Dear Sir / Madam,
This fraudulent Phishing site remains live and active, please take immediate action to remove this link and prevent any further fraudulent pages being added to this domain.
Regards,
Manager, Technical Investigations HSBC Bank PLC Security and Fraud Risk Europe ______________________________
Email. abuse@hsbc.com
______________________________
__________________
Dear Sir/Madam,
We have been made aware of a spoof HSBC Bank web-site being hosted at ITRACO Ltd. The hosting IP address is 212.109.62.30 and the URL's are
http://duplo.itraco.com.ua/site/www.hsbc.co.uk/1/2/personal/internet-banking... http://duplo.itraco.com.ua/security/../site/www.hsbc.co.uk/1/2/personal/inte... http://duplo.itraco.com.ua/security/../site/www.hsbc.co.uk/
Please take immediate action to ensure that this rogue web site is shut down.
Screen shot of page displayed: -
(See attached file: 20090115-0001.GIF)
DNS Lookup: duplo.itraco.com.ua A record
Generated by www.DNSstuff.com at 03:10:58 GMT on 15 Jan 2009.
How I am searching:
Searching for duplo.itraco.com.ua A record at m.root-servers.net [202.12.27.33]: Got referral to NS-UA.RIPE.NET. (zone: ua.) [took 243 ms]
Searching for duplo.itraco.com.ua A record at NS-UA.RIPE.NET. [193.0.12.232]: Got referral to ns-he.kolo.net. (zone: com.ua.) [took 146 ms]
Searching for duplo.itraco.com.ua A record at ns-he.kolo.net. [216.218.215.2]: Got referral to ns.sovamua.com. (zone: itraco.com.ua.) [took 80 ms]
Searching for duplo.itraco.com.ua A record at ns.sovamua.com. [212.109.32.15]: Reports duplo.itraco.com.ua. [took 180 ms] Response: |--------------------------------+------+--------+--------+---------------------| | | | | | | | Domain | Type | Class | TTL | Answer | |--------------------------------+------+--------+--------+---------------------| | | | | | | |duplo.itraco.com.ua. |A |IN |43200 |212.109.62.30 | |--------------------------------+------+--------+--------+---------------------|
WHOIS - 212.109.62.30
Generated by www.DNSstuff.com
Location: Unknown |------------------------------------------------------------------------------| |Using 0 day old cached answer (or, you can get fresh results). | |Displaying E-mail address (use sparingly -- this will make it more likely that| |you will trigger our rate limiting system). | | | |% This is the RIPE Whois query server #2. | |% The objects are in RPSL format. | |% | |% Rights restricted by copyright. | |% See http://www.ripe.net/db/copyright.html | | | |% Information related to '212.109.62.24 - 212.109.62.31' | | | |inetnum: 212.109.62.24 - 212.109.62.31 | |netname: ITRACO-GTUA | |descr: ITRACO Ltd | |descr: 27-B, Konstantinovskaya st. | |descr: Kyiv | |country: UA | |admin-c: DP5439-RIPE | |tech-c: DP5439-RIPE | |status: ASSIGNED PA | |remarks: Please send abuse notification to abuse@svitonline.com | |notify: security@svitonline.com | |mnt-by: GTUA-WO-MNT | |changed: tanya@svitonline.com 20040419 | |changed: mtulyuk@goldentele.com 20071001 | |source: RIPE | | | |person: Dmitry Proskurin | |address: 27-B, Konstantinovskaya st. | |address: Kiev, 04071, Ukraine | |phone: +380 44 4906686 | |fax-no: +380 44 4906682 | |e-mail: admin@itraco.kiev.ua | |nic-hdl: DP5439-RIPE | |changed: tanya@svitonline.com 20001123 | |source: RIPE | | | |% Information related to '212.109.32.0/19AS12530' | | | |route: 212.109.32.0/19 | |descr: SOL Small Delegated Block | |origin: AS12530 | |notify: security@svitonline.com | |mnt-by: GTUA-RT-MNT | |changed: doka@kiev.sovam.com 19990710 | |changed: mtulyuk@goldentele.com 20070928 | |source: RIPE | |------------------------------------------------------------------------------|
Regards,
Manager, Technical Investigations HSBC Bank PLC Security and Fraud Risk Europe ______________________________
Email. abuse@hsbc.com
______________________________
************************************************************ HSBC Bank plc Registered Office: 8 Canada Square, London E14 5HQ Registered in England - Number 14259 Authorised and regulated by the Financial Services Authority ************************************************************
----------------------------------------- SAVE PAPER - THINK BEFORE YOU PRINT!
This E-mail is confidential.
It may also be legally privileged. If you are not the addressee you may not copy, forward, disclose or use any part of it. If you have received this message in error, please delete it and all copies from your system and notify the sender immediately by return E-mail.
Internet communications cannot be guaranteed to be timely secure, error or virus-free. The sender does not accept liability for any errors or omissions.
On Fri, 2009-01-16 at 11:10 +0000, abuse@hsbc.com wrote:
Dear Sir / Madam,
This fraudulent Phishing site remains live and active, please take immediate action to remove this link and prevent any further fraudulent pages being added to this domain.
Regards,
Manager, Technical Investigations HSBC Bank PLC Security and Fraud Risk Europe
That is a test page included with our operating system; we don't actually control the site in question. For more information, please refer to http://fedoraproject.org/wiki/ServerTestPage.
To determine the actual owner, you should look at the WHOIS report you were provided with.
websites@lists.fedoraproject.org