Wednesday, October 6. 2004
Another Live Phish
This one is interesting, in that the server is a live, legitimate server. It's a Dutch jewlery company, whose server has obviously gotten hacked.The site is running Apache on Linux. Investigating, this is getting worse:
HTTP/1.1 302 Found
Date: Wed, 06 Oct 2004 19:16:46 GMT
Server: Apache
Location: http://nl44.yourname.nl/
Connection: close
Content-Type: text/html; charset=iso-8859-1
This means the site is being run by a domain name registrar. It's a Cobalt Raq system, and the probability is high that ALL the sites run by this company are vulnerable. Since it's running on port 80, corporate firewalls aren't going to stop it. The email is clear, without grammatical or spelling mistakes. The website says it's both 'Easy' and 'Secure' -- and it's amazing the number of people who will believe it!
If you run a corporate firewall, block 82.192.68.44 for now.
Trackbacks
Trackback specific URI for this entry
No Trackbacks