Tuesday, April 04, 2006

Another new "Phisherman" Meet Christian Dvorak



I received ANOTHER "Phishing" attempt tonight. This one was a good laugh for me.
It was to welcome me to join something called the "PowerSeller Silver Membership"
What is so funny is I have sold exactly ONE item on eBay.
I really don't think I qualify to be a "Power Seller", silver or any color!

Of course I reported this to eBay, but they seem to be about as good at stopping these clowns as Bush seems to be at catching Osama BinLaden. I thought I would do some snooping on my own.


Here is the subject line. How thoughtful, they want ME to join their little club.

Subject:Your PowerSeller Silver Membership
From: "eBay PowerSellers"
Date: Tue, 04 Apr 2006 22:10:35 +0000


Orignal email link embedded in HTML of spoof email is:
http://www.elitemarine.net/blog/archives/www.anaconda.com

Reverse DNS points us to the evildoers:
elitemarine.net. A IN 14400 66.228.123.163

They are pretty sneaky about their information. They do however leave a email address:(spyhunter2000@bellsouth.net).

Registration Service Provided By: Surpass Hosting
Contact: enom@surpasshosting.com
Visit: http://www.surpasshosting.com

Domain name: elitemarine.net
Registrant Contact:
other
somename somename (spyhunter2000@bellsouth.net)
Fax: somephone
someaddress
somecity, SC somezip

US

A google search for (spyhunter2000@bellsouth.net) lead to a page on www.teamxodus.com. Hmmm.
He is infected with the W32.MyDoom virus as well.


This is only a jumping off point that points to the REAL spoof eBay site, as you will see here...

That URL (www.elitemarine.net/blog/archives/www.anaconda.com) redirects to another site in Austria or Germany:

http://projekt-pd.power-wlan.at/images/.PowerSellerpages.eBay.com/ws/eBayISAPII.dll/SignIn.html

DNS reverse lookup using DNS Stuff

projekt-pd.power-wlan.at. A IN 86400 62.141.48.148

IP address: 62.141.48.148
Reverse DNS: ns.power-web34.net.
Reverse DNS authenticity: [Verified]
ASN: 31103
ASN Name: KEYWEB-AS (Keyweb AG)
IP range connectivity: 0
Registrar (per ASN): RIPE
Country (per IP registrar): DE [Germany]


WHOIS report on projekt-pd.power-wlan.at

domain: power-wlan.at
registrant: CD820810-NICAT
admin-c: CD820810-NICAT
tech-c: CD820810-NICAT
zone-c: CD820810-NICAT
nserver: ns.power-web34.net
remarks: 62.141.48.148
nserver: ns2.power-web34.net
remarks: 62.141.49.148
changed: 20040503 16:31:12
source: AT-DOM

personname: Christian Dvorak
organization: power-web.at
street address: Soedingberg 129
postal code: A-8152
city: Stallhofen
country: Austria
phone: +433142805280
fax-no: +433142805230
e-mail: domreg@power-web.at
nic-hdl: CD820810-NICAT
changed: 20050409 10:35:11
source: AT-DOM

inetnum: 62.141.48.0 - 62.141.55.255
netname: DE-KEYWEB-I
descr: Keyweb AG IP Network
country: DE
admin-c: MERO-RIPE
tech-c: MERO-RIPE
status: ASSIGNED PA
mnt-by: KEYWEB-MNT
changed: hostmaster@keyweb.de 20060217
source: RIPE

WHOIS report on netblock:
Information related to '62.141.48.0 - 62.141.55.255'

person: Holger Amberg
address: Keyweb AG
address: Neuwerkstrasse 45/46
address: 99084 Erfurt
address: Germany
e-mail: ha@keyweb.de
abuse-mailbox: abuse@keyweb.de
phone: +49 361 658530
fax-no: +49 361 6585366
nic-hdl: MERO-RIPE
mnt-by: KEYWEB-MNT
changed: ha@keyweb.de 20050419
source: RIPE


A google for Mr. Christiian Dvorak leads to this web page and this contact info:

POWER-WEB.AT, ING. CHRISTIAN DVORAK
Eintrag korrigieren Kontakt
Strasse / Nr.: SÖDINGBERG 6
PLZ / Ort: 8152 STALLHOFEN
Land ÖSTERREICH
E-Mail: office@power-web.at
Telefon: 03142 80 52 80
Fax: 03142 80 52 30
URL: http://www.power-web.at


It is a web hosting company in SÖDINGBERG Austria.

Someone should let Mr. Dvorak know his server is being bad!



What follows is the text of the email.

To: mrlinuxhead@yahoo.com
Subject:Your PowerSeller Silver Membership
From: "eBay PowerSellers"
Date: Tue, 04 Apr 2006 22:10:35 +0000

Dear eBay Member,

You've been on a super sales streak and since you've done so well, it's time to recognize you for your efforts. You are PowerSeller Silver!

Congratulations! joining the eBay Silver PowerSeller Program. Come and join us. When you join the PowerSeller program, you'll be able to receive more of the support you'll need for continued success. So, why wait? Join now!

PowerSeller icon next to your User ID in recognition of your hard work.
PowerSeller Priority Support via email webform and phone support at Silver level and above.
Exclusive offerings on the PowerSeller portal--check in frequently to see updated program benefits and special offers!
Discussion Board for you to network with other PowerSellers.
Free PowerSeller Business Templates for business cards and letterhead.

Membership to the PowerSeller program is FREE.

Again, congratulations and best wishes for your continued success!

Regards,
eBay PowerSeller Team
If you agree with this rank please Become an eBay Power Seller within 24 hours
You are receiving this communication because you are part of the PowerSeller program. This is a one time communication. There is no need to unsubscribe. eBay will not request personal data (password, credit card/bank numbers) in an email.

Copyright © 2003 eBay Inc. All Rights Reserved.
Designated trademarks and brands are the property of their respective owners. eBay and the eBay logo are trademarks of eBay Inc.

I sent a follow up email to the following addresses:

enom@surpasshosting.com
domreg@power-web.at
projekt-pd.power-wlan.at
ha@keyweb.de
abuse@keyweb.de
hostmaster@keyweb.de

And of course, I feed the URL into Phishfighting.com. Great work guys!

1 Comments:

Blogger Joe Berenguer said...

Hi, Fellow!I like your blog!
I just came across your blog and wanted to
drop you a note telling you how impressed I was with
the information you have posted here.
I have a domain names center
site. It pretty much covers domain names center related subjects.
Come and check it out if you get time :-)
Best regards!

2:02 AM  

Post a Comment

<< Home