Fraudulent Web Site Found on Server (http://217.108.248.234/local_bdno/bbx/index.html ) [BBV20100904(1)]
To Whom It May Concern,
http://www.s21sec.com/servicios.aspx?sec=52&apr=54&HIVEDATA=dW2z6ApWhngR9FW UgvEY10RqCHWnVY0lTdLS%2FaGjop%2FvfsfiJElKFRxQoLWWZ0mNDnqO3aXWaOJT720m%2BvWsG kb9wO%2F%2BFfuTN5uRiEmtYmrvoPnNGHhh7ARq6qMOCCXD S21sec has been informed that there is currently a website hosted by your company that is involved in a phishing scheme to obtain personal account information from the customers of BBVA. http://www.s21sec.com/servicios.aspx?sec=52&apr=54&HIVEDATA=dW2z6ApWhngR9FW UgvEY10RqCHWnVY0lTdLS%2FaGjop%2FvfsfiJElKFRxQoLWWZ0mNDnqO3aXWaOJT720m%2BvWsG kb9wO%2F%2BFfuTN5uRiEmtYmrvoPnNGHhh7ARq6qMOCCXD S21sec has received numerous complaints and e-mails regarding the Web site listed below:
http://217.108.248.234/local_bdno/bbx/index.html
The web IP: http://217.108.248.234/ shows a Fedora Test Page.
We enclose below the legitimate url for BBVA: http://www.bbva.es http://www.bbva.es
According to published WHOIS and DNS data, the Web Site involved is owned and hosted by:
Address lookup
lookup failed
217.108.248.234
Could not find a domain name corresponding to this IP address.
Domain Whois record
Don't have a domain name for which to get a record
Network Whois record
Queried whois.ripe.net with "-B 217.108.248.234"...
% Information related to '217.108.248.232 - 217.108.248.239'
inetnum: 217.108.248.232 - 217.108.248.239
netname: FR-LA-RESERVE-A-RAMATUELLE
country: FR
descr: Interconnection with RAEI backbone
admin-c: VD1393-RIPE
tech-c: VD1393-RIPE
status: ASSIGNED PA
mnt-by: RAIN-TRANSPAC
changed: gestip.rain@orange-ftgroup.com 20091009
source: RIPE
person: Vincent DG
address: CHEMDE LA QUESSINE 83350 RAMATUELLE
phone: +33 494791428
e-mail: vincent.dg@lareserve-ramatuelle.com
nic-hdl: VD1393-RIPE
mnt-by: RAIN-TRANSPAC
changed: gestip.rain@orange-ftgroup.com 20091009
source: RIPE
% Information related to '217.108.0.0/16AS3215'
route: 217.108.0.0/16
descr: RAIN
descr: Reseaux d'Acces a l'INternet
remarks: -------------------------------------------
remarks: For Hacking, Spamming or Security problems
remarks: send mail abuse@orange-business.com
remarks: -------------------------------------------
origin: AS3215
mnt-by: RAIN-TRANSPAC
changed: gestip.rain@orange-ftgroup.com 20070910
source: RIPE
-- end --
On behalf of BBVA, http://www.s21sec.com/servicios.aspx?sec=52&apr=54&HIVEDATA=dW2z6ApWhngR9FW UgvEY10RqCHWnVY0lTdLS%2FaGjop%2FvfsfiJElKFRxQoLWWZ0mNDnqO3aXWaOJT720m%2BvWsG kb9wO%2F%2BFfuTN5uRiEmtYmrvoPnNGHhh7ARq6qMOCCXD S21sec requests that the Web site(s) listed above be deactivated and the domain name removed from your servers. BBVA would like you to provide http://www.s21sec.com/servicios.aspx?sec=52&apr=54&HIVEDATA=dW2z6ApWhngR9FW UgvEY10RqCHWnVY0lTdLS%2FaGjop%2FvfsfiJElKFRxQoLWWZ0mNDnqO3aXWaOJT720m%2BvWsG kb9wO%2F%2BFfuTN5uRiEmtYmrvoPnNGHhh7ARq6qMOCCXD S21sec with the source code, including any data collected, of this Web site for analysis to help prevent further phishing schemes. If any customer data has been collected, it will be forwarded to BBVA so that they may notify their customers regarding this issue and take other appropriate actions as needed.
http://www.s21sec.com/servicios.aspx?sec=52&apr=54&HIVEDATA=dW2z6ApWhngR9FW UgvEY10RqCHWnVY0lTdLS%2FaGjop%2FvfsfiJElKFRxQoLWWZ0mNDnqO3aXWaOJT720m%2BvWsG kb9wO%2F%2BFfuTN5uRiEmtYmrvoPnNGHhh7ARq6qMOCCXD S21sec is the leading company specialized in computer security services. It was founded in 2000 with the aim of preventing and managing organization risks and people in the digital world.
Please contact us if any further information is required to expedite the process of removing this Web site from service. If needed, forward this e-mail and request to the appropriate contact that is able to deactivate this site.
Good day,
Un fortunately we have discovered a second phishing within the same IP which is:
http://217.108.248.234/local_bdnoa/bbx/index.html
Please, there are two different fraudulent URLs which are creating many trouble to customer of BBVA Bank, therefore we need you immediate collaboration to take them down in the shortest time.
Thank you very much for your information.
Kind regards.
Team SOC
S21SEC
----------------------------------------------------- --------------------------------------
To Whom It May Concern,
http://www.s21sec.com/servicios.aspx?sec=52&apr=54&HIVEDATA=dW2z6ApWhngR9FW UgvEY10RqCHWnVY0lTdLS%2FaGjop%2FvfsfiJElKFRxQoLWWZ0mNDnqO3aXWaOJT720m%2BvWsG kb9wO%2F%2BFfuTN5uRiEmtYmrvoPnNGHhh7ARq6qMOCCXD S21sec has been informed that there is currently a website hosted by your company that is involved in a phishing scheme to obtain personal account information from the customers of BBVA. http://www.s21sec.com/servicios.aspx?sec=52&apr=54&HIVEDATA=dW2z6ApWhngR9FW UgvEY10RqCHWnVY0lTdLS%2FaGjop%2FvfsfiJElKFRxQoLWWZ0mNDnqO3aXWaOJT720m%2BvWsG kb9wO%2F%2BFfuTN5uRiEmtYmrvoPnNGHhh7ARq6qMOCCXD S21sec has received numerous complaints and e-mails regarding the Web site listed below:
http://217.108.248.234/local_bdno/bbx/index.html
The web IP: http://217.108.248.234/ shows a Fedora Test Page.
We enclose below the legitimate url for BBVA: http://www.bbva.es http://www.bbva.es
According to published WHOIS and DNS data, the Web Site involved is owned and hosted by:
Address lookup
lookup failed
217.108.248.234
Could not find a domain name corresponding to this IP address.
Domain Whois record
Don't have a domain name for which to get a record
Network Whois record
Queried whois.ripe.net with "-B 217.108.248.234"...
% Information related to '217.108.248.232 - 217.108.248.239'
inetnum: 217.108.248.232 - 217.108.248.239
netname: FR-LA-RESERVE-A-RAMATUELLE
country: FR
descr: Interconnection with RAEI backbone
admin-c: VD1393-RIPE
tech-c: VD1393-RIPE
status: ASSIGNED PA
mnt-by: RAIN-TRANSPAC
changed: gestip.rain@orange-ftgroup.com 20091009
source: RIPE
person: Vincent DG
address: CHEMDE LA QUESSINE 83350 RAMATUELLE
phone: +33 494791428
e-mail: vincent.dg@lareserve-ramatuelle.com
nic-hdl: VD1393-RIPE
mnt-by: RAIN-TRANSPAC
changed: gestip.rain@orange-ftgroup.com 20091009
source: RIPE
% Information related to '217.108.0.0/16AS3215'
route: 217.108.0.0/16
descr: RAIN
descr: Reseaux d'Acces a l'INternet
remarks: -------------------------------------------
remarks: For Hacking, Spamming or Security problems
remarks: send mail abuse@orange-business.com
remarks: -------------------------------------------
origin: AS3215
mnt-by: RAIN-TRANSPAC
changed: gestip.rain@orange-ftgroup.com 20070910
source: RIPE
-- end --
On behalf of BBVA, http://www.s21sec.com/servicios.aspx?sec=52&apr=54&HIVEDATA=dW2z6ApWhngR9FW UgvEY10RqCHWnVY0lTdLS%2FaGjop%2FvfsfiJElKFRxQoLWWZ0mNDnqO3aXWaOJT720m%2BvWsG kb9wO%2F%2BFfuTN5uRiEmtYmrvoPnNGHhh7ARq6qMOCCXD S21sec requests that the Web site(s) listed above be deactivated and the domain name removed from your servers. BBVA would like you to provide http://www.s21sec.com/servicios.aspx?sec=52&apr=54&HIVEDATA=dW2z6ApWhngR9FW UgvEY10RqCHWnVY0lTdLS%2FaGjop%2FvfsfiJElKFRxQoLWWZ0mNDnqO3aXWaOJT720m%2BvWsG kb9wO%2F%2BFfuTN5uRiEmtYmrvoPnNGHhh7ARq6qMOCCXD S21sec with the source code, including any data collected, of this Web site for analysis to help prevent further phishing schemes. If any customer data has been collected, it will be forwarded to BBVA so that they may notify their customers regarding this issue and take other appropriate actions as needed.
http://www.s21sec.com/servicios.aspx?sec=52&apr=54&HIVEDATA=dW2z6ApWhngR9FW UgvEY10RqCHWnVY0lTdLS%2FaGjop%2FvfsfiJElKFRxQoLWWZ0mNDnqO3aXWaOJT720m%2BvWsG kb9wO%2F%2BFfuTN5uRiEmtYmrvoPnNGHhh7ARq6qMOCCXD S21sec is the leading company specialized in computer security services. It was founded in 2000 with the aim of preventing and managing organization risks and people in the digital world.
Please contact us if any further information is required to expedite the process of removing this Web site from service. If needed, forward this e-mail and request to the appropriate contact that is able to deactivate this site.
Good day,
Un fortunately we have discovered a third phishing site within the same IP which is:
http://217.108.248.234/local_bdnob/bbx/index.html http://217.108.248.234/local_bdnob/bbx/index.html
Please, there are two different fraudulent URLs which are creating many trouble to customer of BBVA Bank, therefore we need you immediate collaboration to take them down in the shortest time.
Thank you very much for your information.
Kind regards.
Team SOC
S21SEC
----------------------------------------------------- --------------------------------------
To Whom It May Concern,
http://www.s21sec.com/servicios.aspx?sec=52&apr=54&HIVEDATA=dW2z6ApWhngR9FW UgvEY10RqCHWnVY0lTdLS%2FaGjop%2FvfsfiJElKFRxQoLWWZ0mNDnqO3aXWaOJT720m%2BvWsG kb9wO%2F%2BFfuTN5uRiEmtYmrvoPnNGHhh7ARq6qMOCCXD S21sec has been informed that there is currently a website hosted by your company that is involved in a phishing scheme to obtain personal account information from the customers of BBVA. http://www.s21sec.com/servicios.aspx?sec=52&apr=54&HIVEDATA=dW2z6ApWhngR9FW UgvEY10RqCHWnVY0lTdLS%2FaGjop%2FvfsfiJElKFRxQoLWWZ0mNDnqO3aXWaOJT720m%2BvWsG kb9wO%2F%2BFfuTN5uRiEmtYmrvoPnNGHhh7ARq6qMOCCXD S21sec has received numerous complaints and e-mails regarding the Web site listed below:
http://217.108.248.234/local_bdno/bbx/index.html
The web IP: http://217.108.248.234/ shows a Fedora Test Page.
We enclose below the legitimate url for BBVA: http://www.bbva.es http://www.bbva.es
According to published WHOIS and DNS data, the Web Site involved is owned and hosted by:
Address lookup
lookup failed
217.108.248.234
Could not find a domain name corresponding to this IP address.
Domain Whois record
Don't have a domain name for which to get a record
Network Whois record
Queried whois.ripe.net with "-B 217.108.248.234"...
% Information related to '217.108.248.232 - 217.108.248.239'
inetnum: 217.108.248.232 - 217.108.248.239
netname: FR-LA-RESERVE-A-RAMATUELLE
country: FR
descr: Interconnection with RAEI backbone
admin-c: VD1393-RIPE
tech-c: VD1393-RIPE
status: ASSIGNED PA
mnt-by: RAIN-TRANSPAC
changed: gestip.rain@orange-ftgroup.com 20091009
source: RIPE
person: Vincent DG
address: CHEMDE LA QUESSINE 83350 RAMATUELLE
phone: +33 494791428
e-mail: vincent.dg@lareserve-ramatuelle.com
nic-hdl: VD1393-RIPE
mnt-by: RAIN-TRANSPAC
changed: gestip.rain@orange-ftgroup.com 20091009
source: RIPE
% Information related to '217.108.0.0/16AS3215'
route: 217.108.0.0/16
descr: RAIN
descr: Reseaux d'Acces a l'INternet
remarks: -------------------------------------------
remarks: For Hacking, Spamming or Security problems
remarks: send mail abuse@orange-business.com
remarks: -------------------------------------------
origin: AS3215
mnt-by: RAIN-TRANSPAC
changed: gestip.rain@orange-ftgroup.com 20070910
source: RIPE
-- end --
On behalf of BBVA, http://www.s21sec.com/servicios.aspx?sec=52&apr=54&HIVEDATA=dW2z6ApWhngR9FW UgvEY10RqCHWnVY0lTdLS%2FaGjop%2FvfsfiJElKFRxQoLWWZ0mNDnqO3aXWaOJT720m%2BvWsG kb9wO%2F%2BFfuTN5uRiEmtYmrvoPnNGHhh7ARq6qMOCCXD S21sec requests that the Web site(s) listed above be deactivated and the domain name removed from your servers. BBVA would like you to provide http://www.s21sec.com/servicios.aspx?sec=52&apr=54&HIVEDATA=dW2z6ApWhngR9FW UgvEY10RqCHWnVY0lTdLS%2FaGjop%2FvfsfiJElKFRxQoLWWZ0mNDnqO3aXWaOJT720m%2BvWsG kb9wO%2F%2BFfuTN5uRiEmtYmrvoPnNGHhh7ARq6qMOCCXD S21sec with the source code, including any data collected, of this Web site for analysis to help prevent further phishing schemes. If any customer data has been collected, it will be forwarded to BBVA so that they may notify their customers regarding this issue and take other appropriate actions as needed.
http://www.s21sec.com/servicios.aspx?sec=52&apr=54&HIVEDATA=dW2z6ApWhngR9FW UgvEY10RqCHWnVY0lTdLS%2FaGjop%2FvfsfiJElKFRxQoLWWZ0mNDnqO3aXWaOJT720m%2BvWsG kb9wO%2F%2BFfuTN5uRiEmtYmrvoPnNGHhh7ARq6qMOCCXD S21sec is the leading company specialized in computer security services. It was founded in 2000 with the aim of preventing and managing organization risks and people in the digital world.
Please contact us if any further information is required to expedite the process of removing this Web site from service. If needed, forward this e-mail and request to the appropriate contact that is able to deactivate this site.
Good day,
Un fortunately we have discovered a fourth phishing site within the same IP which is:
http://217.108.248.234/local_bdnoc/bbx/index.html http://217.108.248.234/local_bdnoc/bbx/index.html
Please, there are two different fraudulent URLs which are creating many trouble to customer of BBVA Bank, therefore we need you immediate collaboration to take them down in the shortest time.
Thank you very much for your information.
Kind regards.
Team SOC
S21SEC
----------------------------------------------------- --------------------------------------
To Whom It May Concern,
http://www.s21sec.com/servicios.aspx?sec=52&apr=54&HIVEDATA=dW2z6ApWhngR9FW UgvEY10RqCHWnVY0lTdLS%2FaGjop%2FvfsfiJElKFRxQoLWWZ0mNDnqO3aXWaOJT720m%2BvWsG kb9wO%2F%2BFfuTN5uRiEmtYmrvoPnNGHhh7ARq6qMOCCXD S21sec has been informed that there is currently a website hosted by your company that is involved in a phishing scheme to obtain personal account information from the customers of BBVA. http://www.s21sec.com/servicios.aspx?sec=52&apr=54&HIVEDATA=dW2z6ApWhngR9FW UgvEY10RqCHWnVY0lTdLS%2FaGjop%2FvfsfiJElKFRxQoLWWZ0mNDnqO3aXWaOJT720m%2BvWsG kb9wO%2F%2BFfuTN5uRiEmtYmrvoPnNGHhh7ARq6qMOCCXD S21sec has received numerous complaints and e-mails regarding the Web site listed below:
http://217.108.248.234/local_bdno/bbx/index.html http://217.108.248.234/local_bdnob/bbx/index.html http://217.108.248.234/local_bdnoa/bbx/index.html
The web IP: http://217.108.248.234/ shows a Fedora Test Page.
We enclose below the legitimate url for BBVA: http://www.bbva.es http://www.bbva.es
According to published WHOIS and DNS data, the Web Site involved is owned and hosted by:
Address lookup
lookup failed
217.108.248.234
Could not find a domain name corresponding to this IP address.
Domain Whois record
Don't have a domain name for which to get a record
Network Whois record
Queried whois.ripe.net with "-B 217.108.248.234"...
% Information related to '217.108.248.232 - 217.108.248.239'
inetnum: 217.108.248.232 - 217.108.248.239
netname: FR-LA-RESERVE-A-RAMATUELLE
country: FR
descr: Interconnection with RAEI backbone
admin-c: VD1393-RIPE
tech-c: VD1393-RIPE
status: ASSIGNED PA
mnt-by: RAIN-TRANSPAC
changed: gestip.rain@orange-ftgroup.com 20091009
source: RIPE
person: Vincent DG
address: CHEMDE LA QUESSINE 83350 RAMATUELLE
phone: +33 494791428
e-mail: vincent.dg@lareserve-ramatuelle.com
nic-hdl: VD1393-RIPE
mnt-by: RAIN-TRANSPAC
changed: gestip.rain@orange-ftgroup.com 20091009
source: RIPE
% Information related to '217.108.0.0/16AS3215'
route: 217.108.0.0/16
descr: RAIN
descr: Reseaux d'Acces a l'INternet
remarks: -------------------------------------------
remarks: For Hacking, Spamming or Security problems
remarks: send mail abuse@orange-business.com
remarks: -------------------------------------------
origin: AS3215
mnt-by: RAIN-TRANSPAC
changed: gestip.rain@orange-ftgroup.com 20070910
source: RIPE
-- end --
On behalf of BBVA, http://www.s21sec.com/servicios.aspx?sec=52&apr=54&HIVEDATA=dW2z6ApWhngR9FW UgvEY10RqCHWnVY0lTdLS%2FaGjop%2FvfsfiJElKFRxQoLWWZ0mNDnqO3aXWaOJT720m%2BvWsG kb9wO%2F%2BFfuTN5uRiEmtYmrvoPnNGHhh7ARq6qMOCCXD S21sec requests that the Web site(s) listed above be deactivated and the domain name removed from your servers. BBVA would like you to provide http://www.s21sec.com/servicios.aspx?sec=52&apr=54&HIVEDATA=dW2z6ApWhngR9FW UgvEY10RqCHWnVY0lTdLS%2FaGjop%2FvfsfiJElKFRxQoLWWZ0mNDnqO3aXWaOJT720m%2BvWsG kb9wO%2F%2BFfuTN5uRiEmtYmrvoPnNGHhh7ARq6qMOCCXD S21sec with the source code, including any data collected, of this Web site for analysis to help prevent further phishing schemes. If any customer data has been collected, it will be forwarded to BBVA so that they may notify their customers regarding this issue and take other appropriate actions as needed.
http://www.s21sec.com/servicios.aspx?sec=52&apr=54&HIVEDATA=dW2z6ApWhngR9FW UgvEY10RqCHWnVY0lTdLS%2FaGjop%2FvfsfiJElKFRxQoLWWZ0mNDnqO3aXWaOJT720m%2BvWsG kb9wO%2F%2BFfuTN5uRiEmtYmrvoPnNGHhh7ARq6qMOCCXD S21sec is the leading company specialized in computer security services. It was founded in 2000 with the aim of preventing and managing organization risks and people in the digital world.
Please contact us if any further information is required to expedite the process of removing this Web site from service. If needed, forward this e-mail and request to the appropriate contact that is able to deactivate this site.
On 09/04/2010 02:18 AM, Antiphishing wrote:
To Whom It May Concern,
S21sec http://www.s21sec.com/servicios.aspx?sec=52&apr=54&HIVEDATA=dW2z6ApWhngR9FWUgvEY10RqCHWnVY0lTdLS%2FaGjop%2FvfsfiJElKFRxQoLWWZ0mNDnqO3aXWaOJT720m%2BvWsGkb9wO%2F%2BFfuTN5uRiEmtYmrvoPnNGHhh7ARq6qMOCCXD has been informed that there is currently a website hosted by your company that is involved in a phishing scheme to obtain personal account information from the customers of BBVA. S21sec http://www.s21sec.com/servicios.aspx?sec=52&apr=54&HIVEDATA=dW2z6ApWhngR9FWUgvEY10RqCHWnVY0lTdLS%2FaGjop%2FvfsfiJElKFRxQoLWWZ0mNDnqO3aXWaOJT720m%2BvWsGkb9wO%2F%2BFfuTN5uRiEmtYmrvoPnNGHhh7ARq6qMOCCXD has received numerous complaints and e-mails regarding the Web site listed below:
http://217.108.248.234/local_bdno/bbx/index.html
The web IP: http://217.108.248.234/ shows a Fedora Test Page.
To whom it may concern at S21sec,
That website is not hosted by our company. Fedora is a popular Linux distribution, and whomever set up that website used Fedora as their operating system platform.
If you had bothered to actually look at the IP, you'd have been able to figure out that it falls in this block:
inetnum: 217.108.248.232 - 217.108.248.239 netname: FR-LA-RESERVE-A-RAMATUELLE country: FR descr: Interconnection with RAEI backbone admin-c: VD1393-RIPE tech-c: VD1393-RIPE status: ASSIGNED PA mnt-by: RAIN-TRANSPAC source: RIPE # Filtered
person: Vincent DG address: CHEMDE LA QUESSINE 83350 RAMATUELLE phone: +33 494791428 e-mail: vincent.dg@lareserve-ramatuelle.com nic-hdl: VD1393-RIPE mnt-by: RAIN-TRANSPAC source: RIPE # Filtered
% Information related to '217.108.0.0/16AS3215'
route: 217.108.0.0/16 descr: RAIN descr: Reseaux d'Acces a l'INternet remarks: ------------------------------------------- remarks: For Hacking, Spamming or Security problems remarks: send mail abuse@orange-business.com remarks: ------------------------------------------- origin: AS3215 mnt-by: RAIN-TRANSPAC source: RIPE # Filtered
Then, you'd know where to correctly send this information.
Please make a note of this for the future.
Thanks,
Tom Callaway, Fedora Admin
mirror-admin@lists.fedoraproject.org
-
Antiphishing -
Tom Callaway