGNq+oO0oylq2dVi0j+ax9OVfeDFg==
> =7KxJ
> -----END PGP SIGNATURE-----
>
>
> _______________________________________________
> nsp-security mailing list
> nsp-security at puck.nether.net
> https://puck.nether.net/mailman/listinfo/nsp-security
>
> Please do not Forward, CC, or BCC this E-mail outside of the nsp-security
> community. Confidentiality is essential for effective Internet security counter-measures.
> _______________________________________________
>