Wednesday, November 8, 2017

OVH (Phishing)

Phishing analysis :

OPEN : http://pasalo-bien.de/html/cliente/ES/?https://paiment.ovh.net/espaceclient
SCREENSHOT :


REDIRECT : http://pasalo-bien.de/html/cliente/ES/sn.php
REDIRECT : http://pasalo-bien.de/html/cliente/ES/index1.html
SCREENSHOT :


REDIRECT : http://pasalo-bien.de/html/cliente/ES/sn1.php
REDIRECT : http://pasalo-bien.de/html/cliente/ES/index11.html
REDIRECT : http://pasalo-bien.de/html/cliente/ES/sn11.php
REDIRECT : http://pasalo-bien.de/html/cliente/ES/index2.html
SCREENSHOT :


CLICK : TERMINAR
REDIRECT : https://www.ovh.com/

Saturday, August 19, 2017

Your fund has been discovered (Scam from a zombie server)

Hello,
My name is Frank. I am a top-exec in a global bank here in Asia. I have an offer for you that will greatly benefit us both if we work together. Please, do get in touch with me so I can explain more about the deal.
Cordially,
Frank

Email analysis :

NOTE : p.pproject@outlook.com
NOTE : test@rachatcredits.ovh
NOTE : X-Ovh-Remote : 213.186.33.59 (b9.ovh.net)
NOTE : Mime-Version : 1.0
NOTE : Content-Description : Mail message body
NOTE : client-ip=91.121.204.118;


NOTE : helo=ns336204.ip-91-121-204.eu;
NOTE : Received : from [51.254.235.99] (ip99.ip-51-254-235.eu [51.254.235.99])


NOTE : by ns336204.ip-91-121-204.eu (Postfix)
NOTE : Rép :
NOTE : Scam from a zombie server hosted on OVH.