Mr. Linux Head

Fresh Phish today.

2006-05-09T04:55:00.000-07:00

Hi all,I love Fresh Phish in the morning!Here is the headers and body of another phish email today. These people give me cramps.I sent it to spoof@ebay.com and pasted the URL into phishfighting.com. Go Go Go!Return-Path: Authentication-Results: mta163.mail.mud.yahoo.com from=ebay.com; domainkeys=neutral (no sig)Received: from 208.187.180.4 (EHLO web1.octelecom.net) (208.187.180.4) by

New blog "Mr. Phish Finder" tracks down scumbags

2006-05-09T03:42:00.000-07:00

I started another blog to track down and expose scambags who send phony email as eBay or Paypal seeking to snarf people's user names and passwords with look-alike webs sites.I had to call it something so it's known as Mr. Phish FinderI will try to comment on Linux stuff here and whatever else I can think of.Ok carry on.

Another eBay scam artist emailed me tonight.

2006-04-24T16:52:00.000-07:00

Another eBay scam artist emailed me tonight. This one was just a little different.I guess now I have an "Unpaid Item Dispute" Points to 209.216.209.10 as the mail server.Here is the full email headers and all..X-Apparently-To: mrlinuxhead@yahoo.com via 68.142.207.116; Mon, 24 Apr 2006 15:56:29 -0700X-Originating-IP: [209.216.209.10]Return-Path: Authentication-Results: mta244.mail.re2

Another ebay scammer

2006-04-23T08:56:00.000-07:00

Another ebay scammer at this address:http://1044980011/%20/signin.ebay.com/ws/eBayISAPI/index.htmlPasted it into Phishfighing. com and emailed ebay and the ISP in Finland.http://1044980011/%20/signin.ebay.com/ws/eBayISAPI/index.htmlresolves to 62.73.33.43WHOIS info on 62.73.33.43IP address: 62.73.33.43Reverse DNS: [No reverse DNS entry per ns1.auria.fi.]

Caught a new Polish "Phisherman" tonight

2006-04-19T20:51:00.000-07:00

Another email from another eBay customer.Sure. I trust you. Lets fry this clown..Here is the text of the scam email : Ã Question from mmjd1996Item: (4629414062)This message was sent while the listing was active.mmjd1996 is a potential buyer.Hi, how much would be shipping to Germany? ThanksUsing DNSStuff.com I find out our scammers IP address.eBay.com URL points to:http://1393442438/img/...bleh/

The NSA domestic spying program is wrong!

2006-04-19T11:23:00.000-07:00

The Bush administration seems to be shreding the fourth admendment as fast as they can, with little or no regard for the Bill of Rights, the Constitution, or any checks and balances imposed by laws or Congress.Looking at the news lately, I have been outraged, but not shocked at what we have dicovered in the last few weeks from the papers the EFF has filed in court to block AT&T from wholesale

Webcam feeds from around our fair planet

2006-04-19T09:42:00.000-07:00

I added some webcam feeds from around our fair planet.So far we have:La Tonnarella, Sorrento ItalySaint-Gilles-les-Bains, FranceRoyal Citadel, Plymouth UKBoston, Massachusetts Pensacola Beach, FLAHouston, TXVallejo, California Kamaole Beach, Maui, HawaiiSapporo, JapanHong Kong, China And the list may change at any time. The full size views are at My Back Pages.They don't

Pensacola Beach Blog

2006-04-18T20:59:00.001-07:00

A progressive blog from soomeplace I used to live.Enjoy!Pensacola Beach Blog

Bitch | Lab

2006-04-18T20:59:00.000-07:00

Quite a good blog for a little edgy whitty sort of humor.Check it out.Bitch | Labhttp://blog.pulpculture.org/

random_speak

2006-04-18T20:58:00.000-07:00

Absolutly must read for a taste of Southern Culture gone terribly wrong!random_speak

» Why Windows is less secure than Linux | Threat Chaos | ZDNet.com

2006-04-16T16:09:00.000-07:00

Excellent Security Blog by Richard Stiennon at ZDnet.The basic argument goes like this. In its long evolution, Windows has grown so complicated that it is harder to secure. Well these images make the point very well. Both images are a complete map of the system calls that occur when a web server serves up a single page of html with a single picture. The same page and picture. A system call is an

CNN.com - Beware of tax refund 'phishing' scams - Apr 14, 2006

2006-04-15T14:10:00.000-07:00

CNN.com - Beware of tax refund 'phishing' scams - Apr 14, 2006: "Phishing is an e-mail trick that 'lures' users with a promise of money or an urgent security warning that asks users to update their information. But instead of going to a financial institution or the government, the precious personal data goes to identity thieves.IRS doesn't e-mail taxpayersAt least during this tax season, Internet

Great story about botnets in the New Yorker

2006-04-14T23:06:00.000-07:00

Great artile about botnets in the New Yorker. Makes an excellent read if you want to learn about DDOS counter-measures.Name of article is: "THE ZOMBIE HUNTERS On the trail of cyberextortionists."by EVAN RATLIFFRecomended reading.

The 100 top things I want my girlfriend to say!

2006-04-14T02:28:00.001-07:00

This came from craigslist best of. Enjoy!I didn't vote for either George BushI don't tear the tags off my mattresses til I get homeI always stop to pet dogs outside of grocery storesI'm likely to have a different hair color every time you see meI'm slippery when wetI only use the rail when I walk down the stairs 30% of the time ( I love to walk the line ya know)I've never read Playboy for the

ebay scam scum again. . .

2006-04-14T01:20:00.000-07:00

I got a question from an eBay buyer tonight. How sweet. I don't have anything for sale on eBay.Game on. Your ass is mine soon. . .here is your real url: http://3717423647/~silverfoil/index.html/.ws/www.ebay.com/index.htmlHere is the the message (for what is matters):Â Question from cdesteveItem: (8403494162)This message was sent while the listing was active.cdesteve is a potential buyer.Still no

Euronext.liffe Shifts Exchange to Linux-Intel Platform

2006-04-13T20:56:00.000-07:00

Euronext.liffe is switching its technology to the Linux operating system and the Intel-based processor citing the need to keep up with the growth of algorithmic trading. The move signals "a fairly substantial shift in the electronic exchange's IT strategy," says Jim Johanek, SVP U.S. Technology Strategy for Euronext.liffe. The futures exchange—which is the derivatives arm of Euronext

Another good quote for today.

2006-04-13T15:27:00.000-07:00

This one seems relevant in light of recent disclosures by the Bush administration relating to the Iraq pre-war intelligence.My sources are unreliable, but their information is fascinating. -- Ashleigh Brilliant

BackTrack - A "live" Linux CD could be trouble in the wrong hands

2006-04-11T02:03:00.000-07:00

I sat down last night with a REALLY good toolkit for security professionals called BackTrack - A "live" Linux CD could be real trouble in the wrong hands. It is a bootable CD-ROM that runs Linux. Well, you say, what's so new about that? What is new is this has been designed with the computer security professional in mind, and is truly a "Swiss army knife" full of very sharp tools.It is the

The future of computing

2006-04-10T21:04:00.000-07:00

"The future, according to some scientists, will be exactly like the past, only more expensive." - John Sladek "I predict the Internet... will go spectacularly supernova and in 1996 catastrophically collapse," Bob Metcalfe, inventor and 3Com founder, 1995 "640K ought to be enough for anybody," Bill Gates, chairman of Microsoft, 1981 "There is no reason anyone would want a computer in

Yet Another Phishing scam today!

2006-04-10T00:29:00.000-07:00

Got another question today from an scammer posing as an eBay buyer! Â Question from snoboy2kItem: (6863632227)This message was sent while the listing was active.snoboy2k is a potential buyer.What would the shipping cost be to West Virginia zip code 25511? Respond to this question in My Messages.Respond Now Item DetailsItem number: 6863632227End date: Mar-27-06 01:43:11 PSTView

Why phishing works. Even IT Pros get fooled.

2006-04-09T16:48:00.000-07:00

I got "phished" a few weeks ago and bit the hook. Too early on a saturday, I woke up, checked my email, and clicked on a link. Happened to me and I can vouch for the feeling. I am an IT guy and I should know better. But bottom line is, it happens, just like automobile accidents, when you least expect it and aren't paying attention.Now some researchers , Rachna Dhamija at Harvard and J.D. Tygar

Another "phisherman" emailed me today.

2006-04-09T12:53:00.000-07:00

Another "phisherman" emailed me today. I can't count how many but I think they must be about one a week on average. I opened what looked like a regular ebay email. Here is the text.Â Question from bigmoneyItem: (6852613597)This message was sent while the listing was active.bigmoney is a potential buyer.What is the last price for this Item? Respond to this question in My Messages.Respond Now

INSIDE THE HONEYPOTS

2006-04-09T00:15:00.000-07:00

Simply connecting to the Internet — and doing nothing else — exposes your PC to non-stop, automated break-in attempts by intruders looking to take control of your machine surreptitiously.If an online intruder has infiltrated your Windows PC, you may notice recurring slowdowns of e-mail and Web browsing, or you may notice nothing at all. PC users must shore up defenses on three fronts:As of early

Another "Phisherman" today - Matt Ashby

2006-04-07T14:48:00.000-07:00

Another email showed up today from a ebay member " prescreened". The text of the message follows:Question from prescreened About This Member prescreened( 5792) Positive Feedback: 100% Member Since: Apr-14-99 Location: OH, United States Registered On: www.ebay.comHey ,I'll send you the money today.When will you send the package ?Thanks !Respond to this question in My

New RSS Feed

2006-04-06T02:18:00.000-07:00

Hi All,I got a new RSS feed going today.This will change in the next day or so.I hope to focus on Linux stuff but for now, I will just be experimentiing.As far as you scumbags out there, be afraid. I will come and hunt you down!Don't think I won't expose you for the scum you are!Hope you all enjoy the ride.

Another new "Phisherman" Meet Christian Dvorak

2006-04-04T17:03:00.000-07:00

I received ANOTHER "Phishing" attempt tonight. This one was a good laugh for me.It was to welcome me to join something called the "PowerSeller Silver Membership"What is so funny is I have sold exactly ONE item on eBay.I really don't think I qualify to be a "Power Seller", silver or any color!Of course I reported this to eBay, but they seem to be about as good at stopping these clowns as Bush

BBC NEWS | Americas | 'Miserable failure' links to Bush

2006-04-04T08:28:00.000-07:00

BBC NEWS | Americas | 'Miserable failure' links to Bush

WHOIS info on the "French Phisherman"

2006-04-03T16:30:00.000-07:00

Domain is listed in WHOIS, using DNS Stuff: mfrchampagne-lorraine.netmfrchampagne-lorraine.net. MX IN 172800 smtp2.lerelaisinternet.com. [Preference = 20]mfrchampagne-lorraine.net. MX IN 172800 smtp1.lerelaisinternet.com. [Preference = 10]mfrchampagne-lorraine.net. NS IN 172800 ns1.lerelaisinternet.com.mfrchampagne-lorraine.net. NS IN 172800 ns2.

The French Phisherman returns!

2006-04-03T16:13:00.000-07:00

Some people just won't quit.I just received another spoof email from the "French Phisherman"This clown won't go away quietly. Time to make it hurt.First thing I did was enterhis url into PhishFighting.comThe URL for this clown is the same as last week:http://1342912795/intranet/forum/templates/subSilver/images/wsbleh/ebay/index.htmlThis resolves to 80.11.57.27Same server in France. Will someone

Help Us Impeach George Bush Now! | ImpeachPAC

2006-04-03T05:04:00.000-07:00

Help Us Impeach George Bush Now! | ImpeachPAC

Port scan of the Canadian "Phisherman"

2006-04-03T02:14:00.000-07:00

Got a new "Phisherman" today heehee

2006-04-02T14:25:00.000-07:00

Got a new "Phisherman" today heeheeHere is the URL:http://1088880691/%20/signin.ebay.com/ws/eBayISAPI/index.htmlLet's see who this poor sucker is....C:\>ping 1088880691Pinging 64.231.0.51 with 32 bytes of data:Reply from 64.231.0.51: bytes=32 time=100ms TTL=238Gotcha sucker. .. Game onHere is the text of the email: Â Question from napolitana1 Item: (6852595473) This message

PhishFighting.com - Fight back and take down the Phishers.

2006-04-01T12:41:00.000-08:00

This site will take the URL and send bogus usernames and passwords to it about once a second. Try it with your next "phisherman".PhishFighting.com - Fight back and take down the Phishers.

Help Stop Phishing!

2006-04-01T12:39:00.000-08:00

Here is a site you can use to report Phishing scams!Help Stop Phishing!

Emergency Boot CD fix Spyware & Virus

2006-03-30T23:20:00.000-08:00

The Emergency Boot CDIs your computer getting slow cannot connect to the internet or suffering from lots of pop-ups? Has your home page been changed without your knowledge?Do you suspect that your computer may be infected with Spyware Viruses and Worms? If so you may need professional tools like the experts.I developed the Emergency Boot CD to repair most problems caused by Malware on the

Another Phisherman from China

2006-03-30T21:52:00.000-08:00

Earlier tonight I got the third "phishing" attempt in a week, this time spoofed as an e-mail from Paypal. The subject was obviously b.s., because Paypal would not email me to " Restore Your Account Access - mrlinuxhead@yahoo.com (Routing Code: XXXXXXXXXXX).It was just yesterday I got a second spoofed email from the same clown posing as a eBay buyer. After telling eBay, the web server is still up

The French Phishermen web site is at ..

2006-03-30T05:18:00.000-08:00

This is what I found so far. The scam eBay web site is on the web server's intranet page under the account "wsbleh". I see a link to the "intranet" page and it prompts for a username and password.Looking up information on this site I can see they have been "blacklisted" in SORBS, an on-line database to prevent spam and open-relay servers that can be used by scam artists, like our wanna be eBay

A quick look at the target . .

2006-03-29T21:51:00.000-08:00

It looks like our web server is infected with W32.MyDoom. It's running Apache with PHP, MSSQL, MySQL, OpenSSH, And EDonkey P2P file sharing.This is one busy little box! And it looks like it's on a cable or DSL line. Wonder who is on it?

Our French Phisherman is infected with w32.MyDoom

2006-03-29T21:20:00.000-08:00

The first mail was from mail-cosymed.cosymed.de

2006-03-29T20:49:00.000-08:00

The first IP address I was sent this scam from was 62.157.142.135. That resolves to : mail-cosymed.cosymed.de Asking i.root-servers.net for 135.142.157.62.in-addr.arpa PTR record: i.root-servers.net says to go to tinnie.arin.net. (zone: 62.in-addr.arpa.)Asking tinnie.arin.net. for 135.142.157.62.in-addr.arpa PTR record: tinnie.arin.net [69.25.34.195] says to go to secondary007.

Return of the Phisherman. He's French.

2006-03-29T18:35:00.000-08:00

I got another email from the Phisher today posing as an eBay buyer. The text of the message goes like this:To:mrlinuxhead@yahoo.com Subject: Message from eBay Member regarding Item #4624463216 From:"eBay Member precisionlaptops4u" Date: Wed, 29 Mar 2006 23:36:45 +0200 (CEST) ï»¿ eBay sent this message to you.Your registered name is

I got "Pished" and took the hook.

2006-03-26T12:48:00.000-08:00

I got "Pished" and took the hook. Boy do I feel dumb.I work as computer consultant. I should know better.Something happened to me here yesterday that reminded me even computer gurus make mistakes.Someone posing as a eBay customer sent me a email asking about something for sale.It was 8 am and as I was rolling out of bed, I clicked on reply.A ebay username and password page came up and I typed in

Bush policy to pre-emptively attack US enemies?

2006-03-16T11:25:00.000-08:00

I am deeply troubled by the Bush administration's policy to attack anyone or anywhere they decide are "enemies". They continue to express a willingness to shoot first and ask questions later.Who decides that a country is an threat to the US? The same administration that invaded Iraq? The one that first tried to change the rationale from ending "weapons of mass destruction" to a mission to spread

Still yet more good quotes

2006-03-14T22:33:00.000-08:00

You cannot see farther than others by standing on the feet of giants.What is worth doing is worth the trouble of asking somebody to do it.If you fool around with something long enough, it will eventually break.According to the latest official figures, 43% of all statistics are totally worthless.Experience is what causes a person to make new mistakes instead of old ones.

New Quotes for the week

2006-03-14T22:31:00.000-08:00

I don't want to be a millionaire. I just want to live like one. - Joe E. LewisIf you can't say something nice, say something surrealistic. - Zippy the PinheadIt is impossible to get anywhere without sinning against reason. - EinsteinIf one does not fail at times, then one has not challenged himself. - Dr. PorscheKeep your mouth shut and people will think you stupid;Open it and you remove all

Mr. Linux Head's Quotes of the Week

2006-03-14T20:10:00.000-08:00

Bimbos should be obscene and not heard.How many weeks are there in a light year?No man is rich enough to buy back his past.Music in the soul can be heard by the universe.Keep America beautiful. Swallow your beer cans.Never argue with anyone who buys ink by the gallon.A project not worth doing at all is not worth doing well.It is better to die on your feet than to live on your knees.One picture

New toy of the week : Kororaa Xgl Demo CD

2006-03-14T19:51:00.000-08:00

My New toy of the week : Kororaa Xgl "Live" Demo CD.Kororaa Xgl showcasing Novell's Xgl + Compiz technology is a "live" Linux Cd.Super pimpin looks : This is soooo cool. Loads nVidia drivers up and Rocks right out of the box!Just bagged this from the torrent sites and lit it up.Ooooh this is nice. Accelerated Open GL with squigily windows and lots o eye candy. I like!One thing to try on this is :