[Full-disclosure] Phone Scam

[Jacqui Caren-home]

On 20/07/2011 14:19, Dave wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> OK This is not new, but it happened to me just an hour ago.
>
> A stranger on the end of a phone call tells you your PC is infected, and you should download and install a RC server so it can be fixed.

SOP.

> I just been through this and installed Ammyy admin from ammyy.com (Whois - dataguarded) as per the strangers instruction on a VM XP install.
> Nothing to see here, so what, big deal etc. etc.
>
> What maybe interesting to some is the IP address it connected to:
> prag178.startdedicated.com 62.75.224.229 ports 443, 80, 8080

remarks:         *        ABUSE-Complaints are only handled at:         *
remarks:         *                  ABUSE at plusserver.de                 *

> I reveal the IP address for those of you who might like to update IPTables, databases or just like to write down numbers.

Or just block any traffic to or from plusserver.de - they do not have a good spam/abuse rep.

route:           62.75.128.0/17
descr:           Plusserver AG
origin:          AS8972
mnt-by:          INTERGENIA-MNT
mnt-lower:       INTERGENIA-MNT
source:          RIPE # Filtered