From: MADALINA MARIA MARGINEAN <madalinamaria.marginean.ext@telefonica.com>
To: "les@fuwafuwa.moe" <les@fuwafuwa.moe>
CC: DS_TSOL_phishing <phishing@telefonica.com>
Subject: RE: We have detected that fuwafuwa.moe is hosting a fraudulent website
Thread-Topic: RE: We have detected that fuwafuwa.moe is hosting a fraudulent website
Thread-Index: AdKDwAqPoIDdjrSCSB27zMC/P7kLXw==
Date: Fri, 10 Feb 2017 17:21:35 +0000
Message-ID: <DB4PR06MB298B4BA591B10D953CB2F7EC9440@DB4PR06MB298.eurprd06.prod.outlook.com>
Accept-Language: en-US
Content-Language: es-ES
received-spf: None (protection.outlook.com: telefonica.com does not designate permitted sender hosts)
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: multipart/mixed; boundary="_011_DB4PR06MB298B4BA591B10D953CB2F7EC9440DB4PR06MB298eurprd_"
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-originalarrivaltime: 10 Feb 2017 17:21:35.7350 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 9744600e-3e04-492e-baa1-25ec245c6f10
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB4PR06MB298

--_011_DB4PR06MB298B4BA591B10D953CB2F7EC9440DB4PR06MB298eurprd_
Content-Type: multipart/related; boundary="_010_DB4PR06MB298B4BA591B10D953CB2F7EC9440DB4PR06MB298eurprd_"; type="multipart/alternative"

--_010_DB4PR06MB298B4BA591B10D953CB2F7EC9440DB4PR06MB298eurprd_
Content-Type: multipart/alternative; boundary="_000_DB4PR06MB298B4BA591B10D953CB2F7EC9440DB4PR06MB298eurprd_"

--_000_DB4PR06MB298B4BA591B10D953CB2F7EC9440DB4PR06MB298eurprd_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Dear Les,

These files aren't phishing scam but are being used as part of a phishing s=
cam against the state post office of Spain (Correos y Telegrafos) as my col=
league refer on previosly emails and as you can check on the source code of=
 the deleted phishing scam that is previosly hosted in your servers:

hxxps://a.lainfile.pw/8E/detalle_app-sidioma=3Des_es.htm?//ss/Satellite/sit=
e/pagina-localizador_envios/busqueda-sidioma=3Des_ES

[cid:image001.jpg@01D283C7.7B2D69B0]

These files are a copy of the JS/CSS of the original website of Correos wit=
h the name changed to avoid it could be compared, but if you check the cont=
ent could see that have references to Correos website and paths of the orig=
inal server:

hxxps://p.fuwafuwa.moe/wgzddk.js

             [cid:image002.jpg@01D283C7.7B2D69B0]

Also you can compare the original files on Correos website and the ones tha=
t have been uploaded to your server and see that this is a copy with the sa=
me configuration:

[cid:image003.jpg@01D283C7.7B2D69B0][cid:image004.jpg@01D283C7.7B2D69B0]

And the same MD5:

[cid:image005.jpg@01D283C7.7B2D69B0]
[cid:image006.jpg@01D283C7.7B2D69B0]

You can check by yourself using any progam or website that compare MD5 chec=
ksum of files.

All these evidences are enougth to us to state that these files have been d=
ownloaded since Correos website, modified their filename to avoid detection=
 and uploaded to a diferent server to persist if the phishing site gone and=
 use it on future attacks. This not the first time we seen this tactic and =
this is the reason we request you the delete of this files.

So please, check this information, don't hesitate to request us more inform=
ation or detail if you think that these evidences are not enougth and take =
the actions you consider against this fraudulent files in order to avoid it=
 could be used on future attacks.

Regards.
-----------------------------------------------------------
CyberThreats - Anti-Fraud Service
Telef=F3nica Espa=F1a
Phone: +34 900102230<tel:+34%20900%20102%20230> (option 9)
Email: phishing@telefonica.com<mailto:phishing@telefonica.com>
             servicio.antifraude@telefonica.com<mailto:servicio.antifraude@=
telefonica.com>

-----------------------------------------------------------