Wednesday, December 10, 2014

Veuillez immédiatement mettre à jour vos coordonnées (Apple Phishing) (iTunesConnect related)

Bonjour,

Les donnée de votre compte Apple ont été actualisées le 10/12/2014 :

Carte bancaire

Si ces changements ont été effectués par erreur ou si vous pensez qu’une personne non autorisée a accédé à votre compte, veuillez immédiatement mettre à jour vos coordonnées . Si vous avez besoin d’aide, veuillez vous rendre sur le site Apple Support.

Cordialement,

L’Assistance client Apple

Signature

Apple Sales International, Hollyhill Industrial Estate, Cork, Ireland.Numero d'immatriculation de la societe : 15719. Numero de TVA : IE6554690W. Tous droits reserves / Engagement de confidentialite / Mon Apple ID Si vous ne souhaitez plus recevoir d'e-mails de la part d'Apple ou si votre adresse e-mail a change, veuillez cliquer ici.
TM et copyright 2014 Apple Inc.

Phishing analysis :

CLICK : veuillez immédiatement mettre à jour vos coordonnées
OPEN : http://gator4190.hostgator.com/~inbox212/cgi-bin/iTunes/Apple-Connect/0.21451000/Apple/
SCREENSHOT :


DIG : https://gator4190.hostgator.com/~inbox212/cgi-bin/iTunes/Apple-Connect/0.21451000/Connexion/
SCREENSHOT :


VALIDATE : FORM
REDIRECT : https://gator4190.hostgator.com/~inbox212/cgi-bin/iTunes/Apple-Connect/0.21451000/Connexion/inscription/
SCREENSHOT :


VALIDATE : FORM
REDIRECT : https://itunesconnect.apple.com/WebObjects/iTunesConnect.woa
PHISHING : DONE !

Email analysis :

NOTE : iTunes
NOTE : Veuillez immédiatement mettre à jour vos coordonnées

Friday, October 17, 2014

Please verify your account (Apple phishing)

Confirm your account

Some information on your account appears to be missing or incorrect. Please update your information p romptly so that you can continue to enjoy all the benefits of your account.

Get Started ›

If you don't update your information within 14 days, we'll limit what you can do with your account.

Email analysis :

NOTE : Received : from lvps217-199-162-34.vps.webfusion.co.uk
NOTE : (lvps217-199-162-34.ipv6.vps.webfusion.co.uk. [2a02:4e8:4:1050::d9c7:a222])
NOTE : Received : by lvps217-199-162-34.vps.webfusion.co.uk (Postfix, from userid 33)
NOTE : Return-Path : < www-data@lvps217-199-162-34.vps.webfusion.co.uk >
NOTE : X-Php-Originating-Script : 33:mailerPass.php
NOTE : Mime-Version : 1.0
NOTE : Content-Type : text/html
NOTE : Please verify your account

Phishing analysis :

CLICK : Get Started
OPEN : http://yachtsoffered.com/uploads/images/165/thumbnail/dir.html
REDIRECt : http://support-customer-help-account-verification-id21477.gbtembroidery.com/
SCREENSHOT :


SUBMIT FORM : by clicking Sign In

SCREENSHOT :


CLICK : Finish
REDIRECT : https://itunesconnect.apple.com/WebObjects/iTunesConnect.woa
FINAL PURPOSE : The final purpose of this phising is to compromise itunesconnect accounts.

Whois yachtsoffered.com :

Domain Name: yachtsoffered.com Registry
Domain ID: 1436378277_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.melbourneit.com
Registrar URL: http://www.melbourneit.com.au
Updated Date: 2013-05-07T22:47:57Z
Creation Date: 2008-03-28T14:04:34Z
Registration Expiration Date: 2015-03-28T14:04:25Z
Registrar: Melbourne IT Ltd
Registrar IANA ID: 13
Registrar Abuse Contact Email: abuse@melbourneit.com.au
Registrar Abuse Contact Phone: +61.386242300 Domain Status: ok
Registry Registrant ID: Registrant Name: Judy Nasmith
Registrant Organization: Judy Nasmith
Registrant Street: PO Box 70133
Registrant City: Seattle Registrant State/Province: WA
Registrant Postal Code: 98127 Registrant Country: US
Registrant Phone: +1.9633560
Registrant Phone Ext: Registrant Fax: +1.9633560
Registrant Fax Ext: Registrant Email: captjudy@hotmail.com
Registry Admin ID: Admin Name: Judy Nasmith
Admin Organization: Judy Nasmith
Admin Street: PO Box 70133
Admin City: Seattle
Admin State/Province: WA Admin Postal Code: 98127
Admin Country: US Admin Phone: +1.9633560
Admin Phone Ext: Admin Fax: +1.9633560
Admin Fax Ext: Admin Email: captjudy@hotmail.com
Tech Name: Verio Hostmaster
Tech Organization: Verio
Tech Street: 5050 Blue Lake Dr.
Tech City: Boca Raton
Tech State/Province: FL Tech Postal Code: 33431
Tech Country: US Tech Phone: +1.8886636648
Tech Phone Ext:
Tech Fax: +1.8886636655
Tech Fax Ext:
Tech Email: hostmaster@VERIO-HOSTING.COM
Name Server: NS1.WESTSERVERS.NET
Name Server: NS2.WESTSERVERS.NET
DNSSEC: unsigned URL

whois gbtembroidery.com :

Domain Name: gbtembroidery.com
Creation Date: 2014-07-30
Registration Expiration Date: 2015-07-30
Registrar: Onlinenic Inc Registrar IANA ID: 82
Registrar Abuse Contact Email: onlinenic-enduser@onlinenic.com
Registrar Abuse Contact Phone: +1.5107698492
Reseller: YorHost
Domain Status: clientTransferProhibited
Registrant Name: Tina Flowers
Registrant Organization: GBT Embroidery
Registrant Street: 137 Dominion Road
Registrant City: Leicester
Registrant State/Province: Leicester
Registrant Postal Code: LE3 8JB
Registrant Country: GB
Registrant Phone: +44.7889475809
Registrant Fax: +44.7889475809
Registrant Email: Gbtembroidery@yahoo.co.uk
Admin Name: Tina Flowers
Admin Organization: GBT Embroidery
Admin Street: 137 Dominion Road
Admin City: Leicester
Admin State/Province: Leicester
Admin Postal Code: LE3 8JB Admin Country: GB
Admin Phone: +44.7889475809
Admin Phone Ext: Admin Fax: +44.7889475809
Admin Email: Gbtembroidery@yahoo.co.uk
Registry Tech ID: Tech Name: Tina Flowers
Tech Organization: GBT Embroidery
Tech Street: 137 Dominion Road
Tech City: Leicester
Tech State/Province: Leicester
Tech Postal Code: LE3 8JB
Tech Country: GB Tech Phone: +44.7889475809
Tech Phone Ext: Tech Fax: +44.7889475809
Tech Fax Ext: Tech Email: Gbtembroidery@yahoo.co.uk
Name Server: ns100a.yorhost.net
Name Server: ns100b.yorhost.net