CastleCops, Internet Crime Fighters
Need help? Click here to register for free! Absolutely zero advertisements on this site!

Donation/Premium
spacer
block bottom
Security Central
spacer
· Home
· PIRT/Fried Phish
· MIRT
· SIRT
· Deutsch
· Wiki
· Newsletter
· O16/ActiveX
· CLSID List
· Contest2007
· Downloads
· Feedback (send)
· Forums
· HijackThis
· Hijacktrend
· LSPs
· My Downloads
· O18
· O20
· O21
· O22
· O23
· O9
· Premium
· Private Messages
· Proxomitron
· Reviews
· Search
· StartupList
· Stories Archive
· Submit News
· WsIRT
· Your Account
· Acceptable Use Policy
block bottom
spacer spacer PIRT Squad

Fried Phish(TM)

Phishing Incident Reporting and Termination (PIRT) Squad(SM)

A global phishing termination and intelligence system operated by CastleCops. Become a PIRT Squad terminator by reporting phish today!

[ How-To / FAQ ]

Fried Phish -> Confirmed Phish | Terminated Phish


status: terminated

HTTP Response
10 Oct, 2008
05:40:23
HTTP/1.1 404 Not Found
ID986143 (termination link)
TitleAbbey Bank, EGG, Halifax, IRS, Wells Fargo
Entry
PIRT Squad
Reporter
Submitted anonymously thru the web, or sent to pirt (at) castlecops (dot) com.
Timestamp06 Oct, 2008 @ 16:24:52
Topic ID227208 - Read/respond to PIRT commentary.
Handler Note:
06 Oct, 2008
17:38:20
downie: Consumed following related reports:

[985998] http://www.photosview.net/bbs/icon/halifana/online/www.halifax-online.co.uk
Handler Note:
06 Oct, 2008
17:41:37
downie: The URL accesses an Egg phishing site, active at the time of investigation.
A page fetch was successful.
Handler Note:
06 Oct, 2008
17:45:47
downie: View CIDR AS4670 Report: http://www.cidr-report.org/cgi-bin/as-report?as=4670

"4670 | KR | apnic | 1995-06-16 | HYUNDAI-KR Shinbiro"

Handler Note:
06 Oct, 2008
17:45:47
downie: Extended information for AS4670:
State/Province:
Country:
Responsible Domain: shinbiro.com
Abuse Email: abuse@shinbiro.com
Handler Note:
06 Oct, 2008
19:16:38
downie: Abbey Bank phish at
http://www.photosview.net/bbs/data/abd.php
More Egg phish at
http://www.photosview.net/bbs/data/newegg.php
http://www.photosview.net/bbs/icon/eyin/new.egg.com/customer/youraccounts/Login.htm
Wells Fargo phish at
http://www.photosview.net/bbs/www.wellsfargo.com/wellsfargo/wellsfargo/
Halifax phish at
http://www.photosview.net/bbs/icon/halifana/online/www.halifax-online.co.uk/_mem_/formslogin.asp/
IRS phish at
http://www.photosview.net/bbs/data/essay/secure/online_form/www.irs.gov/0,,id=96596,00.html
Handler Note:
06 Oct, 2008
19:38:11
downie: Generated and sent email phish alert to respective parties.
Handler Note:
06 Oct, 2008
23:15:51
downie: New Halifax kit at
http://www.photosview.net/plus/pack/lifan/online/www.halifax-online.co.uk/_mem_/formslogin.asp/
Handler Note:
09 Oct, 2008
19:10:06
downie: New IRS phish at
http://www.photosview.net/plus/stimulus.refund/0,,id=181665,00.html
http://www.photosview.net/plus/stimulus.refund/return/0,,id=96596,00.html
New Lloyds TSB phish at
http://www.photosview.net/plus/conf/db/soa/online.lloydstsb.co.uk/
New Wells Fargo phish
http://www.photosview.net/bbs/www.wellsfargo.com/update-wells-info/update-wells-info/
New Egg phish at
http://www.photosview.net/plus/lib/eyin/new.egg.com/customer/youraccounts/Login.htm
New Halifax phish at
http://www.photosview.net/plus/lib/halifana/online/www.halifax-online.co.uk/_mem_/formslogin.asp/
http://www.photosview.net/plus/member/halifana/online/www.halifax-online.co.uk/_mem_/formslogin.asp/
Handler Note:
11 Oct, 2008
04:02:40
downie: 404
Fetched URLs
Slaves985998,

Report for at 06 Oct, 2008 @ 17:38:20


fetched page

at 06 Oct, 2008 @ 17:41:41
MD5 Fingerprint: ff0d9b17e0e34d060a07a06cc073dd8e
SHA1 Fingerprint: 1e01d87c046ec9de8516c9cf82d5d19ba6ca84ce

fetched page

at 06 Oct, 2008 @ 17:44:58
MD5 Fingerprint: 99376cff14c46c6173e1fcb3100250b3
SHA1 Fingerprint: 63b117cd84252c2466c13c966ff9404618894204

fetched page

at 06 Oct, 2008 @ 19:16:40
MD5 Fingerprint: 32b916e959e70f543cdaeb48b038bffc
SHA1 Fingerprint: b4650217e1fb5525a70fbb8b4af994450244ecdb