Attention: Ragecash And Extreme Paychecks Affiliates

[seeric]

If by any chance you get an email today from abuse@extremepaychecks or abuse@ragecash saying something like this:

The ragecash one looks the same as this one. Some idiot is trying to build themselves a nice affiliate DB looks like.


Dear Valued Member,

According to our terms of services, you will have to confirm your e-mail by the following link, or your account will be suspended within 24 hours for security reasons.

hxxp://www.extremepaychecks.com/confirm.php?account=yourname@y ourdomain.com

The link will be going to this location:
hxxp://161.246.71.20/Confirmation_Sheet.pif

After following the instructions in the sheet, your account will not be interrupted and will continue as normal.

Thank you for your attention to this request. We apologize for any inconvenience.

Sincerely, Extremepaychecks Abuse Department


DELETE THIS EMAIL AND DO NOT CLICK ON THE LINK !!!! THIS WAS NOT FROM US !!

Thanks

[BoyAlley]

Damn that's some shit! Adult phishing. Do they have no shame?

[MaddCaz]

Get Emmmm!!!!

[JFK]

Thanks for the warning

[seeric]

the subject line just says


KBip



thats it.

[Pete-KT]

Thats fucked up bro

[baddog]

I don't get it . . . don't they already have the database if they are sending the emails to your affiliates?

[Fetish Gimp]

Numeric url + pif file: warning flags should be going up and down your ass.

[jimthefiend]

Can't blame me for trying.

[seeric]

Originally Posted by Fetish Gimp

Numeric url + pif file: warning flags should be going up and down your ass.

they are.

one of the ip is in thailand.

trust me i've got a nice crew of people who love to play with this kind of stuff checking it out.

not sure exactly what they are trying to accomplish but i bet my guys find out.

i'm no brainiac with this, i just want my affils to know that some ass is messing with us and probably other proggies.

[Basic_man]

This kind of shit really sucks !

[fatal attraction]

Thanks for the warning. That's fucked up!

[madawgz]

Originally Posted by baddog

I don't get it . . . don't they already have the database if they are sending the emails to your affiliates?

true, where would they get the emails...

[seeric]

its some kind of worm or virus and we tracked it to the source.



this is the phish mail exactly word for word. still digging deeper.

http://www.millersmiles.co.uk/report/1294

Please send us any scam/phishing emails you have received by clicking here.

If you have received the email below, please remember that it is very common for these email scams to be redistributed at a later date with only slightly different content, such as a different subject or return address, or with the fake webpage(s) hosted on a different webserver.

We aim to report every variant of the scams we receive, so even if it appears that a scam you receive has already been reported, please submit it to us anyway.






ACCOUNT ALERT

Date Reported: 26th September 2005 Whats this? Risk Level: MEDIUM Whats this?

Details

Apparent Sender:
Aol - See all Aol phishing scams Whats this?
Return Address:
< [email protected] > Whats this?
Email Format: HTML Whats this?

URL of Web Content:
http://199.74.94.110:90/Confirmation_Sheet.pif Whats this?
Location:
US Whats this?

Comments:


* Email asks you to confirm/update/verify your account data at Aol by visiting the given link. You will be taken to a spoof website where your details will be captured for the phishers.


* Aol never send their users emails requesting personal details in this way.


* The REAL URL of the spoof website is disguised as "http://[email protected]/confirm. php?email=aol.com".


* The spoof website this email links to was not online at time of this report, but variations of the scam which link to working websites are bound to exist, so be wary! The website may have been taken down or disabled by the hosts, but quite often these websites are hosted on the personal computer of the phishers, so may only be online at certain times.


* The REAL URL of the spoof website looks nothing like the actual Aol URL.


Content

Email:

"According to our terms of services, you will have to confirm your e-mail by the following link or your account will be suspended within 24 hours for security reasons."

Dear Valued Member,

According to our terms of services, you will have to confirm your e-mail by the following link or your account will be suspended within 24 hours for security reasons.

http://[email protected]/confirm. php?email=aol.com

After following the instructions in the sheet, your account will not be interrupted and will continue as normal.

Thanks for your attention to this request. We apologize for any inconvenience.

Sincerely,Aol Security Department

Website:

Spoof website not online at time of report...


started as an aol problem, but looks as if people are adopting the work/virus from this aol phish campaign.

[seeric]

Originally Posted by madawgz

true, where would they get the emails...

heres what i think has happened.


i think they have harvested a bunch of boards and what not and snagged visible email addresses, i did not receive this email to my private registered accounts with rage and i have about 15. i only got it to the email addresses that i use on the boards. or, they are taken from any persons infected computers outlook address book. typical phishing shit.

i've asked several affils that i know if they received it and they said no. so, from what it looks like this ass may be just changing program names and sending to all public addresses that they have found.



this post is more precautionary and educational than anything else.

[Wizzo]

Damn that sucks...

[seeric]

Originally Posted by Wizzo

Damn that sucks...

we wont be the only ones this happens too. jsut wanted to put the research out there.

we're tracking the worm host now to see what to do with it. its def a BP and throwaway when necessary. for real there is no real information on there and the chances of the thailand hosting company helping isn't very good i'd imagine. if anything they'll dump him and he'll get a new account with a new green dot card or something.

i'd love to shove his worm up his ass.

[seeric]

Originally Posted by A1R3K

If by any chance you get an email today from abuse@extremepaychecks or abuse@ragecash saying something like this:

The ragecash one looks the same as this one. Some idiot is trying to build themselves a nice affiliate DB looks like.


Dear Valued Member,

According to our terms of services, you will have to confirm your e-mail by the following link, or your account will be suspended within 24 hours for security reasons.

hxxp://www.extremepaychecks.com/confirm.php?account=yourname@y ourdomain.com

The link will be going to this location:
hxxp://161.246.71.20/Confirmation_Sheet.pif

After following the instructions in the sheet, your account will not be interrupted and will continue as normal.

Thank you for your attention to this request. We apologize for any inconvenience.

Sincerely, Extremepaychecks Abuse Department


DELETE THIS EMAIL AND DO NOT CLICK ON THE LINK !!!! THIS WAS NOT FROM US !!

Thanks

one more thing that i would add to webmasters is, if in fact this is someone who really knows what they are doing and you do click on this link and expose yourself to this worm, god knows what you are opening up for this scumbag. there is a good chance that this person is an adult webmaster and may be looking to expoit your accounts in some way. the email addresses that we got these phishing emails from are not used outside of adult boards and affiliate programs. just be careful.

[gdog]

Damn boy that sucks that someone is pulling shit like that with your program

[seeric]

Originally Posted by gdog

Damn boy that sucks that someone is pulling shit like that with your program

not my program, i'm just the dog chained to the tree, but i'm still pissed about it.

[scottybuzz]

unlucky to whoevers program it is

[seeric]

Originally Posted by scottybuzz

unlucky to whoevers program it is

i basically say that because there are lots of people who nickle and dime every response and stuff around here so i like to keep them straight. do i care alot bout this? fuckin A right i'm pissed about this and we have located the culprit. pays to know certain people.

[xxxjay]

Thanks for the heads up dood!

[V_RocKs]

I love it when people try to take my money and can't even use English anywhere near correctly...

[Mr. Soul]

That's why you shouldn't sell or trade your webmaster database.

[seeric]

Originally Posted by Mr. Soul

That's why you shouldn't sell or trade your webmaster database.

if this was directed at me and made to insinuate that i have sold a database, re-read what i wrote aboove.

if you wrote this to start shit, read below.

you obviously didn't read what i wrote. no one hs my database. i'm no n00b that ses value in spamming webmasters. you must think i'm a complete idiot or something. spamming webmasters is worthless. why would i want to make a measily couple K and have the community pissed off at me. haha. some of you people doubt my intelligence.

[RogerV]

Thats nuts I get them for Paypal all the time