From: MADALINA MARIA MARGINEAN <madalinamaria.marginean.ext@telefonica.com>
To: "abuse@fuwafuwa.moe" <abuse@fuwafuwa.moe>
CC: DS_TSOL_phishing <phishing@telefonica.com>
Subject: We have detected that fuwafuwa.moe is hosting a fraudulent website
Thread-Topic: We have detected that fuwafuwa.moe is hosting a fraudulent website
Thread-Index: AdKBbXj5DH/5oMJPRDCOSwuktEss6Q==
Date: Tue, 7 Feb 2017 18:12:43 +0000
Message-ID: <DB4PR06MB29879D5887C12D7E25C18FCC9430@DB4PR06MB298.eurprd06.prod.outlook.com>
Accept-Language: en-US
Content-Language: es-ES
received-spf: None (protection.outlook.com: telefonica.com does not designate permitted sender hosts)
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: multipart/mixed; boundary="_004_DB4PR06MB29879D5887C12D7E25C18FCC9430DB4PR06MB298eurprd_"
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-originalarrivaltime: 07 Feb 2017 18:12:43.5762 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 9744600e-3e04-492e-baa1-25ec245c6f10
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB4PR06MB300

--_004_DB4PR06MB29879D5887C12D7E25C18FCC9430DB4PR06MB298eurprd_
Content-Type: multipart/alternative; boundary="_000_DB4PR06MB29879D5887C12D7E25C18FCC9430DB4PR06MB298eurprd_"

--_000_DB4PR06MB29879D5887C12D7E25C18FCC9430DB4PR06MB298eurprd_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

To the attention of fuwafuwa.moe webmaster,

Telefonica Espa=F1a is managing the fraudulent actions against Sociedad Est=
atal de Correos y Telegrafos  and all related with Phishing incidents again=
st this company.

We have detected that your website (https://fuwafuwa.moe/) is hosting a fra=
udulent website that offers java script (js) and css files used in a Phishi=
ng scam against Sociedad Estatal de Correos y Telegrafos  from the next URL=
(s):

hxxps://p.fuwafuwa.moe/qgrazk.css
hxxps://p.fuwafuwa.moe/urdelr.css
hxxps://p.fuwafuwa.moe/mdffth.css
hxxps://p.fuwafuwa.moe/nkjcoa.css
hxxps://p.fuwafuwa.moe/ygegkm.js
hxxps://p.fuwafuwa.moe/zdbkvk.js
hxxps://p.fuwafuwa.moe/ovisan.js
hxxps://p.fuwafuwa.moe/ifqnra.js
hxxps://p.fuwafuwa.moe/cbpisx.js
hxxps://p.fuwafuwa.moe/adkeer.js
hxxps://p.fuwafuwa.moe/vrmxsq.js
hxxps://p.fuwafuwa.moe/pyftal.js
hxxps://p.fuwafuwa.moe/mxkqsi.js
hxxps://p.fuwafuwa.moe/amwuzd.js
hxxps://p.fuwafuwa.moe/gtjjkc.js
hxxps://p.fuwafuwa.moe/ihibjo.js
hxxps://p.fuwafuwa.moe/eebxgu.js
hxxps://p.fuwafuwa.moe/hiqigm.js
hxxps://p.fuwafuwa.moe/wgzddk.js
hxxps://p.fuwafuwa.moe/wvczgj.js
hxxps://p.fuwafuwa.moe/cobvtt.js
hxxps://p.fuwafuwa.moe/puplbx.js
hxxps://p.fuwafuwa.moe/vivcvc.css
hxxps://p.fuwafuwa.moe/ypgwbn.css
hxxps://p.fuwafuwa.moe/btcpto.css
hxxps://p.fuwafuwa.moe/esaxve.css

The attacker has used its own servers to upload the files with intent to us=
e them to defraud in case the phishing  is turned off. We need your help in=
 order to prevent them to be used for that purpose. Could you please delete=
 those files?

I attach the evidence that we have found. It is the source of the compromis=
ed page, where you can see the call to your website.

The phishing is located at the following URLs:

hxxps://a.lainfile.pw/8E/detalle_app-sidioma=3Des_es.htm?//ss/Satellite/sit=
e/pagina-localizador_envios/busqueda-sidioma=3Des_ES
hxxps://a.lainfile.pw/7L/1.html

This fraudulent content represents a misuse of the intellectual property of=
 Sociedad Estatal de Correos y Telegrafos , as well as to obtain personal i=
nformation of their customers in order to get fraudulent access into their =
bank accounts, use their credit cards, etc... We need your collaboration fo=
r stopping this fraud, getting offline these fraudulent files.

We keep waiting for your feedback against this incident. If you need furthe=
r information please contact our SOC 24/7 at +34 900 102 230 (option 9)

Best regards.

-----------------------------------------------------------
CyberThreats - Anti-Fraud Service
Telef=F3nica Espa=F1a

Phone: +34 900102230 (option 9)
Email: phishing@telefonica.com<mailto:phishing@telefonica.com>
         servicio.antifraude@telefonica.com<mailto:servicio.antifraude@tele=
fonica.com>
-----------------------------------------------------------


--_000_DB4PR06MB29879D5887C12D7E25C18FCC9430DB4PR06MB298eurprd_