Re: We have detected that PHPNET HOSTING SERVICES IS HOSTING A FRAUDULENT WEBSITE that offers a PHISHING SCAM against ALLIANCE LIECESTER.
| From: | Marcus Boerger | Date: | Fri, 27 Feb 2009 20:56:23 +0000 |
| Subject: | Re: We have detected that PHPNET HOSTING SERVICES IS HOSTING A FRAUDULENT WEBSITE that offers a PHISHING SCAM against ALLIANCE LIECESTER. | ||
| References: | 1 | Groups: | php.webmaster |
| Request: | Send a blank email to php-webmaster+get-3928@lists.php.net to get a copy of this message | ||
FOR THE MILLIONS TIME PHP.NET != PHPNET.FR:
~ $ nslookup www.lunedesang.fr
Name: www.lunedesang.fr
Address: 195.144.11.42 <- Aha the IP addy you found
~ $ nslookup php.net
Name: php.net
Address: 69.147.83.197
~ $ nslookup php.fr <- Some php.net mirror in fr
Name: php.fr
Address: 193.43.210.197 <- Obviously in a different ip range
~ $ nslookup phpnet.fr
Name: phpnet.fr
Address: 195.144.11.67 <- Aha, same /24
~ $ nslookup 195.144.11.42
42.11.144.195.in-addr.arpa name = 195-144-11-42.phpnet.fr.
Authoritative answers can be found from:
11.144.195.in-addr.arpa nameserver = ns2.phpnet.org.
11.144.195.in-addr.arpa nameserver = ns.phpnet.org.
ns2.phpnet.org internet address = 213.215.8.252
ns.phpnet.org internet address = 195.144.11.40
~ $ whois phpnet.fr
domain: phpnet.fr
identified: N
ref-id: [INFORMATION NOT AVAILABLE]
holder: PHP-NET
[...]
phone: +33 4 56 58 65 00
fax-no: +33 4 38 49 27 95
e-mail: thibaud@phpnet.org <- MAYBE THE CONTACT TO TALK TO?
[...]
phone: +33 4 56 58 65 00
fax-no: +33 4 76 48 02 62
e-mail: support@phpnet.org
website: http://www.phpnet.org
[...]
phone: +33 9 53 76 76 76
e-mail: thibaud@phpnet.org
~ $ whois php.net <- So this is us now
Administrative Contact:
Development Team, PHP rasmus@lerdorf.on.ca
[...]
Please give it a rest. Deal with the right people.
Friday, February 27, 2009, 8:52:45 PM, you wrote:
> Hello,
> Telefonica Spain is managing the FRAUDULENT ACTIONS against ALLIANCE
> LIECESTER BANK and all related with PHISHING SCAMS against this finantial entity.
> We have detected that PHPNET HOSTING SERVICES IS HOSTING A FRAUDULENT
> WEBSITE that offers a PHISHING SCAM against ALLIANCE LIECESTER BANK from the next URL:
> http://www.lunedesang.fr/images/gw/old/Alliance.php
>
> with this IP: 195.144.11.42, HOSTED ON YOUR NETWORK.
> This FRAUDULENT WEBSITE represents a MISUSE OF THE INTELLECTUAL PROPERTY
> of ALLIANCE LIECESTER BANK, as well as to obtain personal information of
> their customers in order to get fraudulent access into their bank
> accounts, use their credit cards, etc.
> We need your colaboration for stopping this fraud, getting offline the fraudulent website.
> We keep waiting for your feedback against this incident.
> If you need further information please contact our SOC 24/7 at +34 91 754 8987 / 8928.
> Best regards.
> ------------------------------------------------------------
> ANTI-FRAUD Command Center
> Antiphishing Services
> SOC - Telefonica Empresas
> Tlf: +34 91 754 8987 /8928
> Fax: +34 91 181 7465
> Email: phishing@telefonica.es
Best regards,
Marcus