From: JESUS MAQUEDA BUENO <jesus.maquedabueno.ext@telefonica.com>
To: "hostmaster@online.net" <hostmaster@online.net>, "abuse@online.net" <abuse@online.net>
CC: DS_TSOL_phishing <phishing@telefonica.com>, Les De Ridder <les@fuwafuwa.moe>, "cert-fr.cossi@ssi.gouv.fr" <cert-fr.cossi@ssi.gouv.fr>
Subject: We have detected that Online S.a.s is hosting a fraudulent website
Thread-Topic: We have detected that Online S.a.s is hosting a fraudulent website
Thread-Index: AdKE0UckTskOFbZlR3uEBhy/LTJ1nw==
Date: Sun, 12 Feb 2017 01:53:32 +0000
Message-ID: <AM5PR0601MB2402F6A6AC33A363675D6960A9460@AM5PR0601MB2402.eurprd06.prod.outlook.com>
Accept-Language: es-ES, en-US
Content-Language: es-ES
received-spf: None (protection.outlook.com: telefonica.com does not designate permitted sender hosts)
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: multipart/mixed; boundary="_013_AM5PR0601MB2402F6A6AC33A363675D6960A9460AM5PR0601MB2402_"
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-originalarrivaltime: 12 Feb 2017 01:53:32.8819 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 9744600e-3e04-492e-baa1-25ec245c6f10
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM5PR0601MB2404

 To the attention of Online S.a.s,
 
Telefonica España is managing the fraudulent actions against La Caixa and all related with Phishing incidents against this company.
 
We have detected that Online S.a.s. is hosting a fraudulent website that offers a Phishing scam against Sociedad Estatal de Correos y Telégrafos S.A.  from the next URL(s):
 
hxxps://p.fuwafuwa.moe/qgrazk.css
hxxps://p.fuwafuwa.moe/urdelr.css
hxxps://p.fuwafuwa.moe/mdffth.css
hxxps://p.fuwafuwa.moe/nkjcoa.css
hxxps://p.fuwafuwa.moe/ygegkm.js
hxxps://p.fuwafuwa.moe/zdbkvk.js
hxxps://p.fuwafuwa.moe/ovisan.js
hxxps://p.fuwafuwa.moe/ifqnra.js
hxxps://p.fuwafuwa.moe/cbpisx.js
hxxps://p.fuwafuwa.moe/adkeer.js
hxxps://p.fuwafuwa.moe/vrmxsq.js
hxxps://p.fuwafuwa.moe/pyftal.js
hxxps://p.fuwafuwa.moe/mxkqsi.js
hxxps://p.fuwafuwa.moe/amwuzd.js
hxxps://p.fuwafuwa.moe/gtjjkc.js
hxxps://p.fuwafuwa.moe/ihibjo.js
hxxps://p.fuwafuwa.moe/eebxgu.js
hxxps://p.fuwafuwa.moe/hiqigm.js
hxxps://p.fuwafuwa.moe/wgzddk.js
hxxps://p.fuwafuwa.moe/wvczgj.js
hxxps://p.fuwafuwa.moe/cobvtt.js
hxxps://p.fuwafuwa.moe/puplbx.js
hxxps://p.fuwafuwa.moe/vivcvc.css
hxxps://p.fuwafuwa.moe/ypgwbn.css
hxxps://p.fuwafuwa.moe/btcpto.css
hxxps://p.fuwafuwa.moe/esaxve.css
hxxps://p.fuwafuwa.moe/ujnicm.css
 
These files aren’t phishing scam but are being used as part of a phishing scam against the state post office of Spain (Correos y Telegrafos).
You can check on the source code of the deleted phishing scam that is previosly hosted in your servers:

hxxps://a.lainfile.pw/8E/detalle_app-sidioma=es_es.htm?//ss/Satellite/site/pagina-localizador_envios/busqueda-sidioma=es_ES
 
image001.jpg
 
These files are a copy of the JS/CSS of the original website of Correos with the name changed to avoid it could be compared, but if you check the content could see that have references to Correos website and paths of the original server:
 
hxxps://p.fuwafuwa.moe/wgzddk.js
 
             
image002.jpg
 
Also you can compare the original files on Correos website and the ones that have been uploaded to your server and see that this is a copy with the same configuration:
 
image003.jpgimage004.jpg
 
And the same MD5:
 
image005.jpg
image006.jpg
 
You can check by yourself using any progam or website that compare MD5 checksum of files.
 
All these evidences are enougth to us to state that these files have been downloaded since Correos website, modified their filename to avoid detection and uploaded to a diferent server to persist if the phishing site gone and use it on future attacks. This not the first time we seen this tactic and this is the reason we request you the delete of this files.
 
So please, check this information, don’t hesitate to request us more information or detail if you think that these evidences are not enough and take the actions you consider against this fraudulent files in order to avoid it could be used on future attacks.
Regards.