Stealing Yahoo! login details

freebird

There is a URL http://www.geocities.com/hott_new_pics_for_you17/ floating around for some days which steals yahoo ids of users.

The login form in the page POSTS the form data to ” http://www2.fiberbit.net/form/mailto.cgi” This cgi script sends the Username and Password to the mail id : staff.yahoo.mail.team@gmail.com in the following format.

____________________________

送信元ホスト名: MY_ISP / IP
送信元ブラウザ: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv: Gecko/20060728 Firefox/1.5.0.6
送信元ＵＲＬ　:login = fgfg
passwd = gfgg
.save = Sign In
____________________________

The following mail id occurs when there is an error in form sumbission: root@www2.kjps.net

This entry was posted on Thursday, August 17th, 2006 at 2:35 pmand is filed under machine. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.