însemnări digitale
Phishing cu ţintă Raiffeisen Online
Nici n-am terminat bine de scris despre problemele de la rbl.sns.ro, ca hop! am vazut şi un mesaj ce-mi zice că musai am probleme la cont şi trebuie să-mi verific datele (chiar dacă, între noi fie vorba, nici măcar nu am cont la Raiffeisen).
Return-path:
Envelope-to: billing@hangarhosting.net
Delivery-date: Sun, 21 Oct 2007 17:43:31 +0300
Received: from nlpi015.sbcis.sbc.com ([207.115.36.44]
helo=nlpi015.prodigy.net) by lima.hangarhosting.net with esmtp (Exim 4.68)
(envelope-from ) id 1Ijc1S-0008Cv-FN
for billing@hangarhosting.net; Sun, 21 Oct 2007 17:43:31 +0300
X-ORBL: [76.248.48.6]
Received: from User (adsl-76-248-48-6.dsl.irvnca.sbcglobal.net
[76.248.48.6]) by nlpi015.prodigy.net (8.13.8 out.dk.spool/8.13.8) with
SMTP id l9LEfaAD019135; Sun, 21 Oct 2007 09:41:37 -0500
Message-Id: <200710211441.l9LEfaAD019135@nlpi015.prodigy.net>
From: “Raiffeisen Online Banking”
Date: Sun, 21 Oct 2007 07:41:06 -0700
MIME-Version: 1.0
Content-Type: text/html; charset=”Windows-1251″
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Spam-Status: Yes, score=8.8
X-Spam-Score: 88
X-Spam-Bar: ++++++++
X-Spam-Report: Spam detection software, running on the system
“lima.hangarhosting.net”, has identified this incoming email as possible
spam. The original message has been attached to this so you can view it
(if it isn’t spam) or label similar future email. If you have any
questions, see the administrator of that system for details. Content
preview: [...] Content analysis details: (8.8 points, 5.0 required) pts
rule name description —- ———————-
————————————————– 1.3 MISSING_HEADERS
Missing To: header 0.4 URI_HEX URI: URI hostname has long
hexadecimal sequence 0.0 HTML_MESSAGE BODY: HTML included in
message 1.8 HTML_IMAGE_ONLY_08 BODY: HTML: images with 400-800 bytes of
words 0.0 BAYES_50 BODY: Bayesian spam probability is 40 to
60% [score: 0.5000] 1.5 MIME_HTML_ONLY BODY: Message only has
text/html MIME parts 0.0 FORGED_OUTLOOK_TAGS Outlook can’t send HTML in
this format 0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE 0.0
TVD_PH_SUBJ_META TVD_PH_SUBJ_META 0.0 FORGED_OUTLOOK_HTML Outlook
can’t send HTML message only 3.1 FORGED_MUA_OUTLOOK Forged mail
pretending to be from MS Outlook
X-Spam-Flag: YES
Subject: * SPAM ** Raiffeisen Online Banking – Verificare Cont
….
Am incercat sa sun la Raiffeisen să le atrag atenţia, dar dupa cam o jumatate de ora am ajuns sa ma gandesc serios la zicerea românească despre facerea de bine şi mamă.
Dacă faci click pe imaginea primită pe email, ajungi mai întâi pe o pagină de pe un server
…..150217.vserver.de/manual/raiffeisen.online.ro/login.htm, iar apoi eşti redirectat la www.raiffeisenonline.ro.raiffeisenbanking.com.p12.hostingprod.com.
ATENŢIE!
Nu introduceţi nicio informaţie valoroasă în formulare necunoscute sau suspecte!
| Print article | This entry was posted by gupi on October 21, 2007 at 19:09, and is filed under personal. Follow any responses to this post through RSS 2.0. You can leave a response or trackback from your own site. |




about 2 years ago
Dupa mai multe zile de la raportarea phishing-ului, am descoperit in folderul “Junk” cele doua raportări, rejectate cu mesajul:
Parerea mea: thumbs down pentru Raiffeisen!
about 1 year ago
Unul din cei care trimite acel spam este Dan Zaharia
mailurile se trimitr de pe adresa [sdf.ro] iar serverul este gazduit la [signro.com] ambele site-uri facute “la misto” trimit catre un site in chineza care ofera pay per click aia e daca nu se pot lua masuri stam si stergem mail-uri si ii lasam sa faca bani pe seama celor care nu stiu … Bine macar ca astia nu fac ceva grav …este destul de grav ce fac dar inca nu au construit o pagina de phishing
about 1 year ago
@Dica, ai cu ce sa-ti sustii afirmatiile, nu ?
Niste headere de mail complete ar fi perfecte.