4

A close friend fell for a phishing scam earlier today. His account's all squared up now, but I decided to do a bit of investigation.

The website he fell for was a very poor imitation of a Remax site hosted on what appears to be a compromised domain. The email address that the captured passwords were being sent to is plainly obvious in the site's script. It's a GMail address, and given the recency of attacks I'd say it is still actively being used to harvest logins.

So, armed with that information, I would like to have the account taken down to prevent the (probable script kiddie) from inflicting any more damage. What's the best way to report a suspected phisher's email address?

I am aware that the email address may (a) belong to a legitimate user who is unaware that it is being used nefariously, or (b) be a very temporary account that is simply used to collect addresses. So I am not about to do anything stupid to the account itself, nor am I going to attempt to contact it. I am simply wondering if anyone has any advice, or if I should just forget about it (though I do wish to prevent this unfortunate thing from happening to others).

2
  • 1
    How can a website send login credentials to an email address with JavaScript?
    – Matrix
    Mar 11, 2013 at 7:22
  • 1
    It was a POST to a PHP script. But the email address is plainly visible in the JS. Mar 15, 2013 at 16:51

3 Answers 3

4

Since it's so easy to anonymously register an email address, I doubt it belongs to a legitimate user. Legitimate servers/websites are often hijacked for use in phising/malware distribution/C&C since it can make attacks look more legitimate, and because it's easier than to anonymously pay for and run it. This doesn't really apply to emails.

I absolutely think you should report it.

Since it's Google, you can report it here:

I wouldn't expect a response though. As is often the case with reports like this; they may go ignored. I've not personally dealt with Google regarding problems like this so maybe they handle it well.

5
  • Thank you for the fast response!! But, I'm not really sure how I should tell them about it -- do I just say "I know this is being used by a phisher"? Should I explain how I got the email? Mar 10, 2013 at 23:26
  • I would give you a vote but I can't because I don't have 15 reputation Mar 10, 2013 at 23:28
  • I'd include the same information as you did here. Keep it concise and include links to proof of it being used. If your friend interacted with the email address in question (in particular if he's also using gmail), include that information as well.
    – GBC
    Mar 10, 2013 at 23:29
  • Neither of us directly interacted with the attacker's email. I just know it's his email because that's where the script is sending the passwords to. Mar 10, 2013 at 23:32
  • OK, I sent it off to that first link. It wasn't a content issue so I don't think the second link applies. Let's hope this gets a positive resolution. Thank you for your help. Mar 10, 2013 at 23:41
1

You may better luck reporting the actual site with the compromised pages... I recommend submitting to phishtank here :

http://www.phishtank.com/

3
  • I already reported every site I found to the Google bad site list. Should I also report to phish tank, or would that be redundant? Mar 15, 2013 at 16:52
  • Up to you, but google, to me, always seems like a black hole. At phishtank, your submission will at least get reviews by the community and could then be of benefit to opendns users like me! Mar 15, 2013 at 17:59
  • Try Netcraft: toolbar.netcraft.com/report_url you can also report forward phishing mails to [email protected]. See, news.netcraft.com/archives/2013/04/03/… for example.
    – Matt
    Apr 17, 2013 at 7:19
0

Contact the host/ISP that the headers show the email came from.

1
  • 1
    Hi, can you please expand your answer with more details?
    – user10211
    Mar 12, 2013 at 13:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .