Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- DocuSign Themed Phish
- The following includes details and indicators related to a DocuSign themed phish. It is currently still active as of 20170606.
- ---------------------------------------------------------
- Sender: margaret@chevcon.com
- *Email Subject:* Action Required: New Contract Offer Letter sent via Docu Sign From Chevcon
- ----------------------------------------------------------
- *Email Body Content:*
- Kindly review the attached file sent via Docu Sign.
- Let me know your review
- Thanks
- M
- -------------------------------------------------------
- A DocuSign secure link themed .pdf file was attached to the email:
- 967b6ab06251bacbb1d4c54350b7826dbdc094854082f4ec9bfe8fb0d436eb4c.pdf
- - SHA256: 967b6ab06251bacbb1d4c54350b7826dbdc094854082f4ec9bfe8fb0d436eb4c
- --------------------------------------------------------
- A Link to the initial phish page was found in the pdf: http://prothidetion[.]com/ipatch/
- --------------------------------------------------------
- Screenshot Initial Phish Landing Page: http://imgur.com/a/zRlay
- --------------------------------------------------------
- Successfully phished credentials are sent to the following IP: 178.159.36.185
Add Comment
Please, Sign In to add comment
