uk bank phish
Results 1 to 4 of 4

Thread: uk bank phish

  1. #1
    Junior Member
    Join Date
    Feb 2004
    Posts
    15

    uk bank phish

    i've noticed all (the ones i'm getting atm) are the work of the same dude (group). they can be identified because they all run from a folder called "rock". often there are multiple scams runing from the same compromised host in the same way a group that used port 4901 used to do a year ago.

    they're all running on presumably a preconfigured Apache/2.0.46 (CentOS) Server. why it mentions centOS i dont know cos the hosts are, the ones i've checked, all windows boxes.

    the mails tend to be grouped ie in nov it was all barclays, then halifax and lloyds tsb, and now they're all natwest. why i need to receive like 5 a day for the same bank for days I don't know. it's not like they're much different, possibly trying to avoid spam filters but anyone that gets more than a few a day is bound to get suspicious one would think.

    examples:- for each bank the email is always identical.









    example subject lines, as you can also see there's hidden spam junk on each of the messages

    FFXI: Remora RDM41 BLM41 WHM40
    WOW: Azjul Nerob Rogue 41
    http://www.browolf.f2s.com/wordpress/

  2. #2
    Junior Member
    Join Date
    Sep 2005
    Posts
    16
    In my experience they work in teams with exploited or preconfigured servers.
    Well 5 a day, not bad but at least you didn't win the MICROSOFT MEGA JACKPOT 18 times today


    MANAGER,INTERNATIONAL PROMOTIONS/PRIZE
    AWARD DEPARTMENT MICROSOFT MEGA JACKPOT
    LOTTERY, UNITED KINGDOM.
    89 New Fetter Lane London,EC4A 1AG U.K
    MR. TINZO PAOLO
    PHONE #:+44 7031915205, +44 7031844897
    FAX#: +44 7005980586


    REF NO: MSW/56B-672GH/L
    BATCH: 4583JL/WIN

    MICROSOFT MEGA JACKPOT LOTTERY PROMOTIONS,EMAIL AWARD PROMO: UNITED KINGDOM

    Finally today, we announce the winners of the MICROSOFT MEGA JACKPOT LOTTO WINNINGS PROGRAMS held on 31st of October, 2005. Your company or your personal e-mail address, attached to winning number 23-76-06-54-42-100, With serial number 647489, consequently won in the Tenth lottery category.

    You are therefore been approved for lump sums pay out of GBP 5,500,000.00 POUNDS ($10,464,000 USD) in cash Credited to file REF NO: MSW/56B-672GH/L and winning number 23-76-06-54-42-100, this is from total prize money of GBP 27,500,000.00 POUNDS, shared among the Twenty five (25)international winners in this category.

    All participants were selected through our Microsoft computer ballot system drawn form 42,000 Names, 6,000 names from each continent, as part of International "E-MAIL" Promotions Program, for our prominent MS WORD user all over the world, and for the Continues use of E-mail. Your fund (certified Cashiers cheque) has been insured with your REF NO: MSW/56B-672GH/L and winning number 23-76-06-54-42-100. To claim your winning prize, you must first contact the claims department by email for Processing and remittance of your prize money to you.

    The claims processor is:

    Name : Robert Spencer
    e mail: ukbobspencer2@yahoo.co.uk

    Phone: +44- 703- 1913- 969
    +44- 703- 1945- 906

    Do email the above email addresses, all at once. In order to avoid unnecessary delays and complications, please remember to quote your reference and winning numbers in all correspondences with your claims officer.

    PLEASE NOTE THAT YOU ARE TO SEND THE BELOW INFORMATIONS REQUIRED TO CLAIM YOUR WINNING PRIZE:

    1. FULL NAMES: _______________________________________________________

    2.NATIONALITY: _______________________________________________________

    3. DATE OF BIRTH ________________________________________

    4. SEX: _________________________

    5. MARITAL STATUS: _____________________________________

    6. CONTACT ADDRESS: _____________________________________________

    7. TELEPHONE NUMBER: ___________________

    8. OCCUPATION: _________________________________

    9. WINNING E-MAIL ADDRESS:________________________________

    10.REF/ BATCH NUMBERS:_________________________________________

    11.TOTAL AMOUNT WON:_________________________________________

    Upon reciept of the duly requested data,i`ll send you the contact information of the payment office so you can proceed with effecting the release of your claim in anyway you deem fit, summit back immediately

    Sincerely,
    Secretary
    Mrs. Maurrine Diane H.

    NOTE: Do not reply this mail. You are to contact your claims officer immediately by email. Or call the promotion director MR. TINZO PAOLO on PHONE #:+44 7031915205, +44 7031844897 to confirm your winnings.

    SPONSORS: MS-WORD WORLD WIDE, GLOBAL EXPRESS COURIER, YAHOO.COM, UK2.NET, HSBC BANK.
    The name Roberts Spencer belongs to a very well know anti-jihadie. It is not his real name but rather a pen name.

  3. #3
    They call me the Hunted foxyloxley's Avatar
    Join Date
    Nov 2003
    Location
    3rd Rock from Sun
    Posts
    2,528
    any chance of a C+P of the offending item Browolf ??

    [I HATE one liner replies]
    55 - I'm fiftyfeckinfive and STILL no wiser,
    OLDER yes
    Beware of Geeks bearing GIF's
    come and waste the day :P at The Taz Zone

  4. #4
    Junior Member
    Join Date
    Feb 2004
    Posts
    15
    cut and paste? not really cos the email bodies are images which are included, encoded inside the email. have uploaded pictures of the original emails and linked them on post above.
    FFXI: Remora RDM41 BLM41 WHM40
    WOW: Azjul Nerob Rogue 41
    http://www.browolf.f2s.com/wordpress/

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •