Phisher has left his PC wide open!

[Chimple]

I've just received a phising email, the dozy bugger hasn't secured his computer!

Its running XAMPP, does anybody want the details, if they know how to cause him grief?

[pikey]

You don't think it's a drone then?

[Chimple]

tbh, I have no idea what or who it is, never heard of a drone in this case!

Theres nothing else on there, although it does look like its emailing the users details to
a gmail account.

Have a look :

http://218.28.27.246/xampp/img/new1.pwww.nationwide.co.uk/

Edit: that should be http://218.28.27.246/xampp/img/

new1.png

/www.nationwide.co.uk

Getting fed up of changing it now!

Edited by Chimple on Thursday 2nd November 14:34

[ThePassenger]

Chimple said:

tbh, I have no idea what or who it is, never heard of a drone in this case!

Basically 'drone' or 'Zombie' system. It could be someones hijacked system that he's using.

www.apachefriends.org/en/xampp.html

Yep it's a rootkitted zombie machine, running Linux.

Edited by ThePassenger on Thursday 2nd November 14:46

[Chimple]

ThePassenger said:

Basically 'drone' or 'Zombie' system. It could be someones hijacked system that he's using.

That thought did occur to me, but theres nothing I can do anyway!

Its been up for about 7 hours, and there doesn't seem to be much there!

I've contacted gmail and just hope that they can intercept any bank details that somebody does send.

[aldi]

I must say, I'm having great fun typing lots of rude words into the form

[tank slapper]

Firefox 2 pops up with a phishing warning as soon as I click on that link.

[Chimple]

aldi said:

I must say, I'm having great fun typing lots of rude words into the form

Thats just what I do!!

I wonder if gmail will let him in to view our abuse!

Internet Exploder never warned me...maybe I should see what this firefox is like.

[beanbag]

FTP into his server!!!!

ftp host: 218.28.27.246
username: nobody
password: lampp

This guy is such an idiot!!!

[beanbag]

Alternatively, log into his server config: http://218.28.27.246/xampp/

[Fer]

I have this one... bounced it to [e-mail], but heard nothing back.

[aldi]

beanbag said:

FTP into his server!!!!

ftp host: 218.28.27.246
username: nobody
password: lampp

This guy is such an idiot!!!

Can you delete the phishing site?

Edit: Lol http://218.28.27.246/xampp/phonebook.

Edited by aldi on Friday 3rd November 13:45

[timsta]

aldi said:

Edit: Lol http://218.28.27.246/xampp/phonebook.

Tee-hee!

[BliarOut]

beanbag said:

FTP into his server!!!!

ftp host: 218.28.27.246
username: nobody
password: lampp

This guy is such an idiot!!!

And it's read/write access... I would imagine

[BliarOut]

http://218.28.27.246/xampp/phpinfo.ph

Someone have a play, that's what you've got to use

[aldi]

Just tried to rename the nationwide folder, but computer sez no Come on someone here must be 1337 enough!

f*ck it, just fired off an email to the whois contacts... of course this means that I'l be going directly to a chinese jail now

Edited by aldi on Friday 3rd November 19:39

[ThePassenger]

And is dead.