#fibank

[spamreports]

ФИБАНК фишинг | FIBANK phishing

Refund ID:125-510-11

национална агенция за приходите на българия

Получихте 210 лв. Възстановяване на данък

попълнете начина си на плащане

Този процес може да отнеме 5-10 дни. Моля, щракнете върху връзката по-долу и изберете начина си на плащане на възстановяване.

⚠ /refactory-antiques.jp/wordpress/wp-includes/fonts/

☣ AS7506 [157.7.107.102] 🇯🇵

🖧 @GMOGroup INTERQ GMO Internet,Inc, JP 🌐 @muumuu_domain 🔐 @letsencrypt

[spamreports]

ФиБанк phishing

https://securitytrails.com/list/ip/162.213.255.54

[spamreports]

ФиБанк Фишинг

Phishing attack against Bulgarian Първа Инвестиционна банк

Г

[spamreports]

🎯 @fibank

⚠ https­://maildominiwe-com­.umbler­.net/fibank/user/account/ TLD @umbler @publicdomainregistry

VPS @redehost  [177.55.116.76] 🇧🇷

#phishing

Fake @umbler generic auto reply: 𝐼𝑛𝑣𝑒𝑠𝑡𝑖𝑔𝑎𝑡𝑒𝑑 𝑎𝑛𝑑 𝑟𝑒𝑚𝑜𝑣𝑒𝑑. 𝑇ℎ𝑎𝑛𝑘 𝑦𝑜𝑢 𝑓𝑜𝑟 𝑦𝑜𝑢𝑟 𝑐𝑜𝑙𝑙𝑎𝑏𝑜𝑟𝑎𝑡𝑖𝑜𝑛. 𝐴𝑡𝑡, 𝐴𝑏𝑢𝑠𝑒 𝑇𝑒𝑎𝑚 𝑈𝑚𝑏𝑙𝑒𝑟

[spamreports]

🎣 kit 🎯 @fibank ⚠ https­://fujiharasho.mixh.jp/service-fuji.com/upstart/request/star/inv/account/ ☣ AS7506[150.95.55.147] 🇯🇵

VPS @GMO_Group TLS @sectigostore @cpanel Domain azpocket.co.jp EXFIL [email protected]

[spamreports]

https://fbnk·bg-supervisor·cnfg·ld-details·net·mydogstuff·pw/bg/account/

Mail body

Имаме нужда от твоята помощ Уважаеми потребители Наскоро профилът ви беше маркиран поради потенциална връзка с някои измамни сделки. За да избегнете евентуално ограничение на вашия акаунт моля, потвърдете информацията си, като влезете в нашия мениджър по съдебни дела. потвърдете сега

Site

Email

sent using -[Th3 K!ng Ayoub V2.0=-

[spamreports]

тоя си е казал 'ей уикенда ще пратя спама за по-ефективно' хахахахахахахахаха Main URL https://beamillionaire·mobi/wp-content/uploads/2019/08/paff·php Leads to https://www·cuscoterratravel·com/wp-includes/certificates/bg/account/

From - Sat Aug 31 09:27:31 2019 X-Account-Key: account3 X-UIDL: 1042748947.53067 X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 X-Mozilla-Keys: Return-Path: Received: from mx4.mail.bg ([unix socket]) by stor3 (Cyrus 2.5.10-Debian-2.5.10-3) with LMTPA; Sat, 31 Aug 2019 09:17:49 +0300 X-Sieve: CMU Sieve 2.4 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on stor3.stor3 X-Spam-Level: ** X-Spam-Status: No, score=2.4 required=5.0 tests=BAYES_50,DKIM_ADSP_NXDOMAIN, DKIM_SIGNED,DKIM_VALID,HTML_MESSAGE,MIME_HTML_ONLY shortcircuit=no autolearn=no autolearn_force=no version=3.4.2 Received-SPF: none (sav.saversuper.info: No applicable sender policy available) receiver=mx4.mail.bg; identity=mailfrom; envelope-from="[email protected]"; helo=sav.saversuper.info; client-ip=216.172.179.34 Authentication-Results: mx4.mail.bg; dkim=pass (1024-bit key) [email protected]; dkim-adsp=nxdomain Received: from sav.saversuper.info (sav.saversuper.info [216.172.179.34]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.mail.bg (Postfix) with ESMTPS id 9F4EB678FA for <@mail.bg>; Sat, 31 Aug 2019 09:17:48 +0300 (EEST) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=bestmarketing.mobi; s=default; h=Date:Message-Id:From:Content-type: MIME-Version:Subject:To:Sender:Reply-To:Cc:Content-Transfer-Encoding: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=o5ExusuEujMbFzk8pFr3Uw8uDcrf6ei2JkumfAWs5Ro=; b=mfE/cY/eQDbYqFT4c7i+fPYiB HSWezJQWVJMHQiMlEpoNrGhZNSqNeFoht2dFJ6p3cEp//Tw2Jh48NTeVFyBleT146G4UC98iBux3R 7bgtCm7zJzmes218WQKfsbO2D4cYEljYCa+UFdGu4aacn52d2I1R+RdXAAh/gGXmf7Jvk=; Received: from bestmar by sav.saversuper.info with local (Exim 4.92) (envelope-from ) id 1i3whn-0003PQ-0u for @mail.bg; Sat, 31 Aug 2019 01:17:47 -0500 To: @mail.bg Subject: Account - Alert ( Reference #: 0967133 ) X-PHP-Script: bestmarketing.mobi/wp-content/plugins/qbbdxsl/mailer1.php for 160.159.150.75 MIME-Version: 1.0 Content-type: text/html; charset=iso-8859-1 From: fibank Message-Id: Date: Sat, 31 Aug 2019 01:17:47 -0500 X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - sav.saversuper.info X-AntiAbuse: Original Domain - mail.bg X-AntiAbuse: Originator/Caller UID/GID - [508 501] / [47 12] X-AntiAbuse: Sender Address Domain - sav.saversuper.info X-Get-Message-Sender-Via: sav.saversuper.info: authenticated_id: bestmar/only user confirmed/virtual account not confirmed X-Authenticated-Sender: sav.saversuper.info: bestmar X-Source: /opt/cpanel/ea-php56/root/usr/bin/php-cgi X-Source-Args: /opt/cpanel/ea-php56/root/usr/bin/php-cgi /home/bestmar/public_html/wp-content/plugins/qbbdxsl/mailer1.php X-Source-Dir: bestmarketing.mobi:/public_html/wp-content/plugins/qbbdxsl

[spamreports]

Fi (first investment) Bank phishing - фи банк, ама не баш

Report sent to hostmaster:

Tha bank's IT team was notified of the phishing campaign:

Change interpuncts (·) to dots (.) for the real link:

http://sqfsqfsqfsqfsqf·zzz·com·ua/go·php

From - Tue Aug  7 07:17:17 2018 X-Account-Key: account3 X-UIDL: 1042748947.46542 X-Mozilla-Status: 1001 X-Mozilla-Status2: 00000000 X-Mozilla-Keys:                                                                                 Return-Path: <[email protected]> Received: from Cluster ([10.0.0.121]) by stor6 (Cyrus v2.4.16-Debian-2.4.16-4+deb7u1) with LMTPA; Tue, 07 Aug 2018 01:23:33 +0300 X-Sieve: CMU Sieve 2.4 Received-SPF: none (ubuntu-s-1vcpu-1gb-nyc1-01.localdomain: No applicable sender policy available) receiver=mx5.mail.bg; identity=mailfrom; envelope-from="[email protected]"; helo=ubuntu-s-1vcpu-1gb-nyc1-01.localdomain; client-ip=206.189.204.70 Received: from ubuntu-s-1vcpu-1gb-nyc1-01.localdomain (unknown [206.189.204.70]) by mx5.mail.bg (Postfix) with ESMTP id 7D9C580945A3 for <>; Tue,  7 Aug 2018 01:23:33 +0300 (EEST) Received: by ubuntu-s-1vcpu-1gb-nyc1-01.localdomain (Postfix, from userid 33) id 83C5321097; Mon,  6 Aug 2018 22:16:12 +0000 (UTC) Date: Mon, 6 Aug 2018 22:16:12 +0000 To: From: =?utf-8?Q?Account=20Support?= <[email protected]> Subject: =?utf-8?Q?=32=35fibank=20=3a=20Notification=20=28=31=29=20=2e?= Message-ID: <[email protected]> X-Priority: 3 MIME-Version: 1.0 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 8bit X-DSPAM-Result: Whitelisted X-DSPAM-Processed: Tue Aug  7 01:23:33 2018 X-DSPAM-Confidence: 0.7791 X-DSPAM-Probability: 1.0000 X-DSPAM-Signature: 0,5b68ca65123101549411733 <p style="font-size: medium; font-family: 'Times New Roman'; white-space: normal; word-spacing: 0px; text-transform: none; font-weight: normal; color: #000000; font-style: normal; orphans: 2; widows: 2; letter-spacing: normal; text-indent: 0px; font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-style: initial; text-decoration-color: initial;"> </p> <table id="yui_3_16_0_1_1414805086466_7864" style="border-top: #dddece 4px solid; font-family: 'Times New Roman'; width: 600px; word-spacing: 0px; border-bottom: #999999 1px solid; text-transform: none; orphans: 2; widows: 2; letter-spacing: normal; text-indent: 0px; -webkit-text-stroke-width: 0px; text-decoration-style: initial; text-decoration-color: initial;" cellspacing="0" cellpadding="0"> <tbody id="yui_3_16_0_1_1414805086466_7863"> <tr id="yui_3_16_0_1_1414805086466_7862"> <td id="yui_3_16_0_1_1414805086466_7865" style="width: 62px;"> <div id="yiv5416493348c26img" style="margin-bottom: 15px; margin-left: 10px;"> </div> <p> </p> </td> <td id="yui_3_16_0_1_1414805086466_7861" style="font-size: 12px; font-family: arial, helvetica, sans-serif; vertical-align: top; text-align: right; padding-right: 5px;"> <table id="yiv5416493348layout" style="font-family: sans-serif, Arial, Verdana, 'Trebuchet MS'; width: 600px;" border="0" cellspacing="0" cellpadding="0"> <tbody id="yui_3_16_0_1_1414805086466_7854"> <tr id="yui_3_16_0_1_1414805086466_7853"> <td id="yui_3_16_0_1_1414805086466_7852" style="font-family: arial, helvetica, sans-serif; color: #000000;"> <div id="yui_3_16_0_1_1414805086466_7858" style="margin-bottom: 15px; margin-left: 0px;"> <h1 style="font-size: 19px; text-align: left; margin: 21px 0px 23px 10px;"><span style="font-size: 14px;"><span style="background-color: #fafafa; color: #001780;"><img src="https://my.fibank.bg/EBank/images/logo-en.png" alt="" width="157" height="50" /></span></span></h1> <h1 style="font-size: 19px; text-align: left; margin: 21px 0px 23px 10px;"><span style="font-size: 14px;"><span style="background-color: #fafafa; color: #001780;">Уважаеми клиенти ,</span></span></h1> <h1 style="font-size: 19px; text-align: left; margin: 21px 0px 23px 10px;"><span style="font-size: 14px;">Поради непрекъснатото надстройване на сигурността на Fibank,</span></h1> <h1 style="font-size: 19px; text-align: left; margin: 21px 0px 23px 10px;"><span style="font-size: 14px;">от всички клиенти се изисква да актуализират информацията си в новата база данни за защита ,за да позволят по-бързо, по-лесно и по-сигурно банково преживяване.</span></h1> <h1 style="font-size: 19px; text-align: left; margin: 21px 0px 23px 10px;"><span style="font-size: 14px;">Моля, следвайте връзката по-долу,<br style="font-size: 14px; font-family: sans-serif; white-space: normal; word-spacing: 0px; text-transform: none; font-weight: normal; color: #666666; font-style: normal; orphans: 2; widows: 2; letter-spacing: normal; background-color: #fafafa; text-indent: 0px; font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-style: initial; text-decoration-color: initial;" /></span></h1> <div id="yiv5416493348c11text" style="text-align: left; margin: 0px 0px 15px 10px;"><span style="font-size: 14px; color: #3366ff;"><a style="font-size: 12px; font-family: Arial; white-space: normal; word-spacing: 0px; text-transform: none; font-weight: normal; font-style: normal; orphans: 2; widows: 2; letter-spacing: normal; background-color: #fafafa; text-indent: 0px; font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; color: #3366ff;" href="http://sqfsqfsqfsqfsqf.zzz.com.ua/go.php"><strong>httpÑ•://my.fibаnk.bg/oаuth2-ѕеrvеr/#!/login?cliеnt_id=E_BANK</strong> </a></span></div> <div id="yiv5416493348c11text" style="text-align: left; margin: 0px 0px 15px 10px;"><span style="font-size: 14px;"><span style="font-size: 14px;">Искрено Ваш,</span></span></div> <div style="text-align: left; margin: 0px 0px 15px 10px;"><hr /></div> <div style="margin: 0px 0px 15px 10px; text-align: center;">© Първа инвестиционна банка 2009-2018. Всички права запазени.</div> </div> </td> </tr> </tbody> </table> </td> </tr> </tbody> </table>