Bank of the west notice (sigh)

Well, how long ago was I talking about phishing attacks? Just a few posts back it seems and in my inbox this evening was the above subject line. It's almost funny, since I don't actually HAVE an account with Bank of the West, but since I was feeling a bit curious I thought I'd pick it apart, see where it came from and where the site was hosted.

It turns out that if you can view the source of a message you can see the destination of the links contained in that message, so where it had a hyperlink to Bank of the West, in the source was a reference like this http://www.bankofthewest...blahblah So, I took a look at the following address http://sitehostingscam.com/admin/.../BOW/ kind of bypassing their entry page and got a directory listing. I worked my way up and found an IT company in Australia.

My guess is that it's a php exploit that they've fallen victim to, but I don't know (the admin page appears to be a login for some sort of CMS system.) I sent an email to their webmaster and abuse addresses hoping that someone will see it. I gave the link that the email contained and sent along the phishy message, telling them that their server was being used to host the scam. After exploring a bit more, I came across a directory where their pages had been logging each IP address that requested the page and inside a file for the IP was either account numbers in some cases or abusive comments for the phishers in other cases. (Looks like there are quite a few folks that see it for what it is.)

I sent a second message along to the abuse/webmaster addresses because it appears that there were a few folks that did put in what could be account number information. I have no way of knowing that, but hopefully the IT folks will lock things down in quick order and find the source of the problem.