Tuesday, March 8, 2016

Appstore - check your personal data (Apple Phishing)

Dear Customer

We need your help to solve a problem with your account.

Your Apple ID was used to log in to iCloud from an unauthorized computer.

Your iTunes account will be suspended.

To help us solve this problem, click the link below and perform a verification of personal data.

Https://www.apple.com/En-Au/check your personal data./ID: 6HL37295PC836484T

For further information, please contact custom! er service.

Thanks,
Apple Customer Support Service

Apple Sales International, Hollyhill Industrial Estate, Cork, Ireland. Numero di registrazione impresa 15719. Partita IVA IE6554690W.
Tutti i diritti riservati/Tutela della privacy/Il mio Apple ID

Se non desideri ricevere comunicazioni di carattere commerciale da Apple o se hai cambiato indirizzo e-mail, fai-clic qui.

TM e copyright 2014 Apple Inc.

Phishing analysis :

CLICK : Https://www.apple.com/En-Au/check your personal data./ID: 6HL37295PC836484T
OPEN : http://reims-et-soissons.com/wp-includes/ID3/
REDIRECT : http://zwonakaparkandlodge.co.za/components/com_ajax/paoolinh.apple.com/
SCREENSHOT :


ACTION : VALIDATE FORM
REDIRECT : http://zwonakaparkandlodge.co.za/components/com_ajax/paoolinh.apple.com/info.php?//appleid.apple.com/cgi-bin/WebObjects/MyAppleId.woa/273/wo/RHbGlbVOSDtkOMbXu4TET0/0.0.67.17.1
SCREENSHOT :


ACTION : VALIDATE FORM
REDIRECT : https://appleid.apple.com/

Email analysis :

NOTE : icoud@dongi.ir
NOTE : apache@dongi.ir
NOTE : X-Msmail-Priority : High
NOTE : X-Mailer : timor.websitewelcome.com 192.185.164.21
NOTE : client-ip=78.111.2.20;


Notes from Scam.cz

- A compromised wordpress installation : reims-et-soissons.com
- A compromised joomla installation : zwonakaparkandlodge.co.za
- A relay to send phishing : dongi.ir

Tuesday, October 27, 2015

Your account will expire in 48 hours. (Apple Phishing)

dear client ,

We inform you that your account will expire in 48 hours, it is imperative to conduct an audit of your information to the Now, using your iTunes ID.

Check now

The sending of this email applies when the expiration date of your
account expires,

For more information, see the Security Center category.

thank you,
Apple Support

Phishing analysis :

CLICK : Check now
OPEN : http://bomcity.co/main/iTunes.htm
REDIRECT : http://unlocksuccessmembers.com/iTunes/***/
SCREENSHOT :


VALIDATE : FORM
REDIRECT : http://unlocksuccessmembers.com/iTunes/***/Verification.php
SCREENSHOT :


NOTE : unlocksuccessmembers.com redirect to fiverchamp.com

Whois analysis :

bomcity.co :

Domain Name: BOMCITY.CO
Domain ID: D1433807-CO
Sponsoring Registrar: INSTRA CORPORATION PTY LTD
Sponsoring Registrar IANA ID: 1376
Registrar URL (registration services): whois.instra.net
Domain Status: ok
Registrant ID: TUHAFHUSFMUH682Z
Registrant Name: Dominic Tong
Registrant Address1: Flat F, 42/F, Tower 5
Registrant Address2: Ocean Shores, TKO
Registrant City: Hong Kong
Registrant Postal Code: 000
Registrant Country: Hong Kong
Registrant Country Code: HK
Registrant Phone Number: +852.90348565
Registrant Email: codomains@instra.com
Administrative Contact ID: TUSUQQUY9AQN00ME
Administrative Contact Name: Dominic Tong
Administrative Contact Address1: Flat F, 42/F, Tower 5
Administrative Contact Address2: Ocean Shores, TKO
Administrative Contact City: Hong Kong
Administrative Contact Postal Code: 000
Administrative Contact Country: Hong Kong
Administrative Contact Country Code: HK
Administrative Contact Phone Number: +852.90348565
Administrative Contact Email: codomains@instra.com
Billing Contact ID: TUJQANM3X6PC71J4
Billing Contact Name: Dominic Tong
Billing Contact Address1: Flat F, 42/F, Tower 5
Billing Contact Address2: Ocean Shores, TKO
Billing Contact City: Hong Kong
Billing Contact Postal Code: 000
Billing Contact Country: Hong Kong
Billing Contact Country Code: HK
Billing Contact Phone Number: +852.90348565
Billing Contact Email: codomains@instra.com
Technical Contact ID: TURJGNWGXN7HO1OW
Technical Contact Name: Dominic Tong
Technical Contact Address1: Flat F, 42/F, Tower 5
Technical Contact Address2: Ocean Shores, TKO
Technical Contact City: Hong Kong
Technical Contact Postal Code: 000
Technical Contact Country: Hong Kong
Technical Contact Country Code: HK
Technical Contact Phone Number: +852.90348565
Technical Contact Email: codomains@instra.com
Name Server: NS1.INSTRADNS.COM
Name Server: NS2.INSTRADNS.COM
Name Server: NS3.INSTRADNS.COM
Created by Registrar: TUCOWS DOMAINS INC.
Last Updated by Registrar: INSTRA CORPORATION PTY LTD
Last Transferred Date: Thu Apr 19 12:26:36 GMT 2012
Domain Registration Date: Wed Jul 21 05:10:16 GMT 2010
Domain Expiration Date: Wed Jul 20 23:59:59 GMT 2016
Domain Last Updated Date: Mon Jul 13 01:05:35 GMT 2015
DNSSEC: false

unlocksuccessmembers.com :

Domain Name: UNLOCKSUCCESSMEMBERS.COM
Registry Domain ID: 1909356745_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.godaddy.com
Registrar URL: http://www.godaddy.com
Update Date: 2015-03-12T05:42:16Z
Creation Date: 2015-03-12T05:42:16Z
Registrar Registration Expiration Date: 2016-03-12T05:42:16Z
Registrar: GoDaddy.com, LLC
Registrar IANA ID: 146
Registrar Abuse Contact Email: abuse@godaddy.com
Registrar Abuse Contact Phone: +1.4806242505
Domain Status: clientTransferProhibited http://www.icann.org/epp#clientTransferProhibited
Domain Status: clientUpdateProhibited http://www.icann.org/epp#clientUpdateProhibited
Domain Status: clientRenewProhibited http://www.icann.org/epp#clientRenewProhibited
Domain Status: clientDeleteProhibited http://www.icann.org/epp#clientDeleteProhibited
Registrant Name: Morrison Publishing, LLC
Registrant Street: 965 Hwy 51n ste 4-100
Registrant City: madison
Registrant State/Province: Mississippi
Registrant Postal Code: 39110
Registrant Country: United States
Registrant Phone: +1.6014881062
Registrant Email: anthony@anthonymorrison.com
Admin Name: Morrison Publishing, LLC
Admin Street: 965 Hwy 51n ste 4-100
Admin City: madison
Admin State/Province: Mississippi
Admin Postal Code: 39110
Admin Country: United States
Admin Phone: +1.6014881062
Admin Email: anthony@anthonymorrison.com
Tech Name: Morrison Publishing, LLC
Tech Street: 965 Hwy 51n ste 4-100
Tech City: madison
Tech State/Province: Mississippi
Tech Postal Code: 39110
Tech Country: United States
Tech Phone: +1.6014881062
Tech Email: anthony@anthonymorrison.com
Name Server: NS1.MYLAUNCHMEMBERS.COM
Name Server: NS2.MYLAUNCHMEMBERS.COM
DNSSEC: unsigned
URL of the ICANN WHOIS Data Problem Reporting System: http://wdprs.internic.net/

fiverchamp.com :

Domain Name: FIVERCHAMP.COM
Registrar: GODADDY.COM, LLC
Sponsoring Registrar IANA ID: 146
Whois Server: whois.godaddy.com
Referral URL: http://registrar.godaddy.com
Name Server: NS1527.WEBSITEWELCOME.COM
Name Server: NS1528.WEBSITEWELCOME.COM
Status: clientDeleteProhibited http://www.icann.org/epp#clientDeleteProhibited
Status: clientRenewProhibited http://www.icann.org/epp#clientRenewProhibited
Status: clientTransferProhibited http://www.icann.org/epp#clientTransferProhibited
Status: clientUpdateProhibited http://www.icann.org/epp#clientUpdateProhibited
Updated Date: 30-mar-2014
Creation Date: 05-jan-2013
Expiration Date: 05-jan-2016

Email analysis :

NOTE : Account.Apple@mail.apple-id.com
NOTE : client-ip=64.191.157.113;
NOTE : Received : from webmail.netgainit.com ([64.191.157.113])
NOTE : Received : from HVPS-LaneWeb (10.50.87.1) by ssexch3.ssad2.com (10.50.3.3)