Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 2 down vote favorite

A close friend fell for a phishing scam earlier today. His account's all squared up now, but I decided to do a bit of investigation.

The website he fell for was a very poor imitation of a Remax site hosted on what appears to be a compromised domain. The email address that the captured passwords were being sent to is plainly obvious in the site's script. It's a GMail address, and given the recency of attacks I'd say it is still actively being used to harvest logins.

So, armed with that information, I would like to have the account taken down to prevent the (probable script kiddie) from inflicting any more damage. What's the best way to report a suspected phisher's email address?

I am aware that the email address may (a) belong to a legitimate user who is unaware that it is being used nefariously, or (b) be a very temporary account that is simply used to collect addresses. So I am not about to do anything stupid to the account itself, nor am I going to attempt to contact it. I am simply wondering if anyone has any advice, or if I should just forget about it (though I do wish to prevent this unfortunate thing from happening to others).

share|improve this question
How can a website send login credentials to an email address with JavaScript? – Matrix Mar 11 at 7:22
It was a POST to a PHP script. But the email address is plainly visible in the JS. – James Elegan Mar 15 at 16:51

3 Answers

up vote 3 down vote accepted

Since it's so easy to anonymously register an email address, I doubt it belongs to a legitimate user. Legitimate servers/websites are often hijacked for use in phising/malware distribution/C&C since it can make attacks look more legitimate, and because it's easier than to anonymously pay for and run it. This doesn't really apply to emails.

I absolutely think you should report it.

Since it's Google, you can report it here:

I wouldn't expect a response though. As is often the case with reports like this; they may go ignored. I've not personally dealt with Google regarding problems like this so maybe they handle it well.

share|improve this answer
Thank you for the fast response!! But, I'm not really sure how I should tell them about it -- do I just say "I know this is being used by a phisher"? Should I explain how I got the email? – James Elegan Mar 10 at 23:26
I would give you a vote but I can't because I don't have 15 reputation – James Elegan Mar 10 at 23:28
I'd include the same information as you did here. Keep it concise and include links to proof of it being used. If your friend interacted with the email address in question (in particular if he's also using gmail), include that information as well. – GBC Mar 10 at 23:29
Neither of us directly interacted with the attacker's email. I just know it's his email because that's where the script is sending the passwords to. – James Elegan Mar 10 at 23:32
OK, I sent it off to that first link. It wasn't a content issue so I don't think the second link applies. Let's hope this gets a positive resolution. Thank you for your help. – James Elegan Mar 10 at 23:41
up vote 1 down vote

You may better luck reporting the actual site with the compromised pages... I recommend submitting to phishtank here :

http://www.phishtank.com/

share|improve this answer
I already reported every site I found to the Google bad site list. Should I also report to phish tank, or would that be redundant? – James Elegan Mar 15 at 16:52
Up to you, but google, to me, always seems like a black hole. At phishtank, your submission will at least get reviews by the community and could then be of benefit to opendns users like me! – BrianAdkins Mar 15 at 17:59
Try Netcraft: toolbar.netcraft.com/report_url you can also report forward phishing mails to scam@netcraft.com. See, news.netcraft.com/archives/2013/04/03/… for example. – Matt Apr 17 at 7:19
up vote 0 down vote

Contact the host/ISP that the headers show the email came from.

share|improve this answer
1  
Hi, can you please expand your answer with more details? – Terry Chia Mar 12 at 13:28

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.